mirror of
https://github.com/MariaDB/server.git
synced 2026-10-23 18:49:29 +03:00
52a2bc27cc
If the replication IO Thread receives a Rotate event following a Format Description event (FDE) with no post-header length for Rotate events, the Rotate event’s parser constructor indexes the FDE’s post-header lengths array out of bounds. This commit defends against this situation by checking before the constructor that the FDE describes Rotate events as recognized at all. In practice, because the Binlog Dump thread generates a Fake `ROTATE_EVENT` **before** sending the FDE, it has pinned Rotate events’ post-header length to 8 regardless of FDEs. This fix solution considers that the FDE’s description should still be respected, matching the constructor. Reviewed-by: Kristian Nielsen <knielsen@knielsen-hq.org>
39 lines
1.1 KiB
Plaintext
39 lines
1.1 KiB
Plaintext
--source include/have_debug.inc
|
|
--source include/have_binlog_format_mixed.inc # format-agnostic
|
|
|
|
# OOB read on malformed `Format_description_log_event`
|
|
#
|
|
# Verify that Format Description Events with truncated contents fails gracefully
|
|
# rather than underflow the post-header count and lead to buffer over-read.
|
|
|
|
SET @saved_dbug= @@GLOBAL.debug_dbug;
|
|
|
|
|
|
# MDEV-40366: `used_checksum_alg`
|
|
|
|
SET @@GLOBAL.debug_dbug=
|
|
'+d,truncate_fde_post_header_len,truncate_fde_used_checksum_alg';
|
|
FLUSH BINARY LOGS;
|
|
|
|
--let $binlog_file= query_get_value(SHOW BINLOG STATUS, File, 1)
|
|
--disable_query_log
|
|
--error ER_ERROR_WHEN_EXECUTING_COMMAND
|
|
--eval SHOW BINLOG EVENTS IN '$binlog_file'
|
|
--enable_query_log
|
|
|
|
|
|
# MDEV-40365: `common_header_len` & `post_header_len`
|
|
|
|
SET @@GLOBAL.debug_dbug= '+d,truncate_fde_common_header_len';
|
|
FLUSH BINARY LOGS;
|
|
|
|
--let $binlog_file= query_get_value(SHOW BINLOG STATUS, File, 1)
|
|
--disable_query_log
|
|
--error ER_ERROR_WHEN_EXECUTING_COMMAND
|
|
--eval SHOW BINLOG EVENTS IN '$binlog_file'
|
|
--enable_query_log
|
|
|
|
# Clean-up
|
|
SET @@GLOBAL.debug_dbug= @saved_dbug;
|
|
RESET MASTER;
|