[MDEV-4244] [PATCH] Buffer overruns and use-after-free errors Created: 2013-03-05  Updated: 2013-04-08  Resolved: 2013-04-08

Status: Closed
Project: MariaDB Server
Component/s: None
Affects Version/s: 10.0.1, 5.5.30, 5.3.12
Fix Version/s: 10.0.2, 5.5.31, 5.1.73, 5.3.13

Type: Bug Priority: Major
Reporter: Pavel Ivanov Assignee: Sergei Golubchik
Resolution: Fixed Votes: 0
Labels: None

Attachments: Text File patch.txt    

 Description   

Please consider the attached patch that fixes several buffer overruns and use-after-free errors detected in MariaDB 10.0.1.



 Comments   
Comment by Elena Stepanova [ 2013-03-05 ]

Hi Pavel,

Do you have any ready-to-use test cases which trigger failures caused by these errors?

Comment by Pavel Ivanov [ 2013-03-05 ]

I found these errors while running regular test suite ("./mtr --force --max-test-fail=0") after compiling full tree with Address Sanitizer (https://code.google.com/p/address-sanitizer/). That's the only way of triggering failures that I have.

Comment by Pavel Ivanov [ 2013-03-05 ]

BTW, I understand that assigned patch contains fixes for several different errors unrelated to each other. Feel free to ask questions if you want me to explain the exact problems being fixed.

Comment by Sergei Golubchik [ 2013-04-07 ]

I've installed gcc 4.8, compiled with -fsanitize=address and run the test suite.
This was I've repeated most of the issues and applied your patches (either directly yours or the changes were different, but the patch helped to understand the problem).

But I did not apply your changes to my_once.c, sql_parse.cc, strfunc.c - the test suite passed, it didn't find any problems related to these files. What did you see in your test runs? Why these changes?

Comment by Pavel Ivanov [ 2013-04-07 ]

I didn't know that Address Sanitizer can be used with gcc.

I can dig for more exact info about failures tomorrow PST. But from the top of my head:

my_once.c: There was a failure during shutdown after one test when my_once_free was called after global variables that are used in DBUG_ENTER were already destroyed. Maybe that's a matter of the order of the calls to initializers from different C files...

sql_parse.cc: There was some test where do_handle_bootstrap() was called and then later some code using current_thd, I think it was my_malloc(... MYF(THREADLOCAL)) inside some function.

strfunc.cc: This actually was related to the change in ctype-utf8.c. There's a test operating with table name "@". So after the change in ctype-utf8.c my_mb_wc_filename() was able to finish on the first character of the string "@" without asan error, but then without the change strconvert() proceeded to the next character which is already beyond the end of the string.

Comment by Sergei Golubchik [ 2013-04-08 ]

fixed all issues, pushed in 5.1 and 5.3 (different fixes, where appropriate)

Generated at Thu Feb 08 06:54:55 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.