Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-12416

OOM in create_virtual_tmp_table() makes the server crash

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • 10.2(EOL)
    • 10.2.5
    • OTHER
    • None

    Description

      If OOM (out of memory) happens inside create_virtual_tmp_table(), the server can crash.

      There are two problems:

      1. If OOM happens inside multi_alloc_root in Virtual_tmp_table::init, then the member TABLE::s is left to be a NULL pointer. The destructor calls destruct_fields() without a test that TABLE::s was really allocated. It should test that s is not NULL before calling destruct_fields.

      2. The class Virtual_tmp_table overrides the operator new to allocate itself on mem_root, but it does not override the operator delete, which is mapped to the system function free() by default. As a result free() is called for something which was never allocated with the system function malloc(). The class Virtual_tmp_table should override operator delete.

      The problem was introduced by the patch for MDEV-9238 in 10.2.0.

      Attachments

        Issue Links

          relates to

          Task - A task that needs to be done. MDEV-9238 Wrap create_virtual_tmp_table() into a class, split into different steps

          • Major - Major loss of function.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            bar Alexander Barkov created issue -
            bar Alexander Barkov made changes -
            Field Original Value New Value
            Description If OOM (out of memory) happens inside {{create_virtual_tmp_table()}}, the server can crash.

            There are two problems:

            1. If OOM happens inside {{multi_alloc_root}} in {{Virtual_tmp_table::init}}, then the {{TABLE::s}} member is {{NULL}}. The destructor calls {{destruct_fields()}} without a test that {{TABLE::s}} was allocated. It should test that {{s}} is not {{NULL}} before calling {{destruct_fields}}.

            2. The class {{Virtual_tmp_table}} overrides the operator {{new}} to allocate itself on {{mem_root}}, but it does not override the operator {{delete}}, which is mapped to the system function {{free()}} by default. As a result {{free()}} is called for something which was never allocated with the system function {{malloc()}}. The class {{Virtual_tmp_table}} should override {{operator delete}}.
            		If OOM (out of memory) happens inside {{create_virtual_tmp_table()}}, the server can crash.

            There are two problems:

            1. If OOM happens inside {{multi_alloc_root}} in {{Virtual_tmp_table::init}}, then the {{TABLE::s}} member is {{NULL}}. The destructor calls {{destruct_fields()}} without a test that {{TABLE::s}} was allocated. It should test that {{s}} is not {{NULL}} before calling {{destruct_fields}}.

            2. The class {{Virtual_tmp_table}} overrides the operator {{new}} to allocate itself on {{mem_root}}, but it does not override the operator {{delete}}, which is mapped to the system function {{free()}} by default. As a result {{free()}} is called for something which was never allocated with the system function {{malloc()}}. The class {{Virtual_tmp_table}} should override {{operator delete}}.

            The problem was introduces by the patch for MDEV-9238 in {{10.2.0}}.

            bar Alexander Barkov made changes -
            Description If OOM (out of memory) happens inside {{create_virtual_tmp_table()}}, the server can crash.

            There are two problems:

            1. If OOM happens inside {{multi_alloc_root}} in {{Virtual_tmp_table::init}}, then the {{TABLE::s}} member is {{NULL}}. The destructor calls {{destruct_fields()}} without a test that {{TABLE::s}} was allocated. It should test that {{s}} is not {{NULL}} before calling {{destruct_fields}}.

            2. The class {{Virtual_tmp_table}} overrides the operator {{new}} to allocate itself on {{mem_root}}, but it does not override the operator {{delete}}, which is mapped to the system function {{free()}} by default. As a result {{free()}} is called for something which was never allocated with the system function {{malloc()}}. The class {{Virtual_tmp_table}} should override {{operator delete}}.

            The problem was introduces by the patch for MDEV-9238 in {{10.2.0}}.

            		If OOM (out of memory) happens inside {{create_virtual_tmp_table()}}, the server can crash.

