1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bug#39040 valgrind errors/crash when creating views with binlog logging enabled

Browse Source 
A string buffers which were included in the 'view' data structure
were allocated on the stack, causing an invalid pointer when used
after the function returned.
The fix: use copy of values for view->md5 & view->queries


mysql-test/r/view.result:
  test result
mysql-test/t/view.test:
  test case
sql/sql_view.cc:
  A string buffers which were included in the 'view' data structure
  were allocated on the stack, causing an invalid pointer when used
  after the function returned.
  The fix: use copy of values for view->md5 & view->queries
This commit is contained in:
Sergey Glukhov 2008-10-27 14:22:38 +04:00
parent eafe728fc5
commit 380f1a8440
3 changed files with 24 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
mysql-test/r/view.result
View File

@ -3677,6 +3677,8 @@ DROP VIEW v1;
# -- End of test case for Bug#35193. # -- End of test case for Bug#35193.
CREATE VIEW v1 AS SELECT 1;
DROP VIEW v1;
# ----------------------------------------------------------------- # -----------------------------------------------------------------
# -- End of 5.0 tests. # -- End of 5.0 tests.
# ----------------------------------------------------------------- # -----------------------------------------------------------------

9
mysql-test/t/view.test
View File

@ -3560,6 +3560,15 @@ DROP VIEW v1;
########################################################################### ###########################################################################
#
# Bug#39040: valgrind errors/crash when creating views with binlog logging
# enabled
#
# Bug is visible only when running in valgrind with binary logging.
CREATE VIEW v1 AS SELECT 1;
DROP VIEW v1;
--echo # ----------------------------------------------------------------- --echo # -----------------------------------------------------------------
--echo # -- End of 5.0 tests. --echo # -- End of 5.0 tests.
--echo # ----------------------------------------------------------------- --echo # -----------------------------------------------------------------

16
sql/sql_view.cc
View File

@ -774,8 +774,13 @@ static int mysql_register_view(THD *thd, TABLE_LIST *view,
DBUG_PRINT("info", ("View: %s", str.ptr())); DBUG_PRINT("info", ("View: %s", str.ptr()));
/* fill structure */ /* fill structure */
view->query.str= str.c_ptr_safe(); if (!make_lex_string(thd, &view->query, str.ptr(), str.length(), false))
view->query.length= str.length(); {
my_error(ER_OUT_OF_RESOURCES, MYF(0));
error= -1;
goto err;
}
view->source.str= thd->query + thd->lex->create_view_select_start; view->source.str= thd->query + thd->lex->create_view_select_start;
view->source.length= (char *)skip_rear_comments(thd->charset(), view->source.length= (char *)skip_rear_comments(thd->charset(),
(char *)view->source.str, (char *)view->source.str,
@ -784,7 +789,12 @@ static int mysql_register_view(THD *thd, TABLE_LIST *view,
view->source.str; view->source.str;
view->file_version= 1; view->file_version= 1;
view->calc_md5(md5); view->calc_md5(md5);
view->md5.str= md5; if (!(view->md5.str= thd->memdup(md5, 32)))
{
my_error(ER_OUT_OF_RESOURCES, MYF(0));
error= -1;
goto err;
}
view->md5.length= 32; view->md5.length= 32;
can_be_merged= lex->can_be_merged(); can_be_merged= lex->can_be_merged();
if (lex->create_view_algorithm == VIEW_ALGORITHM_MERGE && if (lex->create_view_algorithm == VIEW_ALGORITHM_MERGE &&