1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MDEV-23558: Galera heap-buffer-overflow at wsrep_schema.cc:1067

Browse Source 
Key buffer needs to contain max field widths i.e. add MAX_FIELD_WIDTH.
This commit is contained in:
Jan Lindström 2020-08-24 16:50:53 +03:00
parent a16f4927db
commit 88e70f4cae
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sql/wsrep_schema.cc
View File

@ -935,7 +935,7 @@ int Wsrep_schema::update_fragment_meta(THD* thd,
Wsrep_schema_impl::binlog_off binlog_off(thd); Wsrep_schema_impl::binlog_off binlog_off(thd);
int error; int error;
uchar key[MAX_KEY_LENGTH]; uchar key[MAX_KEY_LENGTH+MAX_FIELD_WIDTH];
key_part_map key_map= 0; key_part_map key_map= 0;
TABLE* frag_table= 0; TABLE* frag_table= 0;
@ -997,7 +997,7 @@ static int remove_fragment(THD* thd,
seqno.get()); seqno.get());
int ret= 0; int ret= 0;
int error; int error;
uchar key[MAX_KEY_LENGTH]; uchar key[MAX_KEY_LENGTH+MAX_FIELD_WIDTH];
key_part_map key_map= 0; key_part_map key_map= 0;
DBUG_ASSERT(server_id.is_undefined() == false); DBUG_ASSERT(server_id.is_undefined() == false);
@ -1120,7 +1120,7 @@ int Wsrep_schema::replay_transaction(THD* orig_thd,
int ret= 1; int ret= 1;
int error; int error;
TABLE* frag_table= 0; TABLE* frag_table= 0;
uchar key[MAX_KEY_LENGTH]; uchar key[MAX_KEY_LENGTH+MAX_FIELD_WIDTH];
key_part_map key_map= 0; key_part_map key_map= 0;
for (std::vector<wsrep::seqno>::const_iterator i= fragments.begin(); for (std::vector<wsrep::seqno>::const_iterator i= fragments.begin();