[MDEV-15834] The code in TABLE_SHARE::init_from_binary_frm_image() is not safe - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 5.5(EOL), 10.0(EOL), 10.1(EOL), 10.2(EOL), 10.3(EOL)
Fix Version/s: 5.5.61, 10.0.36, 10.1.35, 10.2.16, 10.3.8, 10.4.0
Component/s: Virtual Columns
Labels:
None

Description

The code in TABLE_SHARE::init_from_binary_frm_image() is not safe for broken FRM files.

In debug mode it can crash on assert.
In release mode its behavior is not predictable.

interval_nr=  (uint) strpos[12];

...

DBUG_ASSERT(interval_nr); // Expect non-null expression

...

vcol_info_length= interval_nr;

vcol_expr_length= vcol_info_length -

                          (uint)(FRM_VCOL_OLD_HEADER_SIZE(opt_interval_id));

...

The same problem presents in the branch for MYSQL57_GENERATED_FIELD (since 10.2), it's reported as a separate issue ~~MDEV-16518~~.

Attachments

- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

t1.frm
8 kB
2018-06-19 06:04

Issue Links

blocks

MDEV-4912 Data type plugin API version 1

Closed

relates to

MDEV-16518 MYSQL57_GENERATED_FIELD: The code in TABLE_SHARE::init_from_binary_frm_image() is not safe

Closed

Activity

Ascending order - Click to sort in descending order

Alexander Barkov created issue - 2018-04-10 08:37

Alexander Barkov made changes - 2018-04-10 08:37

Field	Original Value	New Value
Link		This issue blocks ~~MDEV-4912~~ [ ~~MDEV-4912~~ ]

Alexander Barkov made changes - 2018-04-10 08:39

Description

The code in TABLE_SHARE::init_from_binary_frm_image() is not safe for broken FRM files.

In debug mode it can crash of assert.
In release mode its behavior is not predictable.

{code:cpp}
interval_nr= (uint) strpos[12];
...
DBUG_ASSERT(interval_nr); // Expect non-null expression
...
vcol_info_length= interval_nr;
vcol_expr_length= vcol_info_length -
(uint)(FRM_VCOL_OLD_HEADER_SIZE(opt_interval_id));
...

{code}

The same problem presents in the branch for MYSQL57_GENERATED_FIELD:
{code:cpp}
vcol_info_length= uint2korr(vcol_screen_pos + 1);
...
DBUG_ASSERT(vcol_info_length)
...
vcol_screen_pos+= vcol_info_length + MYSQL57_GCOL_HEADER_SIZE;;
{code}

The code in TABLE_SHARE::init_from_binary_frm_image() is not safe for broken FRM files.

In debug mode it can crash of assert.
In release mode its behavior is not predictable.

{code:cpp}
interval_nr= (uint) strpos[12];
...
DBUG_ASSERT(interval_nr); // Expect non-null expression
...
vcol_info_length= interval_nr;
vcol_expr_length= vcol_info_length -
(uint)(FRM_VCOL_OLD_HEADER_SIZE(opt_interval_id));
...

{code}

The same problem presents in the branch for MYSQL57_GENERATED_FIELD:
{code:cpp}
vcol_info_length= uint2korr(vcol_screen_pos + 1);
...
DBUG_ASSERT(vcol_info_length);
...
vcol_screen_pos+= vcol_info_length + MYSQL57_GCOL_HEADER_SIZE;
{code}

Alexander Barkov made changes - 2018-04-10 17:22

Affects Version/s		10.2 [ 14601 ]
Affects Version/s		10.3 [ 22126 ]
Affects Version/s		10.1 [ 16100 ]

Alexander Barkov made changes - 2018-04-10 17:23

Affects Version/s

5.5 [ 15800 ]

Alexander Barkov made changes - 2018-04-10 17:25

Fix Version/s		10.2 [ 14601 ]
Fix Version/s		10.3 [ 22126 ]
Fix Version/s		5.5 [ 15800 ]
Fix Version/s		10.0 [ 16000 ]
Fix Version/s		10.1 [ 16100 ]

