Commit 57f6a1ca authored by Kristian Nielsen's avatar Kristian Nielsen

MDEV-19415: use-after-free on charsets_dir from slave connect

The slave IO thread sets MYSQL_SET_CHARSET_DIR. The code for this option
however is not thread-safe in sql-common/client.c. The value set is
temporarily written to mysys global variable `charsets-dir` and can be seen
by other threads running in parallel, which can result in use-after-free
error.

Problem was visible as random failures of test cases in suite multi_source
with Valgrind or MSAN.

Work-around by not setting this option for slave connect, it is redundant
anyway as it is just setting the default value.
Signed-off-by: default avatarKristian Nielsen <knielsen@knielsen-hq.org>
parent 0c249ad7
...@@ -7412,9 +7412,6 @@ static int connect_to_master(THD* thd, MYSQL* mysql, Master_info* mi, ...@@ -7412,9 +7412,6 @@ static int connect_to_master(THD* thd, MYSQL* mysql, Master_info* mi,
default_client_charset_info->csname); default_client_charset_info->csname);
} }
/* This one is not strictly needed but we have it here for completeness */
mysql_options(mysql, MYSQL_SET_CHARSET_DIR, (char *) charsets_dir);
/* Set MYSQL_PLUGIN_DIR in case master asks for an external authentication plugin */ /* Set MYSQL_PLUGIN_DIR in case master asks for an external authentication plugin */
if (opt_plugin_dir_ptr && *opt_plugin_dir_ptr) if (opt_plugin_dir_ptr && *opt_plugin_dir_ptr)
mysql_options(mysql, MYSQL_PLUGIN_DIR, opt_plugin_dir_ptr); mysql_options(mysql, MYSQL_PLUGIN_DIR, opt_plugin_dir_ptr);
...@@ -7557,8 +7554,6 @@ MYSQL *rpl_connect_master(MYSQL *mysql) ...@@ -7557,8 +7554,6 @@ MYSQL *rpl_connect_master(MYSQL *mysql)
#endif #endif
mysql_options(mysql, MYSQL_SET_CHARSET_NAME, default_charset_info->csname); mysql_options(mysql, MYSQL_SET_CHARSET_NAME, default_charset_info->csname);
/* This one is not strictly needed but we have it here for completeness */
mysql_options(mysql, MYSQL_SET_CHARSET_DIR, (char *) charsets_dir);
if (mi->user == NULL if (mi->user == NULL
|| mi->user[0] == 0 || mi->user[0] == 0
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment