Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
10.2(EOL)
-
None
Description
If OOM (out of memory) happens inside create_virtual_tmp_table(), the server can crash.
There are two problems:
1. If OOM happens inside multi_alloc_root in Virtual_tmp_table::init, then the member TABLE::s is left to be a NULL pointer. The destructor calls destruct_fields() without a test that TABLE::s was really allocated. It should test that s is not NULL before calling destruct_fields.
2. The class Virtual_tmp_table overrides the operator new to allocate itself on mem_root, but it does not override the operator delete, which is mapped to the system function free() by default. As a result free() is called for something which was never allocated with the system function malloc(). The class Virtual_tmp_table should override operator delete.
The problem was introduced by the patch for MDEV-9238 in 10.2.0.
Attachments
Issue Links
- relates to
-
MDEV-9238 Wrap create_virtual_tmp_table() into a class, split into different steps
- Closed