Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
12.3
-
None
-
Can result in hang or crash
Description
e.g. this mtr test case:
perl;
|
use autodie;
|
open F, '>', "$ENV{MYSQL_TMP_DIR}/bad-binlog.ibb";
|
print F pack("V*", 0x10dfefe, 17, 1, 0, 1, 0, 16, 0, 0x11dd6, 0, 8, 0, 1, 0);
|
print F "\xff" x 8, "\x00" x 444;
|
print F pack("V", 0x81C60910);
|
print F "\x00" x 1024 for 1..256;
|
EOF
|
--error 1
|
--exec $MYSQL_BINLOG --short-form $MYSQL_TMP_DIR/bad-binlog.ibb
|
--remove_file $MYSQL_TMP_DIR/bad-binlog.ibb
|
This crashes because chunk_reader_mysqlbinlog::parse_file_header() doesn't check that binlog_page_size <= BINLOG_PAGE_SIZE_MAX.
Reported by Shayaun Nejad