Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-6878

Use of uninitialized saved_primary_key in Mrr_ordered_index_reader::resume_read()

    Details

      Description

      I believe that Mrr_ordered_index_reader::resume_read() is using saved_primary_key uninitialized if the current read hasn't been interrupted. This manifests itself in our case with the following case:

      SET SESSION
        optimizer_switch="mrr=on,mrr_sort_keys=on",
        join_cache_level=8; 
       
      SELECT DISTINCT a.x FROM a LEFT JOIN b ON (a.x = b.x) WHERE ...

      Our query produces an EXPLAIN containing:

      "Using join buffer (flat, BKAH join); Key-ordered Rowid-ordered scan"

      With the result of the query we get many warnings like:

      "Warning 1366 Incorrect string value: '\xE6S\x01\x00\x00\x00...' for column 'y' at row 93"

      This is because the buffer being purported to be column 'y' is uninitialized or random data, and doesn't pass as valid UTF-8.

      Unfortunately I don't have a minimal test case for this yet, but I am able to reproduce it with sensitive data locally and can prove that the below patch fixes the symptom.

      Patch follows:

      --- sql/multi_range_read.cc        2014-07-10 23:01:30.000000000 -0700
      +++ sql/multi_range_read.cc        2014-10-15 19:34:56.000000000 -0700
      @@ -467,6 +467,9 @@ void Mrr_ordered_index_reader::position(
       
       void Mrr_ordered_index_reader::resume_read()
       {
      +  if (have_saved_rowid == FALSE)
      +    return;
      +
         TABLE *table= file->get_table();
         KEY *used_index= &table->key_info[file->active_index];
         key_restore(table->record[0], saved_key_tuple, 
      @@ -477,6 +480,8 @@ void Mrr_ordered_index_reader::resume_re
                       &table->key_info[table->s->primary_key],
                       table->key_info[table->s->primary_key].key_length);
         }
      +
      +  have_saved_rowid= FALSE;
       }

        Attachments

          Activity

            People

            • Assignee:
              psergey Sergei Petrunia
              Reporter:
              jeremycole Jeremy Cole
            • Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: