Details
-
Bug
-
Status: Open (View Workflow)
-
Blocker
-
Resolution: Unresolved
-
11.4
-
MemorySanitizer
Description
To reproduce, handcraft a malformed event in a binary log and read it with mariadb-binlog --force-read, like in MDEV-39485's new test, main.binlog_invalid_row_v2_tag.
Uninitialized value was stored to memory at
|
#0 in Log_event::print_header(st_io_cache*, st_print_event_info*, bool) /path/to/src/sql/log_event_client.cc:349:7
|
#1 in Unknown_log_event::print(_IO_FILE*, st_print_event_info*) /path/to/src/sql/log_event_client.cc:2611:9
|
[...]
|
|
|
Memory was marked as uninitialized
|
[...]
|
#2 in Log_event::operator new(unsigned long) /path/to/src/sql/log_event.h:1477:12
|
#3 in Log_event::read_log_event(unsigned char const*, unsigned int, char const**, Format_description_log_event const*, char, char) /path/to/src/sql/log_event.cc
|
#4 in Log_event::read_log_event(st_io_cache*, int*, Format_description_log_event const*, char, char, unsigned long) /path/to/src/sql/log_event.cc:926:13
|
[...]
|
Code Analysis
The Log_event constructor used to always initialize the checksum algorithm field to UNDEF; the actual algorithm is set later.
MDEV-31273 Commit 2 removed this constructor initialization, but missed that the creation of mariadb-binlog --force-read's Unknown_log_event substitutes for invalid events is after the recording of the actual algorithm.
Checksum failures (in mariadb-binlog --verify-binlog-checksum --force-read) also has a similarly problem:
An Unknown_log_event is immediately outputted, bypassing the post-processing that records the algorithm.
In practice, this case encounters MDEV-40544 first, but should face the same problem after MDEV-40544 is fixed.
Not-events are not affected because they fail in the outer Log_event::read_log_event(st_io_cache*, ...) and become (for whatever reason) encrypted event substitutes that do not output a checksum.
Fix Recommendations
Choose One...
- Restore pre-
MDEV-31273"behaviour" (read: implementation detail) by always setting (or initializing) Unknown_log_event::read_checksum_alg to UNDEF. - Reörder the code to also set the actual algorithm for an Unknown_log_event since it's known at this point.
- This improvement may be worth applying on pre-
MDEV-31273(10.11) as well.
- This improvement may be worth applying on pre-
Blocker priority:
This bug causes the aforementioned test to brick the required MSAN check.
Attachments
Issue Links
- is caused by
-
MDEV-31273 Optimize write to binlog
-
- Closed
-
- relates to
-
MDEV-37060 MSAN binlog_encryption.mysqlbinlog - client event server_id uninitialized in is_server_id_excluded check
-
- Closed
-
- split to
-
MDEV-40544 Assertion fail / Memory leak in `mariadb-binlog --force-read`
-
- Open
-
-
MDEV-40545 `mariadb-binlog -f` infinite loop on 13-18 byte not-event
-
- Open
-