Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-23999

Potential stack overflow in InnoDB fulltext search

Details

    Description

      With a complex MATCH...AGAINST string, the call stack inside the server could look like this:

      10.1

      fts_ast_visit_sub_exp
      fts_query_visitor
      fts_ast_visit
      fts_ast_visit
      ...
      fts_ast_visit_sub_exp
      fts_query_visitor
      fts_ast_visit
      fts_ast_visit
      fts_ast_visit_sub_exp
      fts_query_visitor
      fts_ast_visit
      fts_query
      ha_innobase::ft_init_ext
      Item_func_match::init_search
      init_ftfuncs
      JOIN::optimize_inner
      JOIN::optimize
      mysql_select
      

      On my platform (GCC 10.2.0 -Og AMD64 debug build), the stack usage is 464 bytes for each fts_ast_visit_sub_exp(), and further 9,248 bytes from Item_func_match::init_search() to the first fts_ast_visit_sub_exp().

      To prevent stack overflow, we should return an error if too deep recursion is encountered.

      Attachments

        Issue Links

          Activity

            marko Marko Mäkelä created issue -
            marko Marko Mäkelä made changes -
            Field Original Value New Value
            issue.field.resolutiondate 2020-10-21 07:07:20.0 2020-10-21 07:07:20.86
            marko Marko Mäkelä made changes -
            Fix Version/s 10.1.48 [ 25108 ]
            Fix Version/s 10.2.35 [ 25022 ]
            Fix Version/s 10.3.26 [ 25021 ]
            Fix Version/s 10.4.16 [ 25020 ]
            Fix Version/s 10.5.7 [ 25019 ]
            Fix Version/s 10.2 [ 14601 ]
            Fix Version/s 10.1 [ 16100 ]
            Fix Version/s 10.3 [ 22126 ]
            Fix Version/s 10.4 [ 22408 ]
            Fix Version/s 10.5 [ 23123 ]
            Resolution Fixed [ 1 ]
            Status Open [ 1 ] Closed [ 6 ]
            marko Marko Mäkelä made changes -
            marko Marko Mäkelä made changes -
            serg Sergei Golubchik made changes -
            Workflow MariaDB v3 [ 114789 ] MariaDB v4 [ 158490 ]

            People

              marko Marko Mäkelä
              marko Marko Mäkelä
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.