• Dmitry Shulga's avatar
    MDEV-28129: MariaDB UAF issue at lex_end_nops(LEX*) · cd56b40f
    Dmitry Shulga authored
    This bug report is not about ASAN Use After Free issue. This bug is
    about missed calling of the method LEX::cleanup_lex_after_parse_error
    that should happen on parse error.
    
    Aforementioned method calls sphead::restore_thd_mem_root to clean up
    resources acquired on processing a stored routine. Particularly,
    the method sp_head::restore_tht_mem_root is called to restore
    an original mem root and reset LEX::sphead into nullptr.
    
    The method LEX::cleanup_lex_after_parse_error is invoked by the macros
    MYSQL_YYABORT. Unfortunately, some rules of grammar for handling
    user variables in SQL use YYABORT instead of MYSQL_YYABORT to handle
    parser errors. As a consequence, in case a statement with setting of
    a user variable is called inside a stored routine, it results in
    assert failure in sp_head destructor.
    
    To fix the issue the macros YYABORT should be replaced by MYSQL_YYABORT
    in those grammar rules that handle assignment of user variables.
    cd56b40f
sp.result 212 KB