1
0
mirror of https://github.com/MariaDB/server.git synced 2026-10-23 18:49:29 +03:00
Neeraj Bisht 7b099fd9e3 Bug#16614004 - CRASH AFTER READING FREED MEMORY AFTER DOING DDL
IN STORED ROUTINE

Inside a loop in a stored procedure, we create a partitioned
table. The CREATE statement is thus treated as a prepared statement:
it is prepared once, and then executed by each iteration. Thus its Lex
is reused many times. This Lex contains a part_info member, which
describes how the partitions should be laid out, including the
partitioning function. Each execution of the CREATE does this, in
open_table_from_share ():
    
       tmp= mysql_unpack_partition(thd, share->partition_info_str,
                                   share->partition_info_str_len,
                                   outparam, is_create_table,
                                   share->default_part_db_type,
                                   &work_part_info_used);
    ...
       tmp= fix_partition_func(thd, outparam, is_create_table);
The first line calls init_lex_with_single_table() which creates
a TABLE_LIST, necessary for the "field fixing" which will be
done by the second line; this is how it is created:
     if ((!(table_ident= new Table_ident(thd,
                                         table->s->db,
                                         table->s->table_name, TRUE))) ||
         (!(table_list= select_lex->add_table_to_list(thd,
                                                      table_ident,
                                                      NULL,
                                                       0))))
          return TRUE;
  it is allocated in the execution memory root.
Then the partitioning function ("id", stored in Lex -> part_info)
  is fixed, which calls Item_ident:: fix_fields (), which resolves
"id" to the table_list above, and stores in the item's
cached_table a pointer to this table_list. 
The table is created, later it is dropped by another statement,
then we execute again the prepared CREATE. This reuses the Lex,
thus also its part_info, thus also the item representing the
partitioning function (part_info is cloned but it's a shallow
cloning); CREATE wants to fix the item again (which is
normal, every execution fixes items again), fix_fields ()
sees that the cached_table pointer is set and picks up the
pointed table_list. But this last object does not exist
anymore (it was allocated in the execution memory root of
the previous execution, so it has been freed), so we access
invalid memory.

The solution: when creating the table_list, mark that it
cannot be cached.
2013-08-12 19:46:44 +05:30
2013-05-16 09:01:11 +02:00
2011-06-30 17:46:53 +02:00
2013-05-23 11:06:34 +05:30

MySQL Server 5.5

This is a release of MySQL, a dual-license SQL database server.
For the avoidance of doubt, this particular copy of the software 
is released under the version 2 of the GNU General Public License. 
MySQL is brought to you by Oracle.

Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.

License information can be found in the COPYING file.

MySQL FOSS License Exception
We want free and open source software applications under certain
licenses to be able to use specified GPL-licensed MySQL client
libraries despite the fact that not all such FOSS licenses are
compatible with version 2 of the GNU General Public License.  
Therefore there are special exceptions to the terms and conditions 
of the GPLv2 as applied to these client libraries, which are 
identified and described in more detail in the FOSS License 
Exception at 
<http://www.mysql.com/about/legal/licensing/foss-exception.html>.

This distribution may include materials developed by third
parties. For license and attribution notices for these
materials, please refer to the documentation that accompanies
this distribution (see the "Licenses for Third-Party Components"
appendix) or view the online documentation at 
<http://dev.mysql.com/doc/>.

GPLv2 Disclaimer
For the avoidance of doubt, except that if any license choice
other than GPL or LGPL is available it will apply instead, 
Oracle elects to use only the General Public License version 2 
(GPLv2) at this time for any software where a choice of GPL 
license versions is made available with the language indicating 
that GPLv2 or any later version may be used, or where a choice 
of which version of the GPL is applied is otherwise unspecified.

For further information about MySQL or additional documentation, 
see:
- The latest information about MySQL: http://www.mysql.com
- The current MySQL documentation: http://dev.mysql.com/doc

Some Reference Manual sections of special interest:
- If you are migrating from an older version of MySQL, please 
  read the "Upgrading from..." section.
- To see what MySQL can do, take a look at the features section.
- For installation instructions, see the Installing and Upgrading
  chapter.
- For the new features/bugfix history, see the MySQL Change History 
  appendix.

You can browse the MySQL Reference Manual online or download it 
in any of several formats at the URL given earlier in this file.
Source distributions include a local copy of the manual in the
Docs directory.
Description
Сервер MariaDB - это разработанный сообществом форк сервера MySQL
https://mariadb.org Readme 2.7 GiB
Languages
MariaDB\ 71.8%
C++ 16.5%
C 10.3%
Shell 0.5%
Perl 0.4%
Other 0.3%