Alexander Barkov made changes - 2018-04-10 17:26

Affects Version/s

10.0 [ 16000 ]

Alexander Barkov made changes - 2018-06-19 06:04

Attachment

t1.frm [ 45769 ]

Alexander Barkov added a comment - 2018-06-19 06:05

To reproduce the problem, put the attached f1.frm into the MariaDB data directory and run:

TRUNCATE TABLE t1;

It crashes with the following output:

mysqld: /home/bar/maria-git/server.5.5/sql/table.cc:1465: int open_binary_frm(THD*, TABLE_SHARE*, uchar*, File): Assertion `interval_nr' failed.

Program received signal SIGABRT, Aborted.

[Switching to Thread 0x7ffff7f81700 (LWP 8869)]

0x00007ffff670ba28 in __GI_raise (sig=sig@entry=6)

    at ../sysdeps/unix/sysv/linux/raise.c:55

55	  return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);

Alexander Barkov added a comment - 2018-06-19 06:05 To reproduce the problem, put the attached f1.frm into the MariaDB data directory and run: TRUNCATE TABLE t1; It crashes with the following output: mysqld: /home/bar/maria-git/server.5.5/sql/table.cc:1465: int open_binary_frm(THD*, TABLE_SHARE*, uchar*, File): Assertion `interval_nr' failed. Program received signal SIGABRT, Aborted. [Switching to Thread 0x7ffff7f81700 (LWP 8869)] 0x00007ffff670ba28 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55 55 return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);

Alexander Barkov made changes - 2018-06-19 06:07

Status

Open [ 1 ]

In Progress [ 3 ]

Alexander Barkov made changes - 2018-06-19 06:28

Description

The code in TABLE_SHARE::init_from_binary_frm_image() is not safe for broken FRM files.

In debug mode it can crash of assert.
In release mode its behavior is not predictable.

{code:cpp}
interval_nr= (uint) strpos[12];
...
DBUG_ASSERT(interval_nr); // Expect non-null expression
...
vcol_info_length= interval_nr;
vcol_expr_length= vcol_info_length -
(uint)(FRM_VCOL_OLD_HEADER_SIZE(opt_interval_id));
...

{code}

The same problem presents in the branch for MYSQL57_GENERATED_FIELD:
{code:cpp}
vcol_info_length= uint2korr(vcol_screen_pos + 1);
...
DBUG_ASSERT(vcol_info_length);
...
vcol_screen_pos+= vcol_info_length + MYSQL57_GCOL_HEADER_SIZE;
{code}

The code in TABLE_SHARE::init_from_binary_frm_image() is not safe for broken FRM files.

In debug mode it can crash of assert.
In release mode its behavior is not predictable.

{code:cpp}
interval_nr= (uint) strpos[12];
...
DBUG_ASSERT(interval_nr); // Expect non-null expression
...
vcol_info_length= interval_nr;
vcol_expr_length= vcol_info_length -
(uint)(FRM_VCOL_OLD_HEADER_SIZE(opt_interval_id));
...

{code}

The same problem presents in the branch for MYSQL57_GENERATED_FIELD (since 10.2):
{code:cpp}
vcol_info_length= uint2korr(vcol_screen_pos + 1);
...
DBUG_ASSERT(vcol_info_length);
...
vcol_screen_pos+= vcol_info_length + MYSQL57_GCOL_HEADER_SIZE;
{code}

Alexander Barkov made changes - 2018-06-19 06:35

Link

This issue relates to ~~MDEV-16518~~ [ ~~MDEV-16518~~ ]

Alexander Barkov made changes - 2018-06-19 06:59

Description

The code in TABLE_SHARE::init_from_binary_frm_image() is not safe for broken FRM files.

In debug mode it can crash of assert.
In release mode its behavior is not predictable.

{code:cpp}
interval_nr= (uint) strpos[12];
...
DBUG_ASSERT(interval_nr); // Expect non-null expression
...
vcol_info_length= interval_nr;
vcol_expr_length= vcol_info_length -
(uint)(FRM_VCOL_OLD_HEADER_SIZE(opt_interval_id));
...

