mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-29 02:05:57 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-10951 Field_newdate::cmp access violation

Browse source 
The crash is caused by macro uint3korr() accessing memory (1 byte) past
the end of allocated page. The macro is written such it reads 4 bytes
instead of 3 and discards the value of the last byte.

However, it is not always guaranteed that all uint3korr accesses will be
valid (i.e that the caller allocates an extra byte after the value).

In particular, the tree in Item_func_group_concat does not account for
any extra bytes that it would need for comparison of keys in some cases
(Field_newdate::cmp, Field_medium::cmp)

The fix change uint3korr so it does not access extra bytes.
This commit is contained in:
Vladislav Vaintroub 2016-10-25 22:35:35 +00:00
parent ed3998ae7c
commit 82ab92bd66
2 changed files with 0 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
include/byte_order_generic_x86.h
View file

@ -27,19 +27,9 @@
((uint32) (uchar) (A)[0])))
#define sint4korr(A) (*((const long *) (A)))
#define uint2korr(A) (*((const uint16 *) (A)))
/*
Attention: Please, note, uint3korr reads 4 bytes (not 3)!
It means, that you have to provide enough allocated space.
*/
#if defined(HAVE_valgrind) && !defined(_WIN32)
#define uint3korr(A) (uint32) (((uint32) ((uchar) (A)[0])) +\
(((uint32) ((uchar) (A)[1])) << 8) +\
(((uint32) ((uchar) (A)[2])) << 16))
#else
#define uint3korr(A) (long) (*((const unsigned int *) (A)) & 0xFFFFFF)
#endif
#define uint4korr(A) (*((const uint32 *) (A)))
#define uint5korr(A) ((ulonglong)(((uint32) ((uchar) (A)[0])) +\
(((uint32) ((uchar) (A)[1])) << 8) +\

8
include/byte_order_generic_x86_64.h
View file

@ -27,17 +27,9 @@
((uint32) (uchar) (A)[0])))
#define sint4korr(A) (int32) (*((int32 *) (A)))
#define uint2korr(A) (uint16) (*((uint16 *) (A)))
/*
Attention: Please, note, uint3korr reads 4 bytes (not 3)!
It means, that you have to provide enough allocated space.
*/
#if defined(HAVE_valgrind) && !defined(_WIN32)
#define uint3korr(A) (uint32) (((uint32) ((uchar) (A)[0])) +\
(((uint32) ((uchar) (A)[1])) << 8) +\
(((uint32) ((uchar) (A)[2])) << 16))
#else
#define uint3korr(A) (uint32) (*((unsigned int *) (A)) & 0xFFFFFF)
#endif
#define uint4korr(A) (uint32) (*((uint32 *) (A)))
#define uint5korr(A) ((ulonglong)(((uint32) ((uchar) (A)[0])) +\
(((uint32) ((uchar) (A)[1])) << 8) +\