-
Alexander Barkov authored
MDEV-24901 SIGSEGV in fts_get_table_name, SIGSEGV in ib_vector_size, SIGSEGV in row_merge_fts_doc_tokenize, stack smashing strmake() puts one extra 0x00 byte at the end of the string. The code in my_strnxfrm_tis620[_nopad] did not take this into account, so in the reported scenario the 0x00 byte was put outside of a stack variable, which made ASAN crash. This problem is already fixed in in MySQL: commit 19bd66fe43c41f0bde5f36bc6b455a46693069fb Author: bin.x.su@oracle.com <> Date: Fri Apr 4 11:35:27 2014 +0800 But the fix does not seem to be correct, as it breaks when finds a zero byte in the source string. Using memcpy() instead of strmake(). - Unlike strmake(), memcpy() it does not write beyond the destination size passed. - Unlike the MySQL fix, memcpy() does not break on the first 0x00 byte found in the source string.
059797ed