mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-16 12:02:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

BUG#19875331 - HANDLE_FATAL_SIGNAL 11 IN STRMAKE

Browse source 
Problem Description And Fix:
Inserting a fudged record in mysql.proc with the dbname
column value as test and the name column as empty, will
cause a crash in mysqld when we run the command DROP
DATABASE test.
 During DROP DATABASE test, mysql_rm_db subsequently
calls lock_db_routines. In the routine we fetch the
field 'name' from mysql.proc by calling the underlying
storage engine API in lock_db_routines. This cause NULL
value as the field column of mysql.proc and subsequent
dereference MDL_request::init leads to crash.
Modifying mysql.proc using SQL command by user is not
supported, but in principle, there is a possibility
of mysql.proc getting corrupted which can also lead
to empty fields and arbitary values. The patch fixes
the crash by checking NULL and propagating the appopriate
error code to the user.
This commit is contained in:
Thayumanavar 2015-01-19 12:46:41 +05:30
parent a3e9500823
commit c9f307c456
1 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
sql/sp.cc
View file

@ -1,5 +1,5 @@
/*
Copyright (c) 2002, 2011, Oracle and/or its affiliates. All rights reserved.
Copyright (c) 2002, 2015, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@ -1483,6 +1483,14 @@ bool lock_db_routines(THD *thd, char *db)
{
char *sp_name= get_field(thd->mem_root,
table->field[MYSQL_PROC_FIELD_NAME]);
if (sp_name == NULL)
{
table->file->ha_index_end();
my_error(ER_SP_WRONG_NAME, MYF(0), "");
close_system_tables(thd, &open_tables_state_backup);
DBUG_RETURN(true);
}
longlong sp_type= table->field[MYSQL_PROC_MYSQL_TYPE]->val_int();
MDL_request *mdl_request= new (thd->mem_root) MDL_request;
mdl_request->init(sp_type == TYPE_ENUM_FUNCTION ?