Skip to content

Commit 39dc461

Browse files
committed
MDEV-22751 Uninitialized tbl_len in dict_acquire_mdl_shared()
A crash was observed where dict_acquire_mdl_shared<trylock=false> would invoke memcpy() with an apparently uninitialized tbl_len. dict_table_t::parse_name(): Remove an unnecessary tbl_len-- operation. (This should be mostly non-functional cleanup.) dict_acquire_mdl_shared(): If the second dict_table_t::parse_name() returns false, terminate the loop just like we would do on the first invocation.
1 parent 58f3f69 commit 39dc461

File tree

1 file changed

+11
-2
lines changed

1 file changed

+11
-2
lines changed

storage/innobase/dict/dict0dict.cc

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -749,7 +749,6 @@ bool dict_table_t::parse_name(char (&db_name)[NAME_LEN + 1],
749749

750750
size_t tbl_len= strlen(name.m_name + db_len);
751751
memcpy(tbl_buf, name.m_name + db_len + 1, tbl_len);
752-
tbl_len--;
753752
if (!dict_locked)
754753
mutex_exit(&dict_sys.mutex);
755754

@@ -883,7 +882,17 @@ dict_acquire_mdl_shared(dict_table_t *table,
883882

884883
size_t db1_len, tbl1_len;
885884

886-
table->parse_name<!trylock>(db_buf1, tbl_buf1, &db1_len, &tbl1_len);
885+
if (!table->parse_name<!trylock>(db_buf1, tbl_buf1, &db1_len, &tbl1_len))
886+
{
887+
/* The table was renamed to #sql prefix.
888+
Release MDL (if any) for the old name and return. */
889+
if (*mdl)
890+
{
891+
mdl_context->release_lock(*mdl);
892+
*mdl= nullptr;
893+
}
894+
return table;
895+
}
887896

888897
if (*mdl)
889898
{

0 commit comments

Comments
 (0)