Skip to content

Commit 96045fb

Browse files
committed
MDEV-37052: JSON_TABLE stack overflow handling errors
The recursive nature of add_table_function_dependencies resolution meant that the detection of a stack overrun would continue to recursively call itself. Its quite possible that a user SQL could get multiple ER_STACK_OVERRUN_NEED_MORE errors. Additionaly the results of the stack overrrun check result was incorrectly assigned to a table_map result. Its only because of the "if error" check after add_table_function_dependencies is called, that would detected the stack overrun error, prevented a potential corruped tablemap is from being processed. Corrected add_table_function_dependencies to stop and return on the detection of a stack overrun error. The add_extra_deps call also was true on a stack overrun.
1 parent 30185c9 commit 96045fb

File tree

3 files changed

+20
-7
lines changed

3 files changed

+20
-7
lines changed

sql/json_table.cc

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1428,22 +1428,29 @@ static bool add_extra_deps(List<TABLE_LIST> *join_list, table_map deps)
14281428
@param join_list List of tables to process. Initial invocation should
14291429
supply the JOIN's top-level table list.
14301430
@param nest_tables Bitmap of all tables in the join list.
1431+
@param error Pointer to value which is set to true on stack overrun
1432+
error.
14311433
14321434
@return Bitmap of all outside references that tables in join_list have,
1433-
or 0 on out of stack error.
1435+
or 0 on out of stack overrun error (in addition to *error= true).
14341436
*/
14351437

14361438
table_map add_table_function_dependencies(List<TABLE_LIST> *join_list,
1437-
table_map nest_tables)
1439+
table_map nest_tables,
1440+
bool *error)
14381441
{
14391442
TABLE_LIST *table;
14401443
table_map res= 0;
14411444
List_iterator<TABLE_LIST> li(*join_list);
14421445

14431446
DBUG_EXECUTE_IF("json_check_min_stack_requirement",
1444-
if (dbug_json_check_min_stack_requirement()) return 0;);
1447+
if (dbug_json_check_min_stack_requirement())
1448+
{ *error= true; return 0; });
14451449
if ((res=check_stack_overrun(current_thd, STACK_MIN_SIZE , NULL)))
1446-
return res;
1450+
{
1451+
*error= true;
1452+
return 0;
1453+
}
14471454

14481455
// Recursively compute extra dependencies
14491456
while ((table= li++))
@@ -1452,7 +1459,9 @@ table_map add_table_function_dependencies(List<TABLE_LIST> *join_list,
14521459
if ((nested_join= table->nested_join))
14531460
{
14541461
res |= add_table_function_dependencies(&nested_join->join_list,
1455-
nested_join->used_tables);
1462+
nested_join->used_tables, error);
1463+
if (*error)
1464+
return 0;
14561465
}
14571466
else if (table->table_function)
14581467
{
@@ -1465,7 +1474,10 @@ table_map add_table_function_dependencies(List<TABLE_LIST> *join_list,
14651474
if (res)
14661475
{
14671476
if (add_extra_deps(join_list, res))
1477+
{
1478+
*error= true;
14681479
return 0;
1480+
}
14691481
}
14701482

14711483
return res;

sql/json_table.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,7 @@ bool push_table_function_arg_context(LEX *lex, MEM_ROOT *alloc);
284284
TABLE *create_table_for_function(THD *thd, TABLE_LIST *sql_table);
285285

286286
table_map add_table_function_dependencies(List<TABLE_LIST> *join_list,
287-
table_map nest_tables);
287+
table_map nest_tables, bool *error);
288288

289289
#endif /* JSON_TABLE_INCLUDED */
290290

sql/sql_select.cc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2263,6 +2263,7 @@ JOIN::optimize_inner()
22632263
SELECT_LEX *sel= select_lex;
22642264
if (sel->first_cond_optimization)
22652265
{
2266+
bool error= false;
22662267
/*
22672268
The following code will allocate the new items in a permanent
22682269
MEMROOT for prepared statements and stored procedures.
@@ -2280,7 +2281,7 @@ JOIN::optimize_inner()
22802281
/* Convert all outer joins to inner joins if possible */
22812282
conds= simplify_joins(this, join_list, conds, TRUE, FALSE);
22822283

2283-
add_table_function_dependencies(join_list, table_map(-1));
2284+
add_table_function_dependencies(join_list, table_map(-1), &error);
22842285

22852286
if (thd->is_error() ||
22862287
(!select_lex->leaf_tables_saved && select_lex->save_leaf_tables(thd)))

0 commit comments

Comments
 (0)