Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-23999

Potential stack overflow in InnoDB fulltext search

    XMLWordPrintable

Details

    Description

      With a complex MATCH...AGAINST string, the call stack inside the server could look like this:

      10.1

      fts_ast_visit_sub_exp
      fts_query_visitor
      fts_ast_visit
      fts_ast_visit
      ...
      fts_ast_visit_sub_exp
      fts_query_visitor
      fts_ast_visit
      fts_ast_visit
      fts_ast_visit_sub_exp
      fts_query_visitor
      fts_ast_visit
      fts_query
      ha_innobase::ft_init_ext
      Item_func_match::init_search
      init_ftfuncs
      JOIN::optimize_inner
      JOIN::optimize
      mysql_select
      

      On my platform (GCC 10.2.0 -Og AMD64 debug build), the stack usage is 464 bytes for each fts_ast_visit_sub_exp(), and further 9,248 bytes from Item_func_match::init_search() to the first fts_ast_visit_sub_exp().

      To prevent stack overflow, we should return an error if too deep recursion is encountered.

      Attachments

        Issue Links

          Activity

            People

              marko Marko Mäkelä
              marko Marko Mäkelä
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.