1
0
mirror of https://github.com/MariaDB/server.git synced 2025-12-16 22:03:23 +03:00
Files
mariadb/sql
Praveenkumar Hulakund e6663e70fb Bug#14466617 - INVALID WRITES AND/OR CRASH WITH USER
VARIABLES 

Analysis:
-------------
After executing the query, new value of the user defined
variables are set in the function "select_dumpvar::send_data".
"select_dumpvar::send_data" first calls function 
"Item_func_set_user_var::save_item_result()". This function
checks the nullness of the Item_field passed as parameter 
to it and saves it. The nullness of item is stored with 
arg[0]'s null_value flag. Then "select_dumpvar::send_data" calls
"Item_func_set_user_var::update()" which notices null 
result that was saved and calls "Item_func_set_user_var::
update_hash". But here null_value is not set and args[0]
is different from that given to function "Item_func_set_user_var::
set_item_result()". This causes "Item_func_set_user_var::
update_hash" function to believe that its getting non-null value.
"user_var_entry::length" set to 0 and hence "user_var_entry::value"
is made to point to extra_area allocated in "user_var_entry".
And "Item_func_set_user_var::update_hash" tries to write
at memory beyond extra_area for result type DECIMAL. Because of 
this invalid write issue is reported by Valgrind.

Before this bug was introduced, we avoided this problem by 
creating "Item_func_set_user_var" object with the same 
Item_field as arg[0] and as parameter to 
Item_func_set_user_var::save_item_result(). But now 
they are refering to different args[0]. Because of this
null_value flag set in parameter Item_field in function
"Item_func_set_user_var::save_item_result()" is not
reflected in "Item_func_set_user_var" object.

Fix:
------------
This issue is reported on versions 5.5.24. Issue does not exists
in 5.5.23, 5.1, 5.6 and trunk.

This issue was introduced by
revid:georgi.kodinov@oracle.com-20120309130449-82e3bs5v3et1x0ef (fix for
bug #12408412), which was pushed into 5.5 and later releases. This patch
has later been reversed in 5.6 and trunk by
revid:norvald.ryeng@oracle.com-20121010135242-xj34gg73h04hrmyh (fix for
bug #14664077). Backported this patch in 5.5 also to fix this issue.
2012-11-07 19:08:33 +05:30
..
2011-06-30 17:31:31 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-05-21 10:21:08 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-07-04 01:25:49 +02:00
2012-05-07 22:20:42 +02:00
2012-06-29 18:38:29 +04:00
2012-05-07 22:20:42 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-09-25 16:17:13 +02:00
2012-02-24 11:55:28 +05:30
2011-07-04 01:25:49 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-08-06 10:40:03 +05:30
2011-07-03 17:47:37 +02:00
2012-02-15 17:13:47 +01:00
2011-06-30 17:46:53 +02:00
2012-08-09 15:50:29 +04:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-09-22 18:07:04 +05:30
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-07-03 17:47:37 +02:00
2012-02-15 17:21:38 +01:00
2012-09-25 13:20:00 +02:00
2011-06-30 17:31:31 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-05-07 22:20:42 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-02-16 10:48:16 +01:00
2011-06-30 17:46:53 +02:00
2012-02-16 10:48:16 +01:00
2012-02-16 10:48:16 +01:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-05-07 22:20:42 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-07-10 14:37:35 +05:30
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-03-06 13:47:57 +01:00
2011-06-30 17:46:53 +02:00
2012-02-16 10:48:16 +01:00
2012-02-16 10:48:16 +01:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-08-17 13:18:56 +04:00
2012-08-17 13:18:56 +04:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-07-04 01:25:49 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-09-22 18:07:04 +05:30
2011-03-07 10:08:10 +01:00
2011-07-04 01:25:49 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-02-16 10:48:16 +01:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:37:13 +02:00
2011-06-30 17:46:53 +02:00
2012-09-22 18:07:04 +05:30
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-10-01 15:57:37 +02:00
2011-06-30 17:46:53 +02:00
2012-09-12 08:59:44 +02:00
2012-09-22 18:07:04 +05:30
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-07-26 23:53:45 +05:30
2011-06-30 17:46:53 +02:00
2012-10-12 22:59:21 +02:00
2012-10-12 22:59:21 +02:00
2011-11-17 09:00:58 +01:00
2010-12-07 16:11:13 +00:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-07-03 17:47:37 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-09-22 18:07:04 +05:30
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-02-15 17:13:47 +01:00
2012-07-26 15:06:43 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-07-04 01:25:49 +02:00
2011-07-04 01:25:49 +02:00
2012-09-22 18:07:04 +05:30
2012-02-16 10:48:16 +01:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-10-09 12:25:02 +05:30
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:37:13 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-03-27 14:55:29 +02:00
2012-01-27 13:21:21 +01:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-07-04 01:25:49 +02:00
2012-02-15 17:21:38 +01:00