Fixed crashing when using DBUG_PUSH_EMPTY

montywi · montywi · commit 392e744aec9e · 2022-06-06T14:12:20.000+03:00
DBUG_PUSH_EMPTY is used by thr_mutex.cc.
If there are 4G of DBUG_PUSH_EMPTY calls, then DBUG_POP_EMPTY will
cause a crash when DBUGCloseFile() will try to free an object that
was never allocated.
diff --git a/dbug/dbug.c b/dbug/dbug.c
@@ -1994,11 +1994,10 @@ static void DBUGOpenFile(CODE_STATE *cs,
 static void DBUGCloseFile(CODE_STATE *cs, sFILE *new_value)
 {
   sFILE *fp;
-  if (!cs || !cs->stack || !cs->stack->out_file)
+  if (!cs || !cs->stack || !(fp= cs->stack->out_file))
     return;
 
-  fp= cs->stack->out_file;
-  if (--fp->used == 0)
+  if (fp != sstdout && fp != sstderr && --fp->used == 0)
   {
     if (fclose(fp->file) == EOF)
     {

Original file line number	Diff line number	Diff line change
`@@ -1994,11 +1994,10 @@ static void DBUGOpenFile(CODE_STATE *cs,`
`1994`	`1994`	`static void DBUGCloseFile(CODE_STATE cs, sFILE new_value)`
`1995`	`1995`	`{`
`1996`	`1996`	`sFILE *fp;`
`1997`		`- if (!cs \|\| !cs->stack \|\| !cs->stack->out_file)`
	`1997`	`+ if (!cs \|\| !cs->stack \|\| !(fp= cs->stack->out_file))`
`1998`	`1998`	`return;`
`1999`	`1999`
`2000`		`- fp= cs->stack->out_file;`
`2001`		`- if (--fp->used == 0)`
	`2000`	`+ if (fp != sstdout && fp != sstderr && --fp->used == 0)`
`2002`	`2001`	`{`
`2003`	`2002`	`if (fclose(fp->file) == EOF)`
`2004`	`2003`	`{`