[MDEV-20097] potential use-after-free Created: 2019-07-18 Updated: 2019-07-19 Resolved: 2019-07-19 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Data Definition - Alter Table, Storage Engine - InnoDB |
| Affects Version/s: | 10.1, 10.2, 10.3, 10.4 |
| Fix Version/s: | 10.2.26, 10.1.41, 10.3.17, 10.4.7 |
| Type: | Bug | Priority: | Major |
| Reporter: | Eugene Kosov (Inactive) | Assignee: | Eugene Kosov (Inactive) |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Issue Links: |
|
||||||||
| Description |
|
But was revealed while I was working on https://jira.mariadb.org/browse/MDEV-19471 buf is an alias for a merge_buf[i] and thus both must have the same value. Here is where it's violated: |