mirror of
https://github.com/MariaDB/server.git
synced 2026-05-16 20:07:13 +02:00
MDEV-22387: Do not pass null pointer to some memcpy()
Passing a null pointer to a nonnull argument is not only undefined behaviour, but it also grants the compiler the permission to optimize away further checks whether the pointer is null. GCC -O2 at least starting with version 8 may do that, potentially causing SIGSEGV. These problems were caught in a WITH_UBSAN=ON build with the Bug#7024 test in main.view.
This commit is contained in:
parent
a256070e7d
commit
94a520ddbe
5 changed files with 17 additions and 9 deletions
|
|
@ -1,6 +1,6 @@
|
|||
/*
|
||||
Copyright (c) 2000, 2011, Oracle and/or its affiliates
|
||||
Copyright (c) 2010, 2015, MariaDB
|
||||
Copyright (c) 2010, 2020, MariaDB
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
|
|
@ -703,6 +703,7 @@ int _my_b_cache_read(IO_CACHE *info, uchar *Buffer, size_t Count)
|
|||
info->read_pos=info->buffer+Count;
|
||||
info->read_end=info->buffer+length;
|
||||
info->pos_in_file=pos_in_file;
|
||||
if (Count)
|
||||
memcpy(Buffer, info->buffer, Count);
|
||||
DBUG_RETURN(0);
|
||||
}
|
||||
|
|
@ -1206,6 +1207,7 @@ static int _my_b_cache_read_r(IO_CACHE *cache, uchar *Buffer, size_t Count)
|
|||
DBUG_RETURN(1);
|
||||
}
|
||||
cnt= (len > Count) ? Count : len;
|
||||
if (cnt)
|
||||
memcpy(Buffer, cache->read_pos, cnt);
|
||||
Count -= cnt;
|
||||
Buffer+= cnt;
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
/*
|
||||
Copyright (c) 2000, 2010, Oracle and/or its affiliates
|
||||
Copyright (c) 2010, 2020, MariaDB
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
|
|
@ -449,6 +450,7 @@ char *strmake_root(MEM_ROOT *root, const char *str, size_t len)
|
|||
char *pos;
|
||||
if ((pos=alloc_root(root,len+1)))
|
||||
{
|
||||
if (len)
|
||||
memcpy(pos,str,len);
|
||||
pos[len]=0;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
/* Copyright (c) 2009, 2013, Oracle and/or its affiliates.
|
||||
Copyright (c) 2013, 2020, MariaDB
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
|
|
@ -319,6 +320,7 @@ static char *debug_sync_bmove_len(char *to, char *to_end,
|
|||
DBUG_ASSERT(to_end);
|
||||
DBUG_ASSERT(!length || from);
|
||||
set_if_smaller(length, (size_t) (to_end - to));
|
||||
if (length)
|
||||
memcpy(to, from, length);
|
||||
return (to + length);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
/* Copyright (c) 2000, 2016, Oracle and/or its affiliates.
|
||||
Copyright (c) 2012, 2017, MariaDB Corporation
|
||||
Copyright (c) 2012, 2020, MariaDB Corporation.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
|
|
@ -577,6 +577,7 @@ net_write_buff(NET *net, const uchar *packet, ulong len)
|
|||
return net_real_write(net, packet, len) ? 1 : 0;
|
||||
/* Send out rest of the blocks as full sized blocks */
|
||||
}
|
||||
if (len)
|
||||
memcpy((char*) net->write_pos,packet,len);
|
||||
net->write_pos+= len;
|
||||
return 0;
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
|
||||
/*
|
||||
Copyright (c) 2000, 2013, Oracle and/or its affiliates.
|
||||
Copyright (c) 2008, 2013, Monty Program Ab.
|
||||
Copyright (c) 2008, 2020, MariaDB Corporation.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
|
|
@ -512,6 +512,7 @@ public:
|
|||
}
|
||||
void q_append(const char *data, uint32 data_len)
|
||||
{
|
||||
if (data_len)
|
||||
memcpy(Ptr + str_length, data, data_len);
|
||||
str_length += data_len;
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue