mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-16 20:12:31 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Bug#16736412: THE SERVER WAS CRASHED WHILE EXECUTING

Browse source 
"SHOW BINLOG EVENTS"

Problem:
========
mysql was crashed after executing "show binlog events in
'mysql-bin.000005' from 99", the crash happened randomly.

Analysis:
========
During construction of LOAD EVENT or NEW LOAD EVENT object
if the starting offset is provided as incorrect value then
all the object members that are retrieved from the offset
are also invalid.  Some times it will lead to out of bound
address offsets.  In the bug scenario, the file name is
extracrated from an invalid address and the same is fed to
strlen(fname) function. Passing invalid address to strlen
will lead to crash.

Fix:
===
Validate if the given offset falls within the event boundary
or not.

sql/log_event.cc:
  Added code to validate fname's address. "fname" should
  be within event boundary. Added code to find invalid
  invents.
This commit is contained in:
Sujatha Sivakumar 2013-11-06 15:00:49 +05:30
parent 5f83a7fbf8
commit 2a2641ad7f
1 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
sql/log_event.cc
View file

@ -4711,11 +4711,22 @@ int Load_log_event::copy_log_event(const char *buf, ulong event_len,
fields = (char*)field_lens + num_fields;
table_name = fields + field_block_len;
db = table_name + table_name_len + 1;
DBUG_EXECUTE_IF ("simulate_invalid_address",
db_len = (4294967294U););
fname = db + db_len + 1;
if (fname > buf_end)
goto err;
fname_len = (uint) strlen(fname);
if (fname + fname_len > buf_end)
goto err;
// null termination is accomplished by the caller doing buf[event_len]=0
DBUG_RETURN(0);
err:
// Invalid event.
table_name = 0;
DBUG_RETURN(1);
}