Skip to content

Commit

Permalink
MDEV-30191 Remove the to-be-freed spider condition in an sp call
Browse files Browse the repository at this point in the history
The condition is freed in sp_head::execute, after calling
ha_spider::reset. This commit partially reverts the change in commit
e954d9d, so that the condition is
always freed regardless of the wide_handler->sql_command, which will
prevent access to the freed condition later.

Signed-off-by: Yuchen Pei <yuchen.pei@mariadb.com>
  • Loading branch information
mariadb-YuchenPei committed Jan 18, 2023
1 parent da798c9 commit 8d91e3f
Show file tree
Hide file tree
Showing 4 changed files with 100 additions and 4 deletions.
6 changes: 2 additions & 4 deletions storage/spider/ha_spider.cc
Original file line number Diff line number Diff line change
Expand Up @@ -1365,10 +1365,8 @@ int ha_spider::reset()
#endif
result_list.direct_distinct = FALSE;
store_error_num = 0;
if (
wide_handler &&
wide_handler->sql_command != SQLCOM_END
) {
if (wide_handler)
{
wide_handler->sql_command = SQLCOM_END;
wide_handler->between_flg = FALSE;
wide_handler->idx_bitmap_is_set = FALSE;
Expand Down
44 changes: 44 additions & 0 deletions storage/spider/mysql-test/spider/bugfix/r/mdev_30191.result
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
#
# MDEV-30191 SIGSEGV & heap-use-after-free in spider_db_print_item_type, SIGABRT in __cxa_pure_virtual/spider_db_print_item_type, Got error 128 "Out of memory in engine", 56/112 memory not freed, and Assertion `fixed()' failed in Item_sp_variable::val_str on SP call
#
for master_1
for child2
child2_1
child2_2
child2_3
for child3
connection child2_1;
CREATE DATABASE auto_test_remote;
USE auto_test_remote;
CREATE TABLE tbl_a (c INT);
connection master_1;
CREATE DATABASE auto_test_local;
USE auto_test_local;
CREATE TABLE tbl_a (
c INT
) ENGINE=Spider DEFAULT CHARSET=utf8 COMMENT='table "tbl_a", srv "s_2_1"';
CREATE TABLE tbl_b (c INT);
CREATE PROCEDURE sp() BEGIN
DECLARE v1 DATE;
WHILE EXISTS (SELECT 1 FROM tbl_a WHERE c>v1 AND c<=v1) DO
SELECT 1;
END WHILE;
WHILE EXISTS (SELECT 1
FROM tbl_a
WHERE c<v1 AND EXISTS (SELECT 1
FROM tbl_b
WHERE tbl_a.c=tbl_b.c)) DO
SELECT 1;
END WHILE;
END $$
CALL sp();
connection master_1;
DROP DATABASE IF EXISTS auto_test_local;
connection child2_1;
DROP DATABASE IF EXISTS auto_test_remote;
for master_1
for child2
child2_1
child2_2
child2_3
for child3
3 changes: 3 additions & 0 deletions storage/spider/mysql-test/spider/bugfix/t/mdev_30191.cnf
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
!include include/default_mysqld.cnf
!include ../my_1_1.cnf
!include ../my_2_1.cnf
51 changes: 51 additions & 0 deletions storage/spider/mysql-test/spider/bugfix/t/mdev_30191.test
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
--echo #
--echo # MDEV-30191 SIGSEGV & heap-use-after-free in spider_db_print_item_type, SIGABRT in __cxa_pure_virtual/spider_db_print_item_type, Got error 128 "Out of memory in engine", 56/112 memory not freed, and Assertion `fixed()' failed in Item_sp_variable::val_str on SP call
--echo #

--disable_query_log
--disable_result_log
--source ../../t/test_init.inc
--enable_result_log
--enable_query_log

--connection child2_1
CREATE DATABASE auto_test_remote;
USE auto_test_remote;
CREATE TABLE tbl_a (c INT);

--connection master_1
CREATE DATABASE auto_test_local;
USE auto_test_local;

eval CREATE TABLE tbl_a (
c INT
) $MASTER_1_ENGINE $MASTER_1_CHARSET COMMENT='table "tbl_a", srv "s_2_1"';
CREATE TABLE tbl_b (c INT);

--delimiter $$
CREATE PROCEDURE sp() BEGIN
DECLARE v1 DATE;
WHILE EXISTS (SELECT 1 FROM tbl_a WHERE c>v1 AND c<=v1) DO
SELECT 1;
END WHILE;
WHILE EXISTS (SELECT 1
FROM tbl_a
WHERE c<v1 AND EXISTS (SELECT 1
FROM tbl_b
WHERE tbl_a.c=tbl_b.c)) DO
SELECT 1;
END WHILE;
END $$
--delimiter ;
CALL sp();

--connection master_1
DROP DATABASE IF EXISTS auto_test_local;
--connection child2_1
DROP DATABASE IF EXISTS auto_test_remote;

--disable_query_log
--disable_result_log
--source ../t/test_deinit.inc
--enable_query_log
--enable_result_log

0 comments on commit 8d91e3f

Please sign in to comment.