mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-29 02:05:57 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Bug#16945503 ADDRESSSANITIZER BUG IN SYS_VARS

Browse source 
Sys_var_keycache inherits from some variant of Sys_var_integer

Instances of Sys_var_keycache are initialized using the KEYCACHE_VAR macro,
which takes an offset within st_key_cache.
However, the Sys_var_integer CTOR treats the offset as if it was within
global_system_variables (hidden within some layers of macros and fuction
pointers)

The result is that we write arbitrary data to arbitrary locations in memory.
This all happens during static initialization of global objects,
i.e. before we have even entered the main() function.


Bug#12325449 TYPO IN CMAKE/DTRACE.CMAKE
Fix typo in dtrace.cmake
This commit is contained in:
Tor Didriksen 2013-06-21 14:18:01 +02:00
parent 09d03ff35f
commit 98ed58cad6
2 changed files with 15 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
cmake/dtrace.cmake
View file

@ -1,4 +1,4 @@
# Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
# Copyright (c) 2009, 2013, Oracle and/or its affiliates. All rights reserved.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@ -158,7 +158,7 @@ IF(CMAKE_SYSTEM_NAME MATCHES "SunOS" AND ENABLE_DTRACE)
FOREACH(lib ${libs})
GET_TARGET_PROPERTY(libtype ${lib} TYPE)
IF(libtype MATCHES STATIC_LIBRARY)
SET(static_libs ${static_lics} ${lib})
SET(static_libs ${static_libs} ${lib})
ENDIF()
ENDFOREACH()

19
sql/sys_vars.h
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2002, 2011, Oracle and/or its affiliates. All rights reserved.
/* Copyright (c) 2002, 2013, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@ -122,7 +122,11 @@ public:
option.u_max_value= (uchar**)max_var_ptr();
if (max_var_ptr())
*max_var_ptr()= max_val;
global_var(T)= def_val;
// Do not set global_var for Sys_var_keycache objects
if (offset >= 0)
global_var(T)= def_val;
DBUG_ASSERT(size == sizeof(T));
DBUG_ASSERT(min_val < max_val);
DBUG_ASSERT(min_val <= def_val);
@ -659,12 +663,15 @@ public:
on_check_function on_check_func,
keycache_update_function on_update_func,
const char *substitute=0)
: Sys_var_ulonglong(name_arg, comment, flag_args, off, size,
getopt, min_val, max_val, def_val,
block_size, lock, binlog_status_arg, on_check_func, 0,
substitute),
: Sys_var_ulonglong(name_arg, comment, flag_args,
-1, /* offset, see base class CTOR */
size,
getopt, min_val, max_val, def_val,
block_size, lock, binlog_status_arg, on_check_func, 0,
substitute),
keycache_update(on_update_func)
{
offset= off; /* Remember offset in KEY_CACHE */
option.var_type|= GET_ASK_ADDR;
option.value= (uchar**)1; // crash me, please
keycache_var(dflt_key_cache, off)= def_val;