Commit 2187f1c2 authored by Sujatha's avatar Sujatha

MDEV-18046: Assortment of crashes, assertion failures and ASAN errors in mysql_show_binlog_events

Problem:
========
SHOW BINLOG EVENTS FROM <pos> reports following ASAN error
"heap-buffer-overflow on address" and some times it asserts.

Table_map_log_event::Table_map_log_event(const char*, uint,
    const Format_description_log_event*)
Assertion `m_field_metadata_size <= (m_colcnt * 2)' failed.

Fix:
===
**Part7: Avoid reading out of buffer**


Converted debug assert to error handler code.
parent d6fa69e4
...@@ -11013,7 +11013,6 @@ Table_map_log_event::Table_map_log_event(const char *buf, uint event_len, ...@@ -11013,7 +11013,6 @@ Table_map_log_event::Table_map_log_event(const char *buf, uint event_len,
uint8 post_header_len= description_event->post_header_len[TABLE_MAP_EVENT-1]; uint8 post_header_len= description_event->post_header_len[TABLE_MAP_EVENT-1];
DBUG_PRINT("info",("event_len: %u common_header_len: %d post_header_len: %d", DBUG_PRINT("info",("event_len: %u common_header_len: %d post_header_len: %d",
event_len, common_header_len, post_header_len)); event_len, common_header_len, post_header_len));
/* /*
Don't print debug messages when running valgrind since they can Don't print debug messages when running valgrind since they can
trigger false warnings. trigger false warnings.
...@@ -11022,6 +11021,9 @@ Table_map_log_event::Table_map_log_event(const char *buf, uint event_len, ...@@ -11022,6 +11021,9 @@ Table_map_log_event::Table_map_log_event(const char *buf, uint event_len,
DBUG_DUMP("event buffer", (uchar*) buf, event_len); DBUG_DUMP("event buffer", (uchar*) buf, event_len);
#endif #endif
if (event_len < (uint)(common_header_len + post_header_len))
DBUG_VOID_RETURN;
/* Read the post-header */ /* Read the post-header */
const char *post_start= buf + common_header_len; const char *post_start= buf + common_header_len;
...@@ -11084,7 +11086,8 @@ Table_map_log_event::Table_map_log_event(const char *buf, uint event_len, ...@@ -11084,7 +11086,8 @@ Table_map_log_event::Table_map_log_event(const char *buf, uint event_len,
if (bytes_read < event_len) if (bytes_read < event_len)
{ {
m_field_metadata_size= net_field_length(&ptr_after_colcnt); m_field_metadata_size= net_field_length(&ptr_after_colcnt);
DBUG_ASSERT(m_field_metadata_size <= (m_colcnt * 2)); if(m_field_metadata_size <= (m_colcnt * 2))
{
uint num_null_bytes= (m_colcnt + 7) / 8; uint num_null_bytes= (m_colcnt + 7) / 8;
m_meta_memory= (uchar *)my_multi_malloc(MYF(MY_WME), m_meta_memory= (uchar *)my_multi_malloc(MYF(MY_WME),
&m_null_bits, num_null_bytes, &m_null_bits, num_null_bytes,
...@@ -11094,6 +11097,14 @@ Table_map_log_event::Table_map_log_event(const char *buf, uint event_len, ...@@ -11094,6 +11097,14 @@ Table_map_log_event::Table_map_log_event(const char *buf, uint event_len,
ptr_after_colcnt= (uchar*)ptr_after_colcnt + m_field_metadata_size; ptr_after_colcnt= (uchar*)ptr_after_colcnt + m_field_metadata_size;
memcpy(m_null_bits, ptr_after_colcnt, num_null_bytes); memcpy(m_null_bits, ptr_after_colcnt, num_null_bytes);
} }
else
{
m_coltype= NULL;
my_free(m_memory);
m_memory= NULL;
DBUG_VOID_RETURN;
}
}
} }
DBUG_VOID_RETURN; DBUG_VOID_RETURN;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment