database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-07 00:04:31 +03:00
Code Activity

BUG#47598 - MyISAM may write uninitialized data to disk

Browse Source 
When MyISAM writes newly created index page it may be
initialized partially. In other words some bytes of
sensible data and uninitialized tail of the page may
go into index file.

Under certain rare circumstances these hunks of memory
may contain data that would be otherwise inaccessible
to user, like passwords or data from other tables.

Fixed by initializing memory for temporary MyISAM key
buffer to '\0'.

No test case for this fix as it is heavily covered by
existing tests.
This commit is contained in:
Sergey Vojtovich
2010-03-25 15:18:14 +04:00
parent f8a1823af3
commit e38e30d0f6
5 changed files with 7 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
storage/myisam/rt_split.c
View File

@@ -258,7 +258,7 @@ int rtree_split_page(MI_INFO *info, MI_KEYDEF *keyinfo, uchar *page, uchar *key,
double *old_coord;
int n_dim;
uchar *source_cur, *cur1, *cur2;
uchar *new_page;
uchar *new_page= info->buff;
int err_code= 0;
uint nod_flag= mi_test_if_nod(page);
uint full_length= key_length + (nod_flag ? nod_flag :
@@ -304,12 +304,7 @@ int rtree_split_page(MI_INFO *info, MI_KEYDEF *keyinfo, uchar *page, uchar *key,
goto split_err;
}
if (!(new_page = (uchar*)my_alloca((uint)keyinfo->block_length)))
{
err_code= -1;
goto split_err;
}
info->buff_used= 1;
stop = task + (max_keys + 1);
cur1 = rt_PAGE_FIRST_KEY(page, nod_flag);
cur2 = rt_PAGE_FIRST_KEY(new_page, nod_flag);
@@ -345,8 +340,6 @@ int rtree_split_page(MI_INFO *info, MI_KEYDEF *keyinfo, uchar *page, uchar *key,
DFLT_INIT_HITS, new_page);
DBUG_PRINT("rtree", ("split new block: %lu", (ulong) *new_page_offs));
my_afree((uchar*)new_page);
split_err:
my_afree((uchar*) coord_buf);
DBUG_RETURN(err_code);