[MDEV-4645] Incorrect reads of frozen binlog events; FDE corrupted in relay log Created: 2013-06-12  Updated: 2013-09-25  Resolved: 2013-09-13

Status: Closed
Project: MariaDB Server
Component/s: None
Affects Version/s: 10.0.3, 5.5.31
Fix Version/s: 10.0.5

Type: Bug Priority: Major
Reporter: Jeremy Cole Assignee: Oleksandr Byelkin
Resolution: Fixed Votes: 0
Labels: None
Environment:

All


Attachments: Text File mdev_4645.patch     Text File mdev_4645_2.patch     Text File mdev_4645_3.patch    

 Description   

Currently several places use description_event->common_header_len instead of LOG_EVENT_MINIMAL_HEADER_LEN when parsing events with "frozen" headers (such as Start_event_v3 and its subclasses such as Format_description_log_event, as well as Rotate_event). This causes events with extra headers (which would otherwise be valid and those headers ignored) to be corrupted due to over-reading or skipping into the data portion of the log events.

Patch is forthcoming.



 Comments   
Comment by Jeremy Cole [ 2013-06-18 ]

The attached patch addresses the following:

  • A fairly major restructuring of the way that mysqlbinlog H/-hexdump produces output. The new structure formats better (more closely to hexdump -C) without alignment errors, and with easier to visually parse fields. Additionally it is more extensible, allowing for downstream users (i.e. me) to parse additional header information with simpler patches.
  • Introduces a method in Log_event::has_minimal_header() in order to simplify logic in other places that need to determine whether a log event should have a fixed minimal header or a common header.
  • Ensure mysqlbinlog H/-hexdump handles headers of variable lengths (as above) correctly.
  • Ensure Start_log_event_v3 (and its subclasses) and Rotate_log_event consistently use LOG_EVENT_MINIMAL_HEADER_LEN as the size of their (frozen) header. Multiple instances incorrectly used description_event->common_header_len instead.
  • Fix incorrect usage of common_header_len (via buf[LOG_EVENT_MINIMAL_HEADER_LEN + ST_COMMON_HEADER_LEN_OFFSET]) instead of LOG_EVENT_MINIMAL_HEADER_LEN in get_checksum_alg for FORMAT_DESCRIPTION_EVENT.
Comment by Jeremy Cole [ 2013-06-26 ]

Additionally, see mdev_4645_2.patch which should be applied on top of mdev_4645.patch. This fixes a 1-byte buffer overflow in the event printing code which was caught by our address sanitizer testing. Apologies for the error in the original patch.

Comment by Sergei Golubchik [ 2013-07-01 ]

Jeremy, under what license do we have these patches? If it's new BSD, could you say that explicitly, please?

Comment by Sergei Golubchik [ 2013-07-02 ]

And, why would this issue matter? Under what circumstances is common_header_len not equal to LOG_EVENT_MINIMAL_HEADER_LEN?

Comment by Jeremy Cole [ 2013-07-03 ]

Will get you a definitive answer shortly on license.

Regarding why it matters: For any MySQL/MariaDB deployed in the wild, you're quite right, it doesn't matter, since they are always the same value. So, for those cases this is merely semantics. However, Google has patched MySQL 5.1 to add additional headers, increasing the size of headers (to 31 bytes) for non-frozen binlog events. Correct parsing of the header depends on the size being correct in these instances, and they were found by MariaDB 10 not being able to replicate - at all - from MySQL 5.1.

So, for us it is quite critical, but for everyone else it's just paint touch-ups on the underside of a cabinet.

The formatting changes for mysqlbinlog hexdump output are of course useful to anyone, I'd guess. The original state was a mess.

Comment by Jeremy Cole [ 2013-07-11 ]

serg: The patches attached to this ticket (mdev_4645.patch, mdev_4645_2.patch, mdev_4645_3.patch) are provided under the "New BSD" License by Google Inc.

Comment by Jeremy Cole [ 2013-07-12 ]

Attaching mdev_4645_3.patch which fixes a related issue where the Format_description_log_event event's common_header_len field would be overwritten by the slave's LOG_EVENT_HEADER_LEN value rather than preserving the common_header_len received in the original event.

Comment by Oleksandr Byelkin [ 2013-07-17 ]

Committed for review (with some fixes).

Comment by Oleksandr Byelkin [ 2013-08-12 ]

Variant with test suite committed for review.

Comment by Oleksandr Byelkin [ 2013-09-12 ]

pushed to 10.0-base

Generated at Thu Feb 08 06:58:00 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.