Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-23999

Potential stack overflow in InnoDB fulltext search

    XMLWordPrintable

    Details

      Description

      With a complex MATCH...AGAINST string, the call stack inside the server could look like this:

      10.1

      fts_ast_visit_sub_exp
      fts_query_visitor
      fts_ast_visit
      fts_ast_visit
      ...
      fts_ast_visit_sub_exp
      fts_query_visitor
      fts_ast_visit
      fts_ast_visit
      fts_ast_visit_sub_exp
      fts_query_visitor
      fts_ast_visit
      fts_query
      ha_innobase::ft_init_ext
      Item_func_match::init_search
      init_ftfuncs
      JOIN::optimize_inner
      JOIN::optimize
      mysql_select
      

      On my platform (GCC 10.2.0 -Og AMD64 debug build), the stack usage is 464 bytes for each fts_ast_visit_sub_exp(), and further 9,248 bytes from Item_func_match::init_search() to the first fts_ast_visit_sub_exp().

      To prevent stack overflow, we should return an error if too deep recursion is encountered.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              marko Marko Mäkelä
              Reporter:
              marko Marko Mäkelä
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Git Integration