[MDEV-4244] [PATCH] Buffer overruns and use-after-free errors Created: 2013-03-05 Updated: 2013-04-08 Resolved: 2013-04-08 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | None |
| Affects Version/s: | 10.0.1, 5.5.30, 5.3.12 |
| Fix Version/s: | 10.0.2, 5.5.31, 5.1.73, 5.3.13 |
| Type: | Bug | Priority: | Major |
| Reporter: | Pavel Ivanov | Assignee: | Sergei Golubchik |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Attachments: |
|
| Description |
|
Please consider the attached patch that fixes several buffer overruns and use-after-free errors detected in MariaDB 10.0.1. |
| Comments |
| Comment by Elena Stepanova [ 2013-03-05 ] |
|
Hi Pavel, Do you have any ready-to-use test cases which trigger failures caused by these errors? |
| Comment by Pavel Ivanov [ 2013-03-05 ] |
|
I found these errors while running regular test suite ("./mtr --force --max-test-fail=0") after compiling full tree with Address Sanitizer (https://code.google.com/p/address-sanitizer/). That's the only way of triggering failures that I have. |
| Comment by Pavel Ivanov [ 2013-03-05 ] |
|
BTW, I understand that assigned patch contains fixes for several different errors unrelated to each other. Feel free to ask questions if you want me to explain the exact problems being fixed. |
| Comment by Sergei Golubchik [ 2013-04-07 ] |
|
I've installed gcc 4.8, compiled with -fsanitize=address and run the test suite. But I did not apply your changes to my_once.c, sql_parse.cc, strfunc.c - the test suite passed, it didn't find any problems related to these files. What did you see in your test runs? Why these changes? |
| Comment by Pavel Ivanov [ 2013-04-07 ] |
|
I didn't know that Address Sanitizer can be used with gcc. I can dig for more exact info about failures tomorrow PST. But from the top of my head: my_once.c: There was a failure during shutdown after one test when my_once_free was called after global variables that are used in DBUG_ENTER were already destroyed. Maybe that's a matter of the order of the calls to initializers from different C files... sql_parse.cc: There was some test where do_handle_bootstrap() was called and then later some code using current_thd, I think it was my_malloc(... MYF(THREADLOCAL)) inside some function. strfunc.cc: This actually was related to the change in ctype-utf8.c. There's a test operating with table name "@". So after the change in ctype-utf8.c my_mb_wc_filename() was able to finish on the first character of the string "@" without asan error, but then without the change strconvert() proceeded to the next character which is already beyond the end of the string. |
| Comment by Sergei Golubchik [ 2013-04-08 ] |
|
fixed all issues, pushed in 5.1 and 5.3 (different fixes, where appropriate) |