MDEV-24807:A possibility for double free in dtor of Event_queue_eleme…

…nt_for_exec in the case of OOM Eliminate a memory leak when init can fail by forgetting to delete the Event_queue_element_for_exec object.
MariaDB · Apr 20, 2021 · 6244876 · 6244876
1 parent 922e676
commit 6244876
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 1 deletion.
diff --git a/sql/event_data_objects.cc b/sql/event_data_objects.cc
@@ -178,6 +178,7 @@ Event_queue_element_for_exec::init(LEX_STRING db, LEX_STRING n)
   if (!(name.str= my_strndup(n.str, name.length= n.length, MYF(MY_WME))))
   {
     my_free(dbname.str);
+    dbname.str= NULL;
     return TRUE;
   }
   return FALSE;

diff --git a/sql/event_data_objects.h b/sql/event_data_objects.h
@@ -33,7 +33,7 @@ struct TABLE;
 class Event_queue_element_for_exec
 {
 public:
-  Event_queue_element_for_exec(){};
+  Event_queue_element_for_exec() : dbname{NULL, 0}, name{NULL, 0} {};
   ~Event_queue_element_for_exec();
 
   bool

diff --git a/sql/event_queue.cc b/sql/event_queue.cc
@@ -635,6 +635,7 @@ Event_queue::get_top_for_execution_if_time(THD *thd,
     if (!(*event_name= new Event_queue_element_for_exec()) ||
         (*event_name)->init(top->dbname, top->name))
     {
+      delete *event_name;
       ret= TRUE;
       break;
     }