Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-4244

[PATCH] Buffer overruns and use-after-free errors

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • 10.0.1, 5.5.30, 5.3.12
    • 10.0.2, 5.5.31, 5.1.73, 5.3.13
    • None
    • None

    Description

      Please consider the attached patch that fixes several buffer overruns and use-after-free errors detected in MariaDB 10.0.1.

      Attachments

        Activity

          Hi Pavel,

          Do you have any ready-to-use test cases which trigger failures caused by these errors?

          elenst Elena Stepanova added a comment - Hi Pavel, Do you have any ready-to-use test cases which trigger failures caused by these errors?
          pivanof Pavel Ivanov added a comment -

          I found these errors while running regular test suite ("./mtr --force --max-test-fail=0") after compiling full tree with Address Sanitizer (https://code.google.com/p/address-sanitizer/). That's the only way of triggering failures that I have.

          pivanof Pavel Ivanov added a comment - I found these errors while running regular test suite ("./mtr --force --max-test-fail=0") after compiling full tree with Address Sanitizer ( https://code.google.com/p/address-sanitizer/ ). That's the only way of triggering failures that I have.
          pivanof Pavel Ivanov added a comment -

          BTW, I understand that assigned patch contains fixes for several different errors unrelated to each other. Feel free to ask questions if you want me to explain the exact problems being fixed.

          pivanof Pavel Ivanov added a comment - BTW, I understand that assigned patch contains fixes for several different errors unrelated to each other. Feel free to ask questions if you want me to explain the exact problems being fixed.

          I've installed gcc 4.8, compiled with -fsanitize=address and run the test suite.
          This was I've repeated most of the issues and applied your patches (either directly yours or the changes were different, but the patch helped to understand the problem).

          But I did not apply your changes to my_once.c, sql_parse.cc, strfunc.c - the test suite passed, it didn't find any problems related to these files. What did you see in your test runs? Why these changes?

          serg Sergei Golubchik added a comment - I've installed gcc 4.8, compiled with -fsanitize=address and run the test suite. This was I've repeated most of the issues and applied your patches (either directly yours or the changes were different, but the patch helped to understand the problem). But I did not apply your changes to my_once.c, sql_parse.cc, strfunc.c - the test suite passed, it didn't find any problems related to these files. What did you see in your test runs? Why these changes?
          pivanof Pavel Ivanov added a comment -

          I didn't know that Address Sanitizer can be used with gcc.

          I can dig for more exact info about failures tomorrow PST. But from the top of my head:

          my_once.c: There was a failure during shutdown after one test when my_once_free was called after global variables that are used in DBUG_ENTER were already destroyed. Maybe that's a matter of the order of the calls to initializers from different C files...

          sql_parse.cc: There was some test where do_handle_bootstrap() was called and then later some code using current_thd, I think it was my_malloc(... MYF(THREADLOCAL)) inside some function.

          strfunc.cc: This actually was related to the change in ctype-utf8.c. There's a test operating with table name "@". So after the change in ctype-utf8.c my_mb_wc_filename() was able to finish on the first character of the string "@" without asan error, but then without the change strconvert() proceeded to the next character which is already beyond the end of the string.

          pivanof Pavel Ivanov added a comment - I didn't know that Address Sanitizer can be used with gcc. I can dig for more exact info about failures tomorrow PST. But from the top of my head: my_once.c: There was a failure during shutdown after one test when my_once_free was called after global variables that are used in DBUG_ENTER were already destroyed. Maybe that's a matter of the order of the calls to initializers from different C files... sql_parse.cc: There was some test where do_handle_bootstrap() was called and then later some code using current_thd, I think it was my_malloc(... MYF(THREADLOCAL)) inside some function. strfunc.cc: This actually was related to the change in ctype-utf8.c. There's a test operating with table name "@". So after the change in ctype-utf8.c my_mb_wc_filename() was able to finish on the first character of the string "@" without asan error, but then without the change strconvert() proceeded to the next character which is already beyond the end of the string.

          fixed all issues, pushed in 5.1 and 5.3 (different fixes, where appropriate)

          serg Sergei Golubchik added a comment - fixed all issues, pushed in 5.1 and 5.3 (different fixes, where appropriate)

          People

            serg Sergei Golubchik
            pivanof Pavel Ivanov
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.