Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
12.3.3
-
None
-
Linux/amd64
-
Can result in hang or crash
Description
MariaDB 12.3.3-MariaDB-ubu2404 on Linux/amd64 accepts a Table_map event whose optional SIGNEDNESS metadata declares a ten-byte payload but ends immediately after the length byte. It then processes the dependent Write_rows event and inserts the row without reporting an error or interrupting the server.
Reproducer
Run the following SQL on MariaDB 12.3.3:
DROP DATABASE IF EXISTS replication_metadata_lab; |
CREATE DATABASE replication_metadata_lab; |
CREATE TABLE replication_metadata_lab.signedness_replay_input(a INT, b INT); |
SET SESSION binlog_format=ROW; |
|
|
-- Format_description event required by BINLOG replay.
|
BINLOG 'wlZOTw8BAAAA8QAAAPUAAAAAAAQANS41LjIxLU1hcmlhREItZGVidWctbG9nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEzgNAAgAEgAEBAQEEgAA2QAEGggAAAAICAgCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA371saA=='; |
|
|
-- Table_map plus Write_rows. The Table_map's final 01 0a is a SIGNEDNESS TLV
|
-- declaring ten payload bytes, but no payload bytes follow it.
|
BINLOG 'wlZOTxMBAAAAVQAAAGMBAAAAgCkAAAAAAAEAGHJlcGxpY2F0aW9uX21ldGFkYXRhX2xhYgAXc2lnbmVkbmVzc19yZXBsYXlfaW5wdXQAAgMDAAIBCg==
|
wlZOTxcBAAAAJgAAAGICAAAAACkAAAAAAAEAAv/8AgAAAAgAAAA='; |
|
|
SELECT CONCAT('oracle_row=',COUNT(*),':',COALESCE(MIN(CONCAT(a,',',b)),'NULL')) |
FROM replication_metadata_lab.signedness_replay_input; |
DROP DATABASE replication_metadata_lab; |
Observed result
The BINLOG statements complete successfully, and the query shows that the dependent row event inserted (2,8):
CONCAT('oracle_row=',COUNT(*),':',COALESCE(MIN(CONCAT(a,',',b)),'NULL'))
|
oracle_row=1:2,8
|
Expected result
MariaDB should reject the malformed Table_map before applying its dependent Write_rows event. The encoded length and declared payload of every optional-metadata TLV must fit wholly within the Table_map optional-metadata block.
This occurs when replaying a binlog event with an unusually truncated optional-metadata TLV followed by a dependent row event.
Attachments
Issue Links
- is part of
-
MDEV-41732 Add Missing Binlog Log Event Validation
-
- Open
-