MDEV-15746 ASAN heap-use-after-free in Item_change_list::rollback_item_tree_changes on ALTER executed as PS
don't try to convert a default value string from a user character set into a column character set, if this particular default value string did not came from the user at all (that is, if it's an ALTER TABLE and the default value string is the *old* default value of the unaltered column). This used to crash, because old defaults are allocated on the old table's memroot, which is freed mid-ALTER when the old table is closed. So thd->rollback_item_tree_changes() at the end of the ALTER was writing into the freed memory.
This commit is contained in:
parent
88a0bb83df
commit
92a13148e8
@ -5163,3 +5163,14 @@ END;
|
||||
$$
|
||||
CALL p1('x');
|
||||
DROP PROCEDURE p1;
|
||||
create table t1 (b blob default '');
|
||||
prepare stmt from "alter table t1 force";
|
||||
execute stmt;
|
||||
execute stmt;
|
||||
execute stmt;
|
||||
set names latin1;
|
||||
prepare stmt from "alter table t1 modify b text character set utf8 default 'a'";
|
||||
execute stmt;
|
||||
execute stmt;
|
||||
execute stmt;
|
||||
drop table t1;
|
||||
|
@ -4635,3 +4635,18 @@ DELIMITER ;$$
|
||||
--disable_result_log
|
||||
CALL p1('x');
|
||||
DROP PROCEDURE p1;
|
||||
|
||||
#
|
||||
# MDEV-15746 ASAN heap-use-after-free in Item_change_list::rollback_item_tree_changes on ALTER executed as PS
|
||||
#
|
||||
create table t1 (b blob default '');
|
||||
prepare stmt from "alter table t1 force";
|
||||
execute stmt;
|
||||
execute stmt;
|
||||
execute stmt;
|
||||
set names latin1;
|
||||
prepare stmt from "alter table t1 modify b text character set utf8 default 'a'";
|
||||
execute stmt;
|
||||
execute stmt;
|
||||
execute stmt;
|
||||
drop table t1;
|
||||
|
@ -3378,6 +3378,8 @@ mysql_prepare_create_table(THD *thd, HA_CREATE_INFO *create_info,
|
||||
*/
|
||||
if (sql_field->default_value &&
|
||||
sql_field->default_value->expr->basic_const_item() &&
|
||||
(!sql_field->field ||
|
||||
sql_field->field->default_value != sql_field->default_value) &&
|
||||
save_cs != sql_field->default_value->expr->collation.collation &&
|
||||
(sql_field->sql_type == MYSQL_TYPE_VAR_STRING ||
|
||||
sql_field->sql_type == MYSQL_TYPE_STRING ||
|
||||
|
Loading…
x
Reference in New Issue
Block a user