Commit 94a520dd authored by Marko Mäkelä's avatar Marko Mäkelä

MDEV-22387: Do not pass null pointer to some memcpy()

Passing a null pointer to a nonnull argument is not only undefined
behaviour, but it also grants the compiler the permission to optimize
away further checks whether the pointer is null. GCC -O2 at least
starting with version 8 may do that, potentially causing SIGSEGV.

These problems were caught in a WITH_UBSAN=ON build with the
Bug#7024 test in main.view.
parent a256070e
/* /*
Copyright (c) 2000, 2011, Oracle and/or its affiliates Copyright (c) 2000, 2011, Oracle and/or its affiliates
Copyright (c) 2010, 2015, MariaDB Copyright (c) 2010, 2020, MariaDB
This program is free software; you can redistribute it and/or modify This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by it under the terms of the GNU General Public License as published by
...@@ -703,7 +703,8 @@ int _my_b_cache_read(IO_CACHE *info, uchar *Buffer, size_t Count) ...@@ -703,7 +703,8 @@ int _my_b_cache_read(IO_CACHE *info, uchar *Buffer, size_t Count)
info->read_pos=info->buffer+Count; info->read_pos=info->buffer+Count;
info->read_end=info->buffer+length; info->read_end=info->buffer+length;
info->pos_in_file=pos_in_file; info->pos_in_file=pos_in_file;
memcpy(Buffer, info->buffer, Count); if (Count)
memcpy(Buffer, info->buffer, Count);
DBUG_RETURN(0); DBUG_RETURN(0);
} }
...@@ -1206,7 +1207,8 @@ static int _my_b_cache_read_r(IO_CACHE *cache, uchar *Buffer, size_t Count) ...@@ -1206,7 +1207,8 @@ static int _my_b_cache_read_r(IO_CACHE *cache, uchar *Buffer, size_t Count)
DBUG_RETURN(1); DBUG_RETURN(1);
} }
cnt= (len > Count) ? Count : len; cnt= (len > Count) ? Count : len;
memcpy(Buffer, cache->read_pos, cnt); if (cnt)
memcpy(Buffer, cache->read_pos, cnt);
Count -= cnt; Count -= cnt;
Buffer+= cnt; Buffer+= cnt;
left_length+= cnt; left_length+= cnt;
......
/* /*
Copyright (c) 2000, 2010, Oracle and/or its affiliates Copyright (c) 2000, 2010, Oracle and/or its affiliates
Copyright (c) 2010, 2020, MariaDB
This program is free software; you can redistribute it and/or modify This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by it under the terms of the GNU General Public License as published by
...@@ -449,7 +450,8 @@ char *strmake_root(MEM_ROOT *root, const char *str, size_t len) ...@@ -449,7 +450,8 @@ char *strmake_root(MEM_ROOT *root, const char *str, size_t len)
char *pos; char *pos;
if ((pos=alloc_root(root,len+1))) if ((pos=alloc_root(root,len+1)))
{ {
memcpy(pos,str,len); if (len)
memcpy(pos,str,len);
pos[len]=0; pos[len]=0;
} }
return pos; return pos;
......
/* Copyright (c) 2009, 2013, Oracle and/or its affiliates. /* Copyright (c) 2009, 2013, Oracle and/or its affiliates.
Copyright (c) 2013, 2020, MariaDB
This program is free software; you can redistribute it and/or modify This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by it under the terms of the GNU General Public License as published by
...@@ -319,7 +320,8 @@ static char *debug_sync_bmove_len(char *to, char *to_end, ...@@ -319,7 +320,8 @@ static char *debug_sync_bmove_len(char *to, char *to_end,
DBUG_ASSERT(to_end); DBUG_ASSERT(to_end);
DBUG_ASSERT(!length || from); DBUG_ASSERT(!length || from);
set_if_smaller(length, (size_t) (to_end - to)); set_if_smaller(length, (size_t) (to_end - to));
memcpy(to, from, length); if (length)
memcpy(to, from, length);
return (to + length); return (to + length);
} }
......
/* Copyright (c) 2000, 2016, Oracle and/or its affiliates. /* Copyright (c) 2000, 2016, Oracle and/or its affiliates.
Copyright (c) 2012, 2017, MariaDB Corporation Copyright (c) 2012, 2020, MariaDB Corporation.
This program is free software; you can redistribute it and/or modify This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by it under the terms of the GNU General Public License as published by
...@@ -577,7 +577,8 @@ net_write_buff(NET *net, const uchar *packet, ulong len) ...@@ -577,7 +577,8 @@ net_write_buff(NET *net, const uchar *packet, ulong len)
return net_real_write(net, packet, len) ? 1 : 0; return net_real_write(net, packet, len) ? 1 : 0;
/* Send out rest of the blocks as full sized blocks */ /* Send out rest of the blocks as full sized blocks */
} }
memcpy((char*) net->write_pos,packet,len); if (len)
memcpy((char*) net->write_pos,packet,len);
net->write_pos+= len; net->write_pos+= len;
return 0; return 0;
} }
......
...@@ -3,7 +3,7 @@ ...@@ -3,7 +3,7 @@
/* /*
Copyright (c) 2000, 2013, Oracle and/or its affiliates. Copyright (c) 2000, 2013, Oracle and/or its affiliates.
Copyright (c) 2008, 2013, Monty Program Ab. Copyright (c) 2008, 2020, MariaDB Corporation.
This program is free software; you can redistribute it and/or modify This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by it under the terms of the GNU General Public License as published by
...@@ -512,7 +512,8 @@ class String ...@@ -512,7 +512,8 @@ class String
} }
void q_append(const char *data, uint32 data_len) void q_append(const char *data, uint32 data_len)
{ {
memcpy(Ptr + str_length, data, data_len); if (data_len)
memcpy(Ptr + str_length, data, data_len);
str_length += data_len; str_length += data_len;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment