• Alexander Barkov's avatar
    MDEV-24901 SIGSEGV in fts_get_table_name, SIGSEGV in ib_vector_size, SIGSEGV... · 059797ed
    Alexander Barkov authored
    MDEV-24901 SIGSEGV in fts_get_table_name, SIGSEGV in ib_vector_size, SIGSEGV in row_merge_fts_doc_tokenize, stack smashing
    
    strmake() puts one extra 0x00 byte at the end of the string.
    The code in my_strnxfrm_tis620[_nopad] did not take this into
    account, so in the reported scenario the 0x00 byte was put outside
    of a stack variable, which made ASAN crash.
    
    This problem is already fixed in in MySQL:
    
      commit 19bd66fe43c41f0bde5f36bc6b455a46693069fb
      Author: bin.x.su@oracle.com <>
      Date:   Fri Apr 4 11:35:27 2014 +0800
    
    But the fix does not seem to be correct, as it breaks when finds a zero byte
    in the source string.
    
    Using memcpy() instead of strmake().
    
    - Unlike strmake(), memcpy() it does not write beyond the destination
      size passed.
    - Unlike the MySQL fix, memcpy() does not break on the first 0x00 byte found
      in the source string.
    059797ed
ctype-tis620.c 46.4 KB