From 07a670b8848e00672b2274a30f44e79cdba20376 Mon Sep 17 00:00:00 2001 From: Sergei Golubchik Date: Tue, 2 Aug 2022 11:42:20 +0200 Subject: [PATCH] MDEV-23097 heap-use-after-free in mysqlimport mysqlimport starts many worker threads. when one of the worker encounters an error, it frees global memory and calls exit(). it suppresses memory leak detector, because, as the comment says "dirty exit, some threads are still running", indeed, it cannot free the memory from other threads. but precisely because some threads are still running, they might use this global memory, so it cannot be freed. fix: if we know that some threads are still running and accept that we cannot free all memory anyway, let's not free global allocations either --- client/mysqlimport.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/client/mysqlimport.c b/client/mysqlimport.c index 880d3ff07cf..9d83e65535d 100644 --- a/client/mysqlimport.c +++ b/client/mysqlimport.c @@ -524,16 +524,18 @@ static void safe_exit(int error, MYSQL *mysql) if (mysql) mysql_close(mysql); - mysql_library_end(); -#ifdef HAVE_SMEM - my_free(shared_memory_base_name); -#endif - free_defaults(argv_to_free); - my_free(opt_password); if (error) sf_leaking_memory= 1; /* dirty exit, some threads are still running */ else + { + mysql_library_end(); +#ifdef HAVE_SMEM + my_free(shared_memory_base_name); +#endif + free_defaults(argv_to_free); + my_free(opt_password); my_end(my_end_arg); /* clean exit */ + } exit(error); }