mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-16 12:02:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-28129: MariaDB UAF issue at lex_end_nops(LEX*)

Browse source 
This bug report is not about ASAN Use After Free issue. This bug is
about missed calling of the method LEX::cleanup_lex_after_parse_error
that should happen on parse error.

Aforementioned method calls sphead::restore_thd_mem_root to clean up
resources acquired on processing a stored routine. Particularly,
the method sp_head::restore_tht_mem_root is called to restore
an original mem root and reset LEX::sphead into nullptr.

The method LEX::cleanup_lex_after_parse_error is invoked by the macros
MYSQL_YYABORT. Unfortunately, some rules of grammar for handling
user variables in SQL use YYABORT instead of MYSQL_YYABORT to handle
parser errors. As a consequence, in case a statement with setting of
a user variable is called inside a stored routine, it results in
assert failure in sp_head destructor.

To fix the issue the macros YYABORT should be replaced by MYSQL_YYABORT
in those grammar rules that handle assignment of user variables.
This commit is contained in:
Dmitry Shulga 2022-04-04 14:32:16 +07:00
parent d48774e0e0
commit cd56b40f6d
3 changed files with 35 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
mysql-test/main/sp.result
View file

@ -8913,3 +8913,15 @@ ERROR 42000: Incorrect usage/placement of 'HIGH_PRIORITY'
# #
# End of 10.4 tests # End of 10.4 tests
# #
#
# MDEV-28129: MariaDB UAF issue at lex_end_nops(LEX*)
#
CREATE PROCEDURE sp() SELECT 1 INTO @;
ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' at line 1
CREATE PROCEDURE sp() SET @=1;
ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '=1' at line 1
CREATE PROCEDURE sp() SELECT @;
ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' at line 1
#
# End of 10.7 tests
#

17
mysql-test/main/sp.test
View file

@ -10484,3 +10484,20 @@ DELIMITER ;$$
--echo # --echo #
--echo # End of 10.4 tests --echo # End of 10.4 tests
--echo # --echo #
--echo #
--echo # MDEV-28129: MariaDB UAF issue at lex_end_nops(LEX*)
--echo #
--error ER_PARSE_ERROR
CREATE PROCEDURE sp() SELECT 1 INTO @;
--error ER_PARSE_ERROR
CREATE PROCEDURE sp() SET @=1;
--error ER_PARSE_ERROR
CREATE PROCEDURE sp() SELECT @;
--echo #
--echo # End of 10.7 tests
--echo #

12
sql/sql_yacc.yy
View file

@ -3570,7 +3570,7 @@ simple_target_specification:
if (!$2.length) if (!$2.length)
{ {
thd->parse_error(); thd->parse_error();
YYABORT; MYSQL_YYABORT;
} }
$$= new (thd->mem_root) Item_func_get_user_var(thd, &$2); $$= new (thd->mem_root) Item_func_get_user_var(thd, &$2);
if (unlikely($$ == NULL)) if (unlikely($$ == NULL))
@ -11001,7 +11001,7 @@ variable_aux:
if (!$1.length) if (!$1.length)
{ {
thd->parse_error(); thd->parse_error();
YYABORT; MYSQL_YYABORT;
} }
$$= item= new (thd->mem_root) Item_func_set_user_var(thd, &$1, $3); $$= item= new (thd->mem_root) Item_func_set_user_var(thd, &$1, $3);
if (unlikely($$ == NULL)) if (unlikely($$ == NULL))
@ -11015,7 +11015,7 @@ variable_aux:
if (!$1.length) if (!$1.length)
{ {
thd->parse_error(); thd->parse_error();
YYABORT; MYSQL_YYABORT;
} }
$$= new (thd->mem_root) Item_func_get_user_var(thd, &$1); $$= new (thd->mem_root) Item_func_get_user_var(thd, &$1);
if (unlikely($$ == NULL)) if (unlikely($$ == NULL))
@ -12653,7 +12653,7 @@ select_outvar:
if (!$2.length) if (!$2.length)
{ {
thd->parse_error(); thd->parse_error();
YYABORT; MYSQL_YYABORT;
} }
$$ = Lex->result ? new (thd->mem_root) my_var_user(&$2) : NULL; $$ = Lex->result ? new (thd->mem_root) my_var_user(&$2) : NULL;
@ -14644,7 +14644,7 @@ field_or_var:
if (!$2.length) if (!$2.length)
{ {
thd->parse_error(); thd->parse_error();
YYABORT; MYSQL_YYABORT;
} }
$$= new (thd->mem_root) Item_user_var_as_out_param(thd, &$2); $$= new (thd->mem_root) Item_user_var_as_out_param(thd, &$2);
@ -16465,7 +16465,7 @@ option_value_no_option_type:
if (!$2.length) if (!$2.length)
{ {
thd->parse_error(); thd->parse_error();
YYABORT; MYSQL_YYABORT;
} }
if (sp_create_assignment_lex(thd, $1.str)) if (sp_create_assignment_lex(thd, $1.str))