[MDEV-20097] potential use-after-free - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.1(EOL), 10.2(EOL), 10.3(EOL), 10.4(EOL)
Fix Version/s: 10.2.26, 10.1.41, 10.3.17, 10.4.7
Component/s: Data Definition - Alter Table, Storage Engine - InnoDB
Labels:
None

Description

But was revealed while I was working on https://jira.mariadb.org/browse/MDEV-19471

buf is an alias for a merge_buf[i] and thus both must have the same value.

Here is where it's violated:
https://github.com/MariaDB/server/blob/f616e2b97fec3a8105c70cd72e80d6ef57f460c7/storage/innobase/row/row0merge.cc#L1918

Attachments

Issue Links

relates to

MDEV-19471 Add ASAN-poisoned redzones for mem_heap_t

Closed

Activity

Ascending order - Click to sort in descending order

Eugene Kosov (Inactive) created issue - 2019-07-18 19:16

Eugene Kosov (Inactive) made changes - 2019-07-18 19:16

Field	Original Value	New Value
Rank		Ranked higher

Eugene Kosov (Inactive) made changes - 2019-07-19 08:44

Fix Version/s		10.1.41 [ 23406 ]
Fix Version/s		10.2.26 [ 23409 ]
Fix Version/s		10.3.17 [ 23411 ]
Fix Version/s		10.4.7 [ 23720 ]
Fix Version/s	10.2 [ 14601 ]
Fix Version/s	10.1 [ 16100 ]
Fix Version/s	10.3 [ 22126 ]
Fix Version/s	10.4 [ 22408 ]
Resolution		Fixed [ 1 ]
Status	Open [ 1 ]	Closed [ 6 ]

Eugene Kosov (Inactive) made changes - 2019-07-19 08:44

Link

This issue relates to ~~MDEV-19471~~ [ ~~MDEV-19471~~ ]

Sergei Golubchik made changes - 2021-12-06 21:49

Workflow

MariaDB v3 [ 98346 ]

MariaDB v4 [ 156494 ]

People

Assignee:: Eugene Kosov (Inactive)

Reporter:: Eugene Kosov (Inactive)

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2019-07-18 19:16

Updated:: 2019-07-19 08:44

Resolved:: 2019-07-19 08:44

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.