database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-01-06 05:22:24 +03:00
Code Activity

BUG#21856: Prepared Statements: crash if bad create

Browse Source 
When statement to be prepared contained CREATE PROCEDURE, CREATE FUNCTION
or CREATE TRIGGER statements with a syntax error in it, the preparation
would fail with syntax error message, but the memory could be corrupted.

The problem occurred because we switch memroot when parse stored
routine or trigger definitions, and on parse error we restored the
original memroot only after performing some memory operations.  In more
detail:
 - prepared statement would activate its own memory root to parse
   the definition of the stored procedure.
 - SP would reset this memory root with its own memory root to
   parse SP statements
 - a syntax error would happen
 - prepared statement would restore the original memory root
 - stored procedure would restore what it thinks was the original
   memory root, but actually was the statement memory root.
That led to double free - in destruction of the statement and in
a next call to mysql_parse().

The solution is to restore memroot right after the failed parsing.


mysql-test/r/ps.result:
  Add result for bug#21856: Prepared Statements: crash if bad create.
mysql-test/t/ps.test:
  Add test case for bug#21856: Prepared Statements: crash if bad create.
sql/sql_parse.cc:
  On parse error if thd->lex->sphead is set we have to free sp_head object
  to restore statement memroot, if it was switched during parsing.
  
  The change here is for safety, currently query_cache_abort() and
  lex->unit.cleanup() calls do not use current memroot.
sql/sql_prepare.cc:
  On parse error if thd->lex->sphead is set we have to free sp_head object
  to restore statement memroot, if it was switched during parsing.
This commit is contained in:
unknown
2006-10-19 14:43:52 +04:00
parent 7c99f644ce
commit ef2d2165d1
4 changed files with 39 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
sql/sql_parse.cc
View File

@@ -5852,14 +5852,19 @@ void mysql_parse(THD *thd, char *inBuf, uint length)
DBUG_ASSERT(thd->net.report_error);
DBUG_PRINT("info",("Command aborted. Fatal_error: %d",
thd->is_fatal_error));
query_cache_abort(&thd->net);
lex->unit.cleanup();
/*
The first thing we do after parse error is freeing sp_head to
ensure that we have restored original memroot.
*/
if (thd->lex->sphead)
{
/* Clean up after failed stored procedure/function */
delete thd->lex->sphead;
thd->lex->sphead= NULL;
}
query_cache_abort(&thd->net);
lex->unit.cleanup();
}
thd->proc_info="freeing items";
thd->end_statement();