mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-29 02:05:57 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-15127 AddressSanitizer: stack-buffer-overflow in base_list::push_back ..

Browse source 
Problem:-
 If we try to run this query with -WITH_ASAN=ON compiled server
  CREATE TABLE t1 (i INT);
  SET debug_dbug="+d,test_completely_invisible,test_invisible_index";
  CREATE TABLE t2 LIKE t1;

 This will generate a stack buffer overflow error.
  ==8922==ERROR: AddressSanitizer: stack-buffer-overflow on address #ADDR
Analyze:-
 Error is generated on this line
       if (((*last)=new list_node(info, &end_of_list)))
 So info is our Key*, &end_of_list is global variable and last == #ADDR
 So last is suspicious variable. And last is the variable present in alter_info
 ->key_list. Now the question is how this key_list->last gets wrong/
 different stack variable. In the backtrace,  we can see that key_list is
 generated in mysql_create_table_like_table by calling
 mysql_preapre_alter_table_function and dummy key_list is created by
 mysql_create_like_table. In the end on mysql_prepare_alter_table we call
   alter_info->key_list.swap(new_key_list);
 So there is two options either key_list is empty or not empty , IF it is not
 empty then there is no issues last ptr is replaced by thd->mem_root (allocated ptr)
 So problem arises when key_list is empty. It swaps the dummy last ptr by
 mysql_prepare_alter_table declared ptr. which is wrong.

Solution:-
 We wont swap variable if list does not have any element.
This commit is contained in:
Sachin 2018-08-07 16:05:48 +05:30
parent 4cbadaeaea
commit 482d4da0a7
3 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
mysql-test/main/invisible_field_debug.result
View file

@ -369,3 +369,8 @@ t1 1 invisible 1 c A NULL NULL NULL YES BTREE
t1 1 invisible_2 1 invisible A NULL NULL NULL YES BTREE
drop table t1;
set @old_debug= @@debug_dbug;
CREATE TABLE t1 (i INT );
SET debug_dbug="+d,test_completely_invisible,test_invisible_index";
CREATE TABLE t2 LIKE t1;
SET debug_dbug= DEFAULT;
DROP TABLE t1, t2;

6
mysql-test/main/invisible_field_debug.test
View file

@ -270,3 +270,9 @@ explain select * from t1 where invisible =9;
show indexes in t1;
drop table t1;
set @old_debug= @@debug_dbug;
## MDEV 15127
CREATE TABLE t1 (i INT );
SET debug_dbug="+d,test_completely_invisible,test_invisible_index";
CREATE TABLE t2 LIKE t1;
SET debug_dbug= DEFAULT;
DROP TABLE t1, t2;

5
sql/sql_list.h
View file

@ -278,10 +278,13 @@ public:
*/
inline void swap(base_list &rhs)
{
list_node **rhs_last=rhs.last;
swap_variables(list_node *, first, rhs.first);
swap_variables(list_node **, last, rhs.last);
swap_variables(uint, elements, rhs.elements);
rhs.last= last == &first ? &rhs.first : last;
last = rhs_last == &rhs.first ? &first : rhs_last;
}
inline list_node* last_node() { return *last; }
inline list_node* first_node() { return first;}
inline void *head() { return first->info; }