{code}

The same problem presents in the branch for MYSQL57_GENERATED_FIELD (since 10.2):
{code:cpp}
vcol_info_length= uint2korr(vcol_screen_pos + 1);
...
DBUG_ASSERT(vcol_info_length);
...
vcol_screen_pos+= vcol_info_length + MYSQL57_GCOL_HEADER_SIZE;
{code}

The code in TABLE_SHARE::init_from_binary_frm_image() is not safe for broken FRM files.

In debug mode it can crash of assert.
In release mode its behavior is not predictable.

{code:cpp}
interval_nr= (uint) strpos[12];
...
DBUG_ASSERT(interval_nr); // Expect non-null expression
...
vcol_info_length= interval_nr;
vcol_expr_length= vcol_info_length -
(uint)(FRM_VCOL_OLD_HEADER_SIZE(opt_interval_id));
...

{code}

The same problem presents in the branch for MYSQL57_GENERATED_FIELD (since 10.2), it's reported as a separate issue ~~MDEV-16518~~.

Alexander Barkov made changes - 2018-06-19 07:00

Description

The code in TABLE_SHARE::init_from_binary_frm_image() is not safe for broken FRM files.

In debug mode it can crash of assert.
In release mode its behavior is not predictable.

{code:cpp}
interval_nr= (uint) strpos[12];
...
DBUG_ASSERT(interval_nr); // Expect non-null expression
...
vcol_info_length= interval_nr;
vcol_expr_length= vcol_info_length -
(uint)(FRM_VCOL_OLD_HEADER_SIZE(opt_interval_id));
...

{code}

The same problem presents in the branch for MYSQL57_GENERATED_FIELD (since 10.2), it's reported as a separate issue ~~MDEV-16518~~.

The code in TABLE_SHARE::init_from_binary_frm_image() is not safe for broken FRM files.

In debug mode it can crash on assert.
In release mode its behavior is not predictable.

{code:cpp}
interval_nr= (uint) strpos[12];
...
DBUG_ASSERT(interval_nr); // Expect non-null expression
...
vcol_info_length= interval_nr;
vcol_expr_length= vcol_info_length -
(uint)(FRM_VCOL_OLD_HEADER_SIZE(opt_interval_id));
...

{code}

The same problem presents in the branch for MYSQL57_GENERATED_FIELD (since 10.2), it's reported as a separate issue ~~MDEV-16518~~.

Alexander Barkov made changes - 2018-06-19 09:03

issue.field.resolutiondate

2018-06-19 09:03:57.0

2018-06-19 09:03:57.004

Alexander Barkov made changes - 2018-06-19 09:03

Component/s		Virtual Columns [ 10803 ]
Fix Version/s		5.5.61 [ 22914 ]
Fix Version/s		10.0.36 [ 22916 ]
Fix Version/s		10.1.35 [ 23116 ]
Fix Version/s		10.2.16 [ 23110 ]
Fix Version/s		10.3.8 [ 23113 ]
Fix Version/s		10.4.0 [ 23115 ]
Fix Version/s	10.2 [ 14601 ]
Fix Version/s	5.5 [ 15800 ]
Fix Version/s	10.0 [ 16000 ]
Fix Version/s	10.1 [ 16100 ]
Fix Version/s	10.3 [ 22126 ]
Resolution		Fixed [ 1 ]
Status	In Progress [ 3 ]	Closed [ 6 ]

Sergei Golubchik made changes - 2021-12-06 21:47

Workflow

MariaDB v3 [ 86462 ]

MariaDB v4 [ 154134 ]

People

Assignee:: Alexander Barkov

Reporter:: Alexander Barkov

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2018-04-10 08:37

Updated:: 2018-06-26 07:43

Resolved:: 2018-06-19 09:03

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server

Details

Description

Attachments

Attachments

Issue Links

Activity

People

Dates

Git Integration