1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

BUG#34790 - 'create server' doesn't handle out of memory scenario

Browse Source 
well enough

CREATE SERVER may cause server crash if there is not enough memory
to execute this operation.

Fixed that create_server() and prepare_server_struct_for_insert()
didn't check return value of functions that allocate memory.

As this is out of memory issue fix, not test case available.


sql/sql_servers.cc:
  Fixed that create_server() and prepare_server_struct_for_insert()
  didn't check return value of functions that allocate memory.
This commit is contained in:
unknown 2008-03-20 11:40:26 +04:00
parent ca629f8618
commit 95023bb9b0
1 changed files with 42 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
sql/sql_servers.cc
View File

@ -55,8 +55,8 @@ static bool get_server_from_table_to_cache(TABLE *table);
static int insert_server(THD *thd, FOREIGN_SERVER *server_options); static int insert_server(THD *thd, FOREIGN_SERVER *server_options);
static int insert_server_record(TABLE *table, FOREIGN_SERVER *server); static int insert_server_record(TABLE *table, FOREIGN_SERVER *server);
static int insert_server_record_into_cache(FOREIGN_SERVER *server); static int insert_server_record_into_cache(FOREIGN_SERVER *server);
static void prepare_server_struct_for_insert(LEX_SERVER_OPTIONS *server_options, static FOREIGN_SERVER *
FOREIGN_SERVER *server); prepare_server_struct_for_insert(LEX_SERVER_OPTIONS *server_options);
/* drop functions */ /* drop functions */
static int delete_server_record(TABLE *table, static int delete_server_record(TABLE *table,
char *server_name, char *server_name,
@ -966,10 +966,14 @@ int create_server(THD *thd, LEX_SERVER_OPTIONS *server_options)
server_options->server_name_length)) server_options->server_name_length))
goto end; goto end;
server= (FOREIGN_SERVER *)alloc_root(&mem,
sizeof(FOREIGN_SERVER));
prepare_server_struct_for_insert(server_options, server); if (!(server= prepare_server_struct_for_insert(server_options)))
{
/* purecov: begin inspected */
error= ER_OUT_OF_RESOURCES;
goto end;
/* purecov: end */
}
error= insert_server(thd, server); error= insert_server(thd, server);
@ -1040,52 +1044,64 @@ end:
SYNOPSIS SYNOPSIS
prepare_server_struct_for_insert() prepare_server_struct_for_insert()
LEX_SERVER_OPTIONS *server_options LEX_SERVER_OPTIONS *server_options
FOREIGN_SERVER *server
NOTES NOTES
As FOREIGN_SERVER members are allocated on mem_root, we do not need to
free them in case of error.
RETURN VALUE RETURN VALUE
none On success filled FOREIGN_SERVER, or NULL in case out of memory.
*/ */
static void static FOREIGN_SERVER *
prepare_server_struct_for_insert(LEX_SERVER_OPTIONS *server_options, prepare_server_struct_for_insert(LEX_SERVER_OPTIONS *server_options)
FOREIGN_SERVER *server)
{ {
char *unset_ptr= (char*)""; char *unset_ptr= (char*)"";
FOREIGN_SERVER *server;
DBUG_ENTER("prepare_server_struct"); DBUG_ENTER("prepare_server_struct");
if (!(server= (FOREIGN_SERVER *)alloc_root(&mem, sizeof(FOREIGN_SERVER))))
DBUG_RETURN(NULL); /* purecov: inspected */
/* these two MUST be set */ /* these two MUST be set */
server->server_name= strdup_root(&mem, server_options->server_name); if (!(server->server_name= strdup_root(&mem, server_options->server_name)))
DBUG_RETURN(NULL); /* purecov: inspected */
server->server_name_length= server_options->server_name_length; server->server_name_length= server_options->server_name_length;
server->host= server_options->host ? if (!(server->host= server_options->host ?
strdup_root(&mem, server_options->host) : unset_ptr; strdup_root(&mem, server_options->host) : unset_ptr))
DBUG_RETURN(NULL); /* purecov: inspected */
server->db= server_options->db ? if (!(server->db= server_options->db ?
strdup_root(&mem, server_options->db) : unset_ptr; strdup_root(&mem, server_options->db) : unset_ptr))
DBUG_RETURN(NULL); /* purecov: inspected */
server->username= server_options->username ? if (!(server->username= server_options->username ?
strdup_root(&mem, server_options->username) : unset_ptr; strdup_root(&mem, server_options->username) : unset_ptr))
DBUG_RETURN(NULL); /* purecov: inspected */
server->password= server_options->password ? if (!(server->password= server_options->password ?
strdup_root(&mem, server_options->password) : unset_ptr; strdup_root(&mem, server_options->password) : unset_ptr))
DBUG_RETURN(NULL); /* purecov: inspected */
/* set to 0 if not specified */ /* set to 0 if not specified */
server->port= server_options->port > -1 ? server->port= server_options->port > -1 ?
server_options->port : 0; server_options->port : 0;
server->socket= server_options->socket ? if (!(server->socket= server_options->socket ?
strdup_root(&mem, server_options->socket) : unset_ptr; strdup_root(&mem, server_options->socket) : unset_ptr))
DBUG_RETURN(NULL); /* purecov: inspected */
server->scheme= server_options->scheme ? if (!(server->scheme= server_options->scheme ?
strdup_root(&mem, server_options->scheme) : unset_ptr; strdup_root(&mem, server_options->scheme) : unset_ptr))
DBUG_RETURN(NULL); /* purecov: inspected */
server->owner= server_options->owner ? if (!(server->owner= server_options->owner ?
strdup_root(&mem, server_options->owner) : unset_ptr; strdup_root(&mem, server_options->owner) : unset_ptr))
DBUG_RETURN(NULL); /* purecov: inspected */
DBUG_VOID_RETURN; DBUG_RETURN(server);
} }
/* /*