Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40200

bound shift width in dyncol integer readers

    XMLWordPrintable

Details

    • Can result in unexpected behaviour
    • Dynamic columns when reading an unsigned integer could overflow the 64 that was used as a shift counter; fix thanks to Syed Mohammed Nayyar

    Description

      Noticed the dyncol integer readers shift by an exponent taken from the value length.

      In dynamic_column_uint_read() the i*8 shift reaches 64 once a COLUMN_GET() blob gives an integer column more than 8 data bytes, and dynamic_column_var_uint_get() keeps shifting length*7 over a run of 0x80 continuation bytes (the charset id of a string value, intg/frac of a decimal). Both are undefined and abort under -fsanitize=shift. Reject the over-long integer and cap the varint at 10 groups.

      Attachments

        Activity

          People

            gkodinov Georgi Kodinov
            gkodinov Georgi Kodinov
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Time Tracking

                Estimated:
                Original Estimate - 0d
                0d
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 1h 10m
                1h 10m

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.