Skip to content

Commit 09ea2dc

Browse files
committed
MDEV-33209 Stack overflow in main.json_debug_nonembedded due to incorrect debug injection
In the JSON functions, the debug injection for stack overflows is inaccurate and may cause actual stack overflows. Let us simply inject stack overflow errors without actually relying on the ability of check_stack_overrun() to do so. Reviewed by: Rucha Deodhar
1 parent 015f69a commit 09ea2dc

File tree

1 file changed

+13
-35
lines changed

1 file changed

+13
-35
lines changed

sql/item_jsonfunc.cc

Lines changed: 13 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -20,20 +20,14 @@
2020
#include "item.h"
2121
#include "sql_parse.h" // For check_stack_overrun
2222

23-
/*
24-
Allocating memory and *also* using it (reading and
25-
writing from it) because some build instructions cause
26-
compiler to optimize out stack_used_up. Since alloca()
27-
here depends on stack_used_up, it doesnt get executed
28-
correctly and causes json_debug_nonembedded to fail
29-
( --error ER_STACK_OVERRUN_NEED_MORE does not occur).
30-
*/
31-
#define ALLOCATE_MEM_ON_STACK(A) do \
32-
{ \
33-
uchar *array= (uchar*)alloca(A); \
34-
bzero(array, A); \
35-
my_checksum(0, array, A); \
36-
} while(0)
23+
#ifndef DBUG_OFF
24+
static int dbug_json_check_min_stack_requirement()
25+
{
26+
my_error(ER_STACK_OVERRUN_NEED_MORE, MYF(ME_FATAL),
27+
my_thread_stack_size, my_thread_stack_size, STACK_MIN_SIZE);
28+
return 1;
29+
}
30+
#endif
3731

3832
/*
3933
Compare ASCII string against the string with the specified
@@ -151,11 +145,8 @@ int json_path_parts_compare(
151145
int res, res2;
152146

153147
DBUG_EXECUTE_IF("json_check_min_stack_requirement",
154-
{
155-
long arbitrary_var;
156-
long stack_used_up= (available_stack_size(current_thd->thread_stack, &arbitrary_var));
157-
ALLOCATE_MEM_ON_STACK(my_thread_stack_size-stack_used_up-STACK_MIN_SIZE);
158-
});
148+
return dbug_json_check_min_stack_requirement(););
149+
159150
if (check_stack_overrun(current_thd, STACK_MIN_SIZE , NULL))
160151
return 1;
161152

@@ -1210,11 +1201,7 @@ static int check_contains(json_engine_t *js, json_engine_t *value)
12101201
json_engine_t loc_js;
12111202
bool set_js;
12121203
DBUG_EXECUTE_IF("json_check_min_stack_requirement",
1213-
{
1214-
long arbitrary_var;
1215-
long stack_used_up= (available_stack_size(current_thd->thread_stack, &arbitrary_var));
1216-
ALLOCATE_MEM_ON_STACK(my_thread_stack_size-stack_used_up-STACK_MIN_SIZE);
1217-
});
1204+
return dbug_json_check_min_stack_requirement(););
12181205
if (check_stack_overrun(current_thd, STACK_MIN_SIZE , NULL))
12191206
return 1;
12201207

@@ -2128,13 +2115,8 @@ String *Item_func_json_object::val_str(String *str)
21282115

21292116
static int do_merge(String *str, json_engine_t *je1, json_engine_t *je2)
21302117
{
2131-
21322118
DBUG_EXECUTE_IF("json_check_min_stack_requirement",
2133-
{
2134-
long arbitrary_var;
2135-
long stack_used_up= (available_stack_size(current_thd->thread_stack, &arbitrary_var));
2136-
ALLOCATE_MEM_ON_STACK(my_thread_stack_size-stack_used_up-STACK_MIN_SIZE);
2137-
});
2119+
return dbug_json_check_min_stack_requirement(););
21382120
if (check_stack_overrun(current_thd, STACK_MIN_SIZE , NULL))
21392121
return 1;
21402122

@@ -2471,11 +2453,7 @@ static int do_merge_patch(String *str, json_engine_t *je1, json_engine_t *je2,
24712453
bool *empty_result)
24722454
{
24732455
DBUG_EXECUTE_IF("json_check_min_stack_requirement",
2474-
{
2475-
long arbitrary_var;
2476-
long stack_used_up= (available_stack_size(current_thd->thread_stack, &arbitrary_var));
2477-
ALLOCATE_MEM_ON_STACK(my_thread_stack_size-stack_used_up-STACK_MIN_SIZE);
2478-
});
2456+
return dbug_json_check_min_stack_requirement(););
24792457
if (check_stack_overrun(current_thd, STACK_MIN_SIZE , NULL))
24802458
return 1;
24812459

0 commit comments

Comments
 (0)