[MDEV-20097] potential use-after-free - Jira

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.1(EOL), 10.2(EOL), 10.3(EOL), 10.4(EOL)
Fix Version/s: 10.2.26, 10.1.41, 10.3.17, 10.4.7
Component/s: Data Definition - Alter Table, Storage Engine - InnoDB
Labels:
None

Description

But was revealed while I was working on https://jira.mariadb.org/browse/MDEV-19471

buf is an alias for a merge_buf[i] and thus both must have the same value.

Here is where it's violated:
https://github.com/MariaDB/server/blob/f616e2b97fec3a8105c70cd72e80d6ef57f460c7/storage/innobase/row/row0merge.cc#L1918

Attachments

Issue Links

relates to

MDEV-19471 Add ASAN-poisoned redzones for mem_heap_t

Closed

Activity

People

Assignee:: Eugene Kosov (Inactive)

Reporter:: Eugene Kosov (Inactive)

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2019-07-18 19:16

Updated:: 2019-07-19 08:44

Resolved:: 2019-07-19 08:44

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.