1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bug#43201 : Stack overrun when running sp-error test.

Browse Source 
It appears that stack overflow checks for recusrive stored procedure
calls, that run in the normal server, did not work in embedded and were
 dummified with preprocessor magic( #ifndef EMBEDDED_SERVER ).
      
 The fix is to remove ifdefs, there is no reason not to run overflow checks
 and crash in deeply recursive calls. 
      
 Note: Start of the stack (thd->thread_stack variable) in embedded is not
necessarily exact but stil provides the best guess. Unless the caller of 
mysql_read_connect()   is already deep in the stack, thd->thread_stack 
variable should approximate stack  start address well.
This commit is contained in:
Vladislav Vaintroub 2010-02-23 12:48:26 +01:00
parent c88200172e
commit 94bd96e815
5 changed files with 1 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sql/item_cmpfunc.cc
View File

@ -2865,9 +2865,7 @@ bool Item_func_case::fix_fields(THD *thd, Item **ref)
buff should match stack usage from
Item_func_case::val_int() -> Item_func_case::find_item()
*/
#ifndef EMBEDDED_LIBRARY
uchar buff[MAX_FIELD_WIDTH*2+sizeof(String)*2+sizeof(String*)*2+sizeof(double)*2+sizeof(longlong)*2];
#endif
bool res= Item_func::fix_fields(thd, ref);
/*
Call check_stack_overrun after fix_fields to be sure that stack variable
@ -4081,9 +4079,7 @@ Item_cond::fix_fields(THD *thd, Item **ref)
DBUG_ASSERT(fixed == 0);
List_iterator<Item> li(list);
Item *item;
#ifndef EMBEDDED_LIBRARY
uchar buff[sizeof(char*)]; // Max local vars in function
#endif
not_null_tables_cache= used_tables_cache= 0;
const_item_cache= 1;
/*

4
sql/item_func.cc
View File

@ -151,9 +151,7 @@ Item_func::fix_fields(THD *thd, Item **ref)
{
DBUG_ASSERT(fixed == 0);
Item **arg,**arg_end;
#ifndef EMBEDDED_LIBRARY // Avoid compiler warning
uchar buff[STACK_BUFF_ALLOC]; // Max argument in function
#endif
used_tables_cache= not_null_tables_cache= 0;
const_item_cache=1;
@ -2839,9 +2837,7 @@ bool
udf_handler::fix_fields(THD *thd, Item_result_field *func,
uint arg_count, Item **arguments)
{
#ifndef EMBEDDED_LIBRARY // Avoid compiler warning
uchar buff[STACK_BUFF_ALLOC]; // Max argument in function
#endif
DBUG_ENTER("Item_udf_func::fix_fields");
if (check_stack_overrun(thd, STACK_MIN_SIZE, buff))

2
sql/opt_range.cc
View File

@ -2266,9 +2266,7 @@ int SQL_SELECT::test_quick_select(THD *thd, key_map keys_to_use,
keys_to_use.intersect(head->keys_in_use_for_query);
if (!keys_to_use.is_clear_all())
{
#ifndef EMBEDDED_LIBRARY // Avoid compiler warning
uchar buff[STACK_BUFF_ALLOC];
#endif
MEM_ROOT alloc;
SEL_TREE *tree= NULL;
KEY_PART *key_parts;

3
sql/sql_parse.cc
View File

@ -5171,7 +5171,6 @@ bool check_global_access(THD *thd, ulong want_access)
Check stack size; Send error if there isn't enough stack to continue
****************************************************************************/
#ifndef EMBEDDED_LIBRARY
#if STACK_DIRECTION < 0
#define used_stack(A,B) (long) (A - B)
@ -5209,7 +5208,7 @@ bool check_stack_overrun(THD *thd, long margin,
#endif
return 0;
}
#endif /* EMBEDDED_LIBRARY */
#define MY_YACC_INIT 1000 // Start with big alloc
#define MY_YACC_MAX 32000 // Because of 'short'

2
sql/sql_select.cc
View File

@ -2516,9 +2516,7 @@ static ha_rows get_quick_record_count(THD *thd, SQL_SELECT *select,
{
int error;
DBUG_ENTER("get_quick_record_count");
#ifndef EMBEDDED_LIBRARY // Avoid compiler warning
uchar buff[STACK_BUFF_ALLOC];
#endif
if (check_stack_overrun(thd, STACK_MIN_SIZE, buff))
DBUG_RETURN(0); // Fatal error flag is set
if (select)