1
0
mirror of https://github.com/MariaDB/server.git synced 2026-10-23 18:49:29 +03:00
Files
mariadb/mysql-test/suite/binlog/r/fdle_overflow.result
ParadoxV5 52a2bc27cc MDEV-40647 OOB read in IO Thread if the FDEv does not support Rotate Events
If the replication IO Thread receives a Rotate event following a Format
Description event (FDE) with no post-header length for Rotate events,
the Rotate event’s parser constructor indexes
the FDE’s post-header lengths array out of bounds.
This commit defends against this situation by checking before the
constructor that the FDE describes Rotate events as recognized at all.

In practice, because the Binlog Dump thread generates a Fake
`ROTATE_EVENT` **before** sending the FDE, it has pinned
Rotate events’ post-header length to 8 regardless of FDEs.
This fix solution considers that the FDE’s description should still be
respected, matching the constructor.

Reviewed-by: Kristian Nielsen <knielsen@knielsen-hq.org>
2026-08-11 15:36:37 -06:00

11 lines
457 B
Plaintext

SET @saved_dbug= @@GLOBAL.debug_dbug;
SET @@GLOBAL.debug_dbug=
'+d,truncate_fde_post_header_len,truncate_fde_used_checksum_alg';
FLUSH BINARY LOGS;
ERROR HY000: Error when executing command SHOW BINLOG EVENTS: Wrong offset or I/O error
SET @@GLOBAL.debug_dbug= '+d,truncate_fde_common_header_len';
FLUSH BINARY LOGS;
ERROR HY000: Error when executing command SHOW BINLOG EVENTS: Wrong offset or I/O error
SET @@GLOBAL.debug_dbug= @saved_dbug;
RESET MASTER;