            There are two problems:

            1. If OOM happens inside {{multi_alloc_root}} in {{Virtual_tmp_table::init}}, then the {{TABLE::s}} member is {{NULL}}. The destructor calls {{destruct_fields()}} without a test that {{TABLE::s}} was allocated. It should test that {{s}} is not {{NULL}} before calling {{destruct_fields}}.

            2. The class {{Virtual_tmp_table}} overrides the operator {{new}} to allocate itself on {{mem_root}}, but it does not override the operator {{delete}}, which is mapped to the system function {{free()}} by default. As a result {{free()}} is called for something which was never allocated with the system function {{malloc()}}. The class {{Virtual_tmp_table}} should override {{operator delete}}.

            The problem was introduced by the patch for MDEV-9238 in {{10.2.0}}.

            bar Alexander Barkov made changes -
            Description If OOM (out of memory) happens inside {{create_virtual_tmp_table()}}, the server can crash.

            There are two problems:

            1. If OOM happens inside {{multi_alloc_root}} in {{Virtual_tmp_table::init}}, then the {{TABLE::s}} member is {{NULL}}. The destructor calls {{destruct_fields()}} without a test that {{TABLE::s}} was allocated. It should test that {{s}} is not {{NULL}} before calling {{destruct_fields}}.

            2. The class {{Virtual_tmp_table}} overrides the operator {{new}} to allocate itself on {{mem_root}}, but it does not override the operator {{delete}}, which is mapped to the system function {{free()}} by default. As a result {{free()}} is called for something which was never allocated with the system function {{malloc()}}. The class {{Virtual_tmp_table}} should override {{operator delete}}.

            The problem was introduced by the patch for MDEV-9238 in {{10.2.0}}.

            		If OOM (out of memory) happens inside {{create_virtual_tmp_table()}}, the server can crash.

            There are two problems:

            1. If OOM happens inside {{multi_alloc_root}} in {{Virtual_tmp_table::init}}, then the member {{TABLE::s}} is left to be a {{NULL}} pointer. The destructor calls {{destruct_fields()}} without a test that {{TABLE::s}} was really allocated. It should test that {{s}} is not {{NULL}} before calling {{destruct_fields}}.

            2. The class {{Virtual_tmp_table}} overrides the operator {{new}} to allocate itself on {{mem_root}}, but it does not override the operator {{delete}}, which is mapped to the system function {{free()}} by default. As a result {{free()}} is called for something which was never allocated with the system function {{malloc()}}. The class {{Virtual_tmp_table}} should override {{operator delete}}.

            The problem was introduced by the patch for MDEV-9238 in {{10.2.0}}.

            bar Alexander Barkov made changes -
            Status Open [ 1 ] In Progress [ 3 ]
            bar Alexander Barkov made changes -
            bar Alexander Barkov made changes -
            Assignee Alexander Barkov [ bar ] Alexey Botchkov [ holyfoot ]
            Status In Progress [ 3 ] In Review [ 10002 ]
            holyfoot Alexey Botchkov made changes -
            Status In Review [ 10002 ] Stalled [ 10000 ]
            holyfoot Alexey Botchkov made changes -
            Assignee Alexey Botchkov [ holyfoot ] Alexander Barkov [ bar ]
            bar Alexander Barkov made changes -
            Status Stalled [ 10000 ] In Progress [ 3 ]
            bar Alexander Barkov made changes -
            issue.field.resolutiondate 2017-03-31 12:03:10.0 2017-03-31 12:03:10.433
            bar Alexander Barkov made changes -
            Fix Version/s 10.2.5 [ 22117 ]
            Fix Version/s 10.2 [ 14601 ]
            Resolution Fixed [ 1 ]
            Status In Progress [ 3 ] Closed [ 6 ]
            serg Sergei Golubchik made changes -
            Workflow MariaDB v3 [ 80205 ] MariaDB v4 [ 151899 ]

            People

              bar Alexander Barkov
              bar Alexander Barkov
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.