• Alexander Barkov's avatar
    MDEV-18738 ASAN heap-use-after-free in copy_if_not_alloced / copy_fields · 5fb6444a
    Alexander Barkov authored
    copy_if_not_alloced() did not handle situations when
    "from" is a constant string pointing to a substring of "to",
    so this code part freed "to" but then tried to copy its old (already freed)
    content to a new buffer:
    
      if (to->realloc(from_length))
        return from;
      if ((to->str_length=MY_MIN(from->str_length,from_length)))
        memcpy(to->Ptr,from->Ptr,to->str_length);
    
    Adding a new code piece that catches such constant substrings
    and propery reallocs "to" to preserve its important part referenced
    by "from".
    5fb6444a
sql_string.cc 32.5 KB