Commit c9f307c4 authored by Thayumanavar's avatar Thayumanavar

BUG#19875331 - HANDLE_FATAL_SIGNAL 11 IN STRMAKE

Problem Description And Fix:
Inserting a fudged record in mysql.proc with the dbname
column value as test and the name column as empty, will
cause a crash in mysqld when we run the command DROP
DATABASE test.
 During DROP DATABASE test, mysql_rm_db subsequently
calls lock_db_routines. In the routine we fetch the
field 'name' from mysql.proc by calling the underlying
storage engine API in lock_db_routines. This cause NULL
value as the field column of mysql.proc and subsequent
dereference MDL_request::init leads to crash.
Modifying mysql.proc using SQL command by user is not
supported, but in principle, there is a possibility
of mysql.proc getting corrupted which can also lead
to empty fields and arbitary values. The patch fixes
the crash by checking NULL and propagating the appopriate
error code to the user.
parent a3e95008
/*
Copyright (c) 2002, 2011, Oracle and/or its affiliates. All rights reserved.
Copyright (c) 2002, 2015, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
......@@ -1483,6 +1483,14 @@ bool lock_db_routines(THD *thd, char *db)
{
char *sp_name= get_field(thd->mem_root,
table->field[MYSQL_PROC_FIELD_NAME]);
if (sp_name == NULL)
{
table->file->ha_index_end();
my_error(ER_SP_WRONG_NAME, MYF(0), "");
close_system_tables(thd, &open_tables_state_backup);
DBUG_RETURN(true);
}
longlong sp_type= table->field[MYSQL_PROC_MYSQL_TYPE]->val_int();
MDL_request *mdl_request= new (thd->mem_root) MDL_request;
mdl_request->init(sp_type == TYPE_ENUM_FUNCTION ?
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment