Details
-
New Feature
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
3.3.21, 3.4.11
-
None
Description
mariadb_dyncol_list_named() allocates the result array (*names) before it reads the column names from the packed dynamic column. If read_name() fails for one of the entries, the function returns ER_DYNCOL_FORMAT without freeing the array and without resetting *names:
LEX_STRING tmp;
|
if (read_name(&header, read, &tmp)) |
return ER_DYNCOL_FORMAT; /* *names is neither freed nor reset */ |
Attachments
Issue Links
- relates to
-
MDEV-41651 mariadb_dyncol_list_named() leaks the result array when a column name cannot be read
-
- Open
-