Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-23999

Potential stack overflow in InnoDB fulltext search

Details

    Description

      With a complex MATCH...AGAINST string, the call stack inside the server could look like this:

      10.1

      fts_ast_visit_sub_exp
      fts_query_visitor
      fts_ast_visit
      fts_ast_visit
      ...
      fts_ast_visit_sub_exp
      fts_query_visitor
      fts_ast_visit
      fts_ast_visit
      fts_ast_visit_sub_exp
      fts_query_visitor
      fts_ast_visit
      fts_query
      ha_innobase::ft_init_ext
      Item_func_match::init_search
      init_ftfuncs
      JOIN::optimize_inner
      JOIN::optimize
      mysql_select
      

      On my platform (GCC 10.2.0 -Og AMD64 debug build), the stack usage is 464 bytes for each fts_ast_visit_sub_exp(), and further 9,248 bytes from Item_func_match::init_search() to the first fts_ast_visit_sub_exp().

      To prevent stack overflow, we should return an error if too deep recursion is encountered.

      Attachments

        Issue Links

          Activity

            There are no comments yet on this issue.

            People

              marko Marko Mäkelä
              marko Marko Mäkelä
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.