Skip to content

Commit

Permalink
MDEV-19415: use-after-free on charsets_dir from slave connect
Browse files Browse the repository at this point in the history
The slave IO thread sets MYSQL_SET_CHARSET_DIR. The code for this option
however is not thread-safe in sql-common/client.c. The value set is
temporarily written to mysys global variable `charsets-dir` and can be seen
by other threads running in parallel, which can result in use-after-free
error.

Problem was visible as random failures of test cases in suite multi_source
with Valgrind or MSAN.

Work-around by not setting this option for slave connect, it is redundant
anyway as it is just setting the default value.

Signed-off-by: Kristian Nielsen <knielsen@knielsen-hq.org>
  • Loading branch information
knielsen committed Apr 20, 2024
1 parent 0c249ad commit 57f6a1c
Showing 1 changed file with 0 additions and 5 deletions.
5 changes: 0 additions & 5 deletions sql/slave.cc
Original file line number Diff line number Diff line change
Expand Up @@ -7412,9 +7412,6 @@ static int connect_to_master(THD* thd, MYSQL* mysql, Master_info* mi,
default_client_charset_info->csname);
}

/* This one is not strictly needed but we have it here for completeness */
mysql_options(mysql, MYSQL_SET_CHARSET_DIR, (char *) charsets_dir);

/* Set MYSQL_PLUGIN_DIR in case master asks for an external authentication plugin */
if (opt_plugin_dir_ptr && *opt_plugin_dir_ptr)
mysql_options(mysql, MYSQL_PLUGIN_DIR, opt_plugin_dir_ptr);
Expand Down Expand Up @@ -7557,8 +7554,6 @@ MYSQL *rpl_connect_master(MYSQL *mysql)
#endif

mysql_options(mysql, MYSQL_SET_CHARSET_NAME, default_charset_info->csname);
/* This one is not strictly needed but we have it here for completeness */
mysql_options(mysql, MYSQL_SET_CHARSET_DIR, (char *) charsets_dir);

if (mi->user == NULL
|| mi->user[0] == 0
Expand Down

0 comments on commit 57f6a1c

Please sign in to comment.