mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-05-07 23:54:31 +02:00
Code Issues Projects Releases Packages Wiki Activity

MDEV-36723 Fix an MSAN caused by memcmp going over a string boundary

Browse source 
When spider tries to find a partition matching a name passed from the
sql layer, it construct the partition name with NORMAL_PART_NAME.
However, the name passed from the sql layer could be constructed with
other types of name, such as TEMP_PART_NAME, which is a longer string.
Spider does handle TEMP_PART_NAME in other places of
spider_get_partition_info, but overall it is not able to handle
partition changes involving redistributing data to partitions which
can result in TEMP_PART_NAME. That is a more involved issue. In this
patch, we simply follow the existing intended logic and fix the MSAN
complaint.
This commit is contained in:
Yuchen Pei 2025-09-05 11:03:49 +10:00
commit 0a4315509b
No known key found for this signature in database
GPG key ID: 3DD1B35105743563
2 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
storage/spider/ha_spider.cc
View file

@ -7875,7 +7875,7 @@ int ha_spider::create(
SPIDER_ALTER_PARTITION_COALESCE | SPIDER_ALTER_PARTITION_REORGANIZE |
SPIDER_ALTER_PARTITION_TABLE_REORG | SPIDER_ALTER_PARTITION_REBUILD
)
) &&
) && /* Does not support PART_CHANGED */
memcmp(name + strlen(name) - 5, "#TMP#", 5)
) {
need_lock = TRUE;

6
storage/spider/spd_table.cc
View file

@ -6775,7 +6775,8 @@ void spider_get_partition_info(
DBUG_VOID_RETURN;
}
DBUG_PRINT("info",("spider tmp_name=%s", tmp_name));
if (!memcmp(table_name, tmp_name, table_name_length + 1))
if (table_name_length == strlen(tmp_name) &&
!strncmp(table_name, tmp_name, table_name_length))
DBUG_VOID_RETURN;
if (
tmp_flg &&
@ -6796,7 +6797,8 @@ void spider_get_partition_info(
DBUG_VOID_RETURN;
}
DBUG_PRINT("info",("spider tmp_name=%s", tmp_name));
if (!memcmp(table_name, tmp_name, table_name_length + 1))
if (table_name_length == strlen(tmp_name) &&
!strncmp(table_name, tmp_name, table_name_length))
DBUG_VOID_RETURN;
if (
tmp_flg &&