Commit 2e6b21be authored by Sujatha's avatar Sujatha

MDEV-22317: SIGSEGV in my_free/delete_dynamic in optimized builds (ARIA)

Problem:
=======
SET @@GLOBAL.replicate_wild_ignore_table='';
SET @@GLOBAL.replicate_wild_do_table='';

Reports following valgrind error.

Conditional jump or move depends on uninitialised value(s)
Rpl_filter::set_wild_ignore_table(char const*) (rpl_filter.cc:439)

Conditional jump or move depends on uninitialised value(s)
at 0xF60390: delete_dynamic (array.c:304)
by 0x74F3F2: Rpl_filter::set_wild_do_table(char const*) (rpl_filter.cc:421)

Analysis:
========
List of values provided for options "wild_do_table" and "wild_ignore_table" are
stored in DYNAMIC_ARRAYS.  When an empty list is provided these dynamic arrays
are not initialized.  Existing code treats empty element list as an error and
tries to clean the uninitialized list. This results in above valgrind issue.

Fix:
===
The clean up should be initiated only when there is an error while parsing the
'wild_do_table' or 'wild_ignore_table' list and the dynamic_array is in
initialized state. Otherwise for empty list it should simply return success.
parent 5193c1b5
...@@ -7,6 +7,8 @@ SET @@GLOBAL.replicate_wild_ignore_table="test.b%"; ...@@ -7,6 +7,8 @@ SET @@GLOBAL.replicate_wild_ignore_table="test.b%";
ERROR HY000: This operation cannot be performed as you have a running slave ''; run STOP SLAVE '' first ERROR HY000: This operation cannot be performed as you have a running slave ''; run STOP SLAVE '' first
connection slave; connection slave;
include/stop_slave.inc include/stop_slave.inc
SET @@GLOBAL.replicate_wild_do_table="";
SET @@GLOBAL.replicate_wild_ignore_table="";
SET @@GLOBAL.replicate_wild_do_table="test.a%"; SET @@GLOBAL.replicate_wild_do_table="test.a%";
SET @@GLOBAL.replicate_wild_ignore_table="test.b%"; SET @@GLOBAL.replicate_wild_ignore_table="test.b%";
include/start_slave.inc include/start_slave.inc
......
...@@ -13,6 +13,8 @@ SET @@GLOBAL.replicate_wild_ignore_table="test.b%"; ...@@ -13,6 +13,8 @@ SET @@GLOBAL.replicate_wild_ignore_table="test.b%";
connection slave; connection slave;
source include/stop_slave.inc; source include/stop_slave.inc;
SET @@GLOBAL.replicate_wild_do_table="";
SET @@GLOBAL.replicate_wild_ignore_table="";
SET @@GLOBAL.replicate_wild_do_table="test.a%"; SET @@GLOBAL.replicate_wild_do_table="test.a%";
SET @@GLOBAL.replicate_wild_ignore_table="test.b%"; SET @@GLOBAL.replicate_wild_ignore_table="test.b%";
source include/start_slave.inc; source include/start_slave.inc;
......
...@@ -416,10 +416,13 @@ Rpl_filter::set_wild_do_table(const char* table_spec) ...@@ -416,10 +416,13 @@ Rpl_filter::set_wild_do_table(const char* table_spec)
status= parse_filter_rule(table_spec, &Rpl_filter::add_wild_do_table); status= parse_filter_rule(table_spec, &Rpl_filter::add_wild_do_table);
if (!wild_do_table.elements) if (wild_do_table_inited && status)
{ {
delete_dynamic(&wild_do_table); if (!wild_do_table.elements)
wild_do_table_inited= 0; {
delete_dynamic(&wild_do_table);
wild_do_table_inited= 0;
}
} }
return status; return status;
...@@ -436,10 +439,13 @@ Rpl_filter::set_wild_ignore_table(const char* table_spec) ...@@ -436,10 +439,13 @@ Rpl_filter::set_wild_ignore_table(const char* table_spec)
status= parse_filter_rule(table_spec, &Rpl_filter::add_wild_ignore_table); status= parse_filter_rule(table_spec, &Rpl_filter::add_wild_ignore_table);
if (!wild_ignore_table.elements) if (wild_ignore_table_inited && status)
{ {
delete_dynamic(&wild_ignore_table); if (!wild_ignore_table.elements)
wild_ignore_table_inited= 0; {
delete_dynamic(&wild_ignore_table);
wild_ignore_table_inited= 0;
}
} }
return status; return status;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment