mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-30 18:41:56 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-29555 ASAN heap-buffer-overflow in mariabackup.huge_lsn,strict_full_crc32

Browse source 
recv_scan_log(): Do not dereference the first byte of the log record
before recv_sys.parse_pmem() (or recv_sys_t::parse_mtr()) returns OK.

In the case of the failure that was analyzed, we had
recv_sys.offset == recv_sys.len and recv_sys_t::parse_mtr() would return
PREMATURE_EOF. This would lead us to reading more data and parsing again.

When a memory-mapped interface to the log is being used, that is,
log_sys.is_pmem() holds, recv_sys.offset cannot point past the
end of the memory-mapped log_sys.buf[]. This is guaranteed by
log_sys.calc_lsn_offset().

Thanks to Nayuta Yanagisawa for providing a core dump for analysis.
This commit is contained in:
Marko Mäkelä 2022-09-16 14:10:45 +03:00
parent d2cae171d1
commit 593fdee397
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
storage/innobase/log/log0recv.cc
View file

@ -3713,7 +3713,7 @@ static bool recv_scan_log(bool last_phase)
for (;;)
{
const byte b{log_sys.buf[recv_sys.offset]};
const byte& b{log_sys.buf[recv_sys.offset]};
r= recv_sys.parse_pmem(store);
if (r == recv_sys_t::OK)
{