Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41798

BINLOG accepts a truncated Table_map SIGNEDNESS TLV and applies the dependent row event

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      MariaDB 12.3.3-MariaDB-ubu2404 on Linux/amd64 accepts a Table_map event whose optional SIGNEDNESS metadata declares a ten-byte payload but ends immediately after the length byte. It then processes the dependent Write_rows event and inserts the row without reporting an error or interrupting the server.

      Reproducer

      Run the following SQL on MariaDB 12.3.3:

      DROP DATABASE IF EXISTS replication_metadata_lab;
      CREATE DATABASE replication_metadata_lab;
      CREATE TABLE replication_metadata_lab.signedness_replay_input(a INT, b INT);
      SET SESSION binlog_format=ROW;
       
      -- Format_description event required by BINLOG replay.
      BINLOG 'wlZOTw8BAAAA8QAAAPUAAAAAAAQANS41LjIxLU1hcmlhREItZGVidWctbG9nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEzgNAAgAEgAEBAQEEgAA2QAEGggAAAAICAgCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA371saA==';
       
      -- Table_map plus Write_rows. The Table_map's final 01 0a is a SIGNEDNESS TLV
      -- declaring ten payload bytes, but no payload bytes follow it.
      BINLOG 'wlZOTxMBAAAAVQAAAGMBAAAAgCkAAAAAAAEAGHJlcGxpY2F0aW9uX21ldGFkYXRhX2xhYgAXc2lnbmVkbmVzc19yZXBsYXlfaW5wdXQAAgMDAAIBCg==
      wlZOTxcBAAAAJgAAAGICAAAAACkAAAAAAAEAAv/8AgAAAAgAAAA=';
       
      SELECT CONCAT('oracle_row=',COUNT(*),':',COALESCE(MIN(CONCAT(a,',',b)),'NULL'))
      FROM replication_metadata_lab.signedness_replay_input;
      DROP DATABASE replication_metadata_lab;

      Observed result

      The BINLOG statements complete successfully, and the query shows that the dependent row event inserted (2,8):

      CONCAT('oracle_row=',COUNT(*),':',COALESCE(MIN(CONCAT(a,',',b)),'NULL'))
      oracle_row=1:2,8

      Expected result

      MariaDB should reject the malformed Table_map before applying its dependent Write_rows event. The encoded length and declared payload of every optional-metadata TLV must fit wholly within the Table_map optional-metadata block.

      This occurs when replaying a binlog event with an unusually truncated optional-metadata TLV followed by a dependent row event.

      Attachments

        Issue Links

          Activity

            People

              knielsen Kristian Nielsen
              imchifan 刘启帆
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.