Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40542

MSAN use-of-uninitialized-value on Unknown_log_event::read_checksum_alg

    XMLWordPrintable

Details

    Description

      To reproduce, handcraft a malformed event in a binary log and read it with mariadb-binlog --force-read, like in MDEV-39485's new test, main.binlog_invalid_row_v2_tag.

        Uninitialized value was stored to memory at
          #0 in Log_event::print_header(st_io_cache*, st_print_event_info*, bool) /path/to/src/sql/log_event_client.cc:349:7
          #1 in Unknown_log_event::print(_IO_FILE*, st_print_event_info*) /path/to/src/sql/log_event_client.cc:2611:9
      [...]
       
        Memory was marked as uninitialized
      [...]
          #2 in Log_event::operator new(unsigned long) /path/to/src/sql/log_event.h:1477:12
          #3 in Log_event::read_log_event(unsigned char const*, unsigned int, char const**, Format_description_log_event const*, char, char) /path/to/src/sql/log_event.cc
          #4 in Log_event::read_log_event(st_io_cache*, int*, Format_description_log_event const*, char, char, unsigned long) /path/to/src/sql/log_event.cc:926:13
      [...]
      

      Code Analysis

      The Log_event constructor used to always initialize the checksum algorithm field to UNDEF; the actual algorithm is set later.

      MDEV-31273 Commit 2 removed this constructor initialization, but missed that the creation of mariadb-binlog --force-read's Unknown_log_event substitutes for invalid events is after the recording of the actual algorithm.

      Checksum failures (in mariadb-binlog --verify-binlog-checksum --force-read) also has a similarly problem:
      An Unknown_log_event is immediately outputted, bypassing the post-processing that records the algorithm.
      In practice, this case encounters MDEV-40544 first, but should face the same problem after MDEV-40544 is fixed.

      Not-events are not affected because they fail in the outer Log_event::read_log_event(st_io_cache*, ...) and become (for whatever reason) encrypted event substitutes that do not output a checksum.

      Fix Recommendations

      Choose One...

      • Restore pre-MDEV-31273 "behaviour" (read: implementation detail) by always setting (or initializing) Unknown_log_event::read_checksum_alg to UNDEF.
      • Reörder the code to also set the actual algorithm for an Unknown_log_event since it's known at this point.
        • This improvement may be worth applying on pre-MDEV-31273 (10.11) as well.

      Blocker priority:
      This bug causes the aforementioned test to brick the required MSAN check.

      Attachments

        Issue Links

          Activity

            People

              ParadoxV5 Jimmy Hú
              ParadoxV5 Jimmy Hú
              Kristian Nielsen Kristian Nielsen
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - 1.5d Original Estimate - 1.5d
                  1.5d
                  Remaining:
                  Time Spent - 3h 10m Remaining Estimate - 1.25d
                  1.25d
                  Logged:
                  Time Spent - 3h 10m Remaining Estimate - 1.25d
                  3h 10m

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.