Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-4244

[PATCH] Buffer overruns and use-after-free errors

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 10.0.1, 5.5.30, 5.3.12
    • Fix Version/s: 10.0.2, 5.5.31, 5.3.13, 5.1.73
    • Component/s: None
    • Labels:
      None

      Description

      Please consider the attached patch that fixes several buffer overruns and use-after-free errors detected in MariaDB 10.0.1.

        Gliffy Diagrams

          Attachments

            Activity

            Hide
            elenst Elena Stepanova added a comment -

            Hi Pavel,

            Do you have any ready-to-use test cases which trigger failures caused by these errors?

            Show
            elenst Elena Stepanova added a comment - Hi Pavel, Do you have any ready-to-use test cases which trigger failures caused by these errors?
            Hide
            pivanof Pavel Ivanov added a comment -

            I found these errors while running regular test suite ("./mtr --force --max-test-fail=0") after compiling full tree with Address Sanitizer (https://code.google.com/p/address-sanitizer/). That's the only way of triggering failures that I have.

            Show
            pivanof Pavel Ivanov added a comment - I found these errors while running regular test suite ("./mtr --force --max-test-fail=0") after compiling full tree with Address Sanitizer ( https://code.google.com/p/address-sanitizer/ ). That's the only way of triggering failures that I have.
            Hide
            pivanof Pavel Ivanov added a comment -

            BTW, I understand that assigned patch contains fixes for several different errors unrelated to each other. Feel free to ask questions if you want me to explain the exact problems being fixed.

            Show
            pivanof Pavel Ivanov added a comment - BTW, I understand that assigned patch contains fixes for several different errors unrelated to each other. Feel free to ask questions if you want me to explain the exact problems being fixed.
            Hide
            serg Sergei Golubchik added a comment -

            I've installed gcc 4.8, compiled with -fsanitize=address and run the test suite.
            This was I've repeated most of the issues and applied your patches (either directly yours or the changes were different, but the patch helped to understand the problem).

            But I did not apply your changes to my_once.c, sql_parse.cc, strfunc.c - the test suite passed, it didn't find any problems related to these files. What did you see in your test runs? Why these changes?

            Show
            serg Sergei Golubchik added a comment - I've installed gcc 4.8, compiled with -fsanitize=address and run the test suite. This was I've repeated most of the issues and applied your patches (either directly yours or the changes were different, but the patch helped to understand the problem). But I did not apply your changes to my_once.c, sql_parse.cc, strfunc.c - the test suite passed, it didn't find any problems related to these files. What did you see in your test runs? Why these changes?
            Hide
            pivanof Pavel Ivanov added a comment -

            I didn't know that Address Sanitizer can be used with gcc.

            I can dig for more exact info about failures tomorrow PST. But from the top of my head:

            my_once.c: There was a failure during shutdown after one test when my_once_free was called after global variables that are used in DBUG_ENTER were already destroyed. Maybe that's a matter of the order of the calls to initializers from different C files...

            sql_parse.cc: There was some test where do_handle_bootstrap() was called and then later some code using current_thd, I think it was my_malloc(... MYF(THREADLOCAL)) inside some function.

            strfunc.cc: This actually was related to the change in ctype-utf8.c. There's a test operating with table name "@". So after the change in ctype-utf8.c my_mb_wc_filename() was able to finish on the first character of the string "@" without asan error, but then without the change strconvert() proceeded to the next character which is already beyond the end of the string.

            Show
            pivanof Pavel Ivanov added a comment - I didn't know that Address Sanitizer can be used with gcc. I can dig for more exact info about failures tomorrow PST. But from the top of my head: my_once.c: There was a failure during shutdown after one test when my_once_free was called after global variables that are used in DBUG_ENTER were already destroyed. Maybe that's a matter of the order of the calls to initializers from different C files... sql_parse.cc: There was some test where do_handle_bootstrap() was called and then later some code using current_thd, I think it was my_malloc(... MYF(THREADLOCAL)) inside some function. strfunc.cc: This actually was related to the change in ctype-utf8.c. There's a test operating with table name "@". So after the change in ctype-utf8.c my_mb_wc_filename() was able to finish on the first character of the string "@" without asan error, but then without the change strconvert() proceeded to the next character which is already beyond the end of the string.
            Hide
            serg Sergei Golubchik added a comment -

            fixed all issues, pushed in 5.1 and 5.3 (different fixes, where appropriate)

            Show
            serg Sergei Golubchik added a comment - fixed all issues, pushed in 5.1 and 5.3 (different fixes, where appropriate)

              People

              • Assignee:
                serg Sergei Golubchik
                Reporter:
                pivanof Pavel Ivanov
              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 1 day, 5 hours, 30 minutes
                  1d 5h 30m