Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
10.6, 10.11, 11.4, 11.8
-
Not for Release Notes
Description
MariaDB builds can fail as follows:
FAILED: sql/CMakeFiles/sql.dir/field.cc.o
|
/usr/bin/c++ -DHAVE_CONFIG_H -DHAVE_EVENT_SCHEDULER -DHAVE_POOL_OF_THREADS -DMYSQL_SERVER -D_FILE_OFFSET_BITS=64 -I/mariadb/10.11/wsrep-lib/include -I/mariadb/10.11/wsrep-lib/wsrep-API/v26 -I/dev/shm/10.11/include -I/mariadb/10.11/include/providers -I/mariadb/10.11/include -I/mariadb/10.11/sql -I/dev/shm/10.11/sql -I/mariadb/10.11/tpool -O2 -march=native -pie -fPIC -fstack-protector --param=ssp-buffer-size=4 -fPIC -g -DPROTECT_STATEMENT_MEMROOT -DENABLED_DEBUG_SYNC -D_GLIBCXX_DEBUG -D_GLIBCXX_ASSERTIONS -ggdb3 -DSAFE_MUTEX -DTRASH_FREED_MEMORY -Wall -Wenum-compare -Wenum-conversion -Wextra -Wmissing-braces -Wno-format-truncation -Wno-init-self -Wno-nonnull-compare -Wno-unused-parameter -Wnon-virtual-dtor -Woverloaded-virtual -Wsuggest-override -Wvla -Wwrite-strings -Werror -fno-operator-names -std=gnu++11 -DHAVE_OPENSSL -DOPENSSL_API_COMPAT=0x10100000L -MD -MT sql/CMakeFiles/sql.dir/field.cc.o -MF sql/CMakeFiles/sql.dir/field.cc.o.d -o sql/CMakeFiles/sql.dir/field.cc.o -c /mariadb/10.11/sql/field.cc
|
In file included from /mariadb/10.11/sql/structs.h:26,
|
from /mariadb/10.11/sql/handler.h:34,
|
from /mariadb/10.11/sql/log.h:20,
|
from /mariadb/10.11/sql/sql_class.h:28,
|
from /mariadb/10.11/sql/procedure.h:31,
|
from /mariadb/10.11/sql/sql_select.h:31,
|
from /mariadb/10.11/sql/field.cc:32:
|
In function 'long int my_time_fraction_remainder(long int, uint)',
|
inlined from 'long int Timestamp::fraction_remainder(uint) const' at /mariadb/10.11/sql/sql_type.h:2815:38,
|
inlined from 'Timestamp& Timestamp::round(uint, time_round_mode_t, int*)' at /mariadb/10.11/sql/sql_type.h:2831:7,
|
inlined from 'virtual int Field_timestamp::store_timestamp_dec(const timeval&, uint)' at /mariadb/10.11/sql/field.cc:5411:42:
|
/mariadb/10.11/include/my_time.h:234:67: error: array subscript 4294901767 is above array bounds of 'ulonglong [20]' {aka 'long long unsigned int [20]'} [-Werror=array-bounds=]
|
234 | return nr % (long) log_10_int[TIME_SECOND_PART_DIGITS - decimals];
|
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
|
/mariadb/10.11/include/my_time.h: In member function 'virtual int Field_timestamp::store_timestamp_dec(const timeval&, uint)':
|
/mariadb/10.11/include/my_time.h:30:38: note: while referencing 'log_10_int'
|
30 | extern MYSQL_PLUGIN_IMPORT ulonglong log_10_int[20];
|
| ^~~~~~~~~~
|
The following patch fixes the problem:
diff --git a/include/my_time.h b/include/my_time.h
|
index 9f3e61b944f..90a8885a293 100644
|
--- a/include/my_time.h
|
+++ b/include/my_time.h
|
@@ -230,7 +230,6 @@ static inline longlong sec_part_unshift(longlong second_part, uint digits)
|
/* Date/time rounding and truncation functions */
|
static inline long my_time_fraction_remainder(long nr, uint decimals)
|
{
|
- DBUG_ASSERT(decimals <= TIME_SECOND_PART_DIGITS);
|
return nr % (long) log_10_int[TIME_SECOND_PART_DIGITS - decimals];
|
}
|
static inline void my_datetime_trunc(MYSQL_TIME *ltime, uint decimals) |
This inline function is being invoked from many places. Other inline functions that access the table log_10_int are missing such an assertion. We regularly build and test cmake -DWITH_ASAN=ON, which should catch any buffer overflow here even when the DBUG_ASSERT is not present.