Details
Description
In ha_recover() array of XA transactions is allocated as following:
#define MAX_XID_LIST_SIZE (1024*128)
|
#define MIN_XID_LIST_SIZE 128
|
|
for (info.len= MAX_XID_LIST_SIZE ;
|
info.list==0 && info.len > MIN_XID_LIST_SIZE; info.len/=2)
|
{
|
info.list=(XID *)my_malloc(info.len*sizeof(XID), MYF(0));
|
}
|
if (!info.list)
|
{
|
sql_print_error(ER(ER_OUTOFMEMORY),
|
static_cast<int>(info.len*sizeof(XID)));
|
DBUG_RETURN(1);
|
}
|
Then each storage engine fills this array. However at least InnoDB (trx_recover_for_mysql()) doesn't check for boundaries and may overrun this array.
Attachments
Issue Links
- relates to
-
MDEV-19408 Assertion `trx->state == TRX_STATE_ACTIVE || trx->state == TRX_STATE_PREPARED' failed in ReadView::copy_trx_ids, innodb.xa_debug, innodb.innodb fail in buildbot
- Closed