Raghunandan Bhat e87b958d2e MDEV-40422: MSAN: use-of-uninitialized-value in my_convert ...

Problem:
  `Item::val_str()` may return a String that points to the buffer it was
  given instead of copying the value into it. For eg: CAST(expr AS CHAR)
  does so when there's nothing to convert, RIGHT() and SUBSTR() when
  they return a fragment.

  `Item_copy_string::copy()` hands its own str_value buffer to such a
  val_str() and then compares String objects, not the buffers behind
  them, so it doesn't notice the reuse and copies the buffer onto itself.
  `String::copy()` needs one byte more for the terminating '\0' and
  adjusting it frees the old buffer before allocating the new one, so
  the copy reads freed memory.

Fix:
  Add `String::copy_maybe_substring()` to handle a source that points
  into the destination's buffer. When the whole buffer is reused, only
  length and character set are taken over. For a fragment, it is moved
  to the beginning of the buffer without re-allocating using the newly
  added `Binary_string::bmove_from()`.

2026-09-24 17:05:58 +05:30

38 KiB

Raw Blame History

View Raw