Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-15772

Potential list overrun during XA recovery

    XMLWordPrintable

Details

    Description

      In ha_recover() array of XA transactions is allocated as following:

      #define MAX_XID_LIST_SIZE  (1024*128)
      #define MIN_XID_LIST_SIZE  128
       
        for (info.len= MAX_XID_LIST_SIZE ;
             info.list==0 && info.len > MIN_XID_LIST_SIZE; info.len/=2)
        {
          info.list=(XID *)my_malloc(info.len*sizeof(XID), MYF(0));
        }
        if (!info.list)
        {
          sql_print_error(ER(ER_OUTOFMEMORY),
                          static_cast<int>(info.len*sizeof(XID)));
          DBUG_RETURN(1);
        }
      

      Then each storage engine fills this array. However at least InnoDB (trx_recover_for_mysql()) doesn't check for boundaries and may overrun this array.

      Attachments

        Issue Links

          Activity

            People

              marko Marko Mäkelä
              svoj Sergey Vojtovich
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.