mirror of
https://github.com/MariaDB/server.git
synced 2026-05-16 20:07:13 +02:00
BUG#47598 - MyISAM may write uninitialized data to disk
When MyISAM writes newly created index page it may be initialized partially. In other words some bytes of sensible data and uninitialized tail of the page may go into index file. Under certain rare circumstances these hunks of memory may contain data that would be otherwise inaccessible to user, like passwords or data from other tables. Fixed by initializing memory for temporary MyISAM key buffer to '\0'. No test case for this fix as it is heavily covered by existing tests. storage/myisam/mi_open.c: When creating new MI_INFO object, initialize MI_INFO::buff. This is done to ensure that we never write uninitialized memory hunks to index file. storage/myisam/mi_page.c: No need to silence memory error detector anymore, page buffer is always initialized. storage/myisam/mi_write.c: Fixed invalid memory read of 2 bytes. new_right_length is length of data on a page, including first 2 bytes that store this length itself. pos + k_length is pure data excluding these 2 bytes containing length. storage/myisam/rt_index.c: To avoid uninitialized data write, create new page on info->buff, instead of locally allocated buffer. Note: second key block on info->buff is used here, because first block is used by called functions. storage/myisam/rt_split.c: To avoid uninitialized data write, create new page on info->buff, instead of locally allocated buffer.
This commit is contained in:
parent
0ed4684547
commit
85094f3cc1
5 changed files with 7 additions and 26 deletions
|
|
@ -652,6 +652,9 @@ MI_INFO *mi_open(const char *name, int mode, uint open_flags)
|
|||
myisam_open_list=list_add(myisam_open_list,&m_info->open_list);
|
||||
|
||||
pthread_mutex_unlock(&THR_LOCK_myisam);
|
||||
|
||||
bzero(info.buff, share->base.max_key_block_length * 2);
|
||||
|
||||
if (myisam_log_file >= 0)
|
||||
{
|
||||
intern_filename(name_buff,share->index_file_name);
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue