Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-15772

Potential list overrun during XA recovery

    XMLWordPrintable

    Details

      Description

      In ha_recover() array of XA transactions is allocated as following:

      #define MAX_XID_LIST_SIZE  (1024*128)
      #define MIN_XID_LIST_SIZE  128
       
        for (info.len= MAX_XID_LIST_SIZE ;
             info.list==0 && info.len > MIN_XID_LIST_SIZE; info.len/=2)
        {
          info.list=(XID *)my_malloc(info.len*sizeof(XID), MYF(0));
        }
        if (!info.list)
        {
          sql_print_error(ER(ER_OUTOFMEMORY),
                          static_cast<int>(info.len*sizeof(XID)));
          DBUG_RETURN(1);
        }
      

      Then each storage engine fills this array. However at least InnoDB (trx_recover_for_mysql()) doesn't check for boundaries and may overrun this array.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              marko Marko Mäkelä
              Reporter:
              svoj Sergey Vojtovich
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: