Skip to content

Commit b449612

Browse files
committed
MDEV-8638: REVOKE ALL PRIVILEGES, GRANT OPTION FROM CURRENT_ROLE breaks replication
Fix the replication failure caused by incorect initialization of THD::invoker_host && THD::invoker_user. Breakdown of the failure is this: Query_log_event::host and Query_log_event::user can have their LEX_STRING's set to length 0, but the actual str member points to garbage. Code afterwards copies Query_log_event::host and user to THD::invoker_host and THD::invoker_user. Calling code for these members expects both members to be initialized. Eg. the str member be a NULL terminated string and length have appropriate size.
1 parent 5fd8087 commit b449612

File tree

3 files changed

+50
-2
lines changed

3 files changed

+50
-2
lines changed
Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
include/master-slave.inc
2+
[connection master]
3+
create role r1;
4+
set role r1;
5+
grant select on db.* to current_role;
6+
revoke all privileges, grant option from current_role;
7+
drop role r1;
8+
include/rpl_end.inc
9+
connection server_2;
10+
connection server_2;
11+
connection server_2;
12+
connection server_2;
13+
connection server_1;
14+
connection server_1;
15+
connection server_1;
16+
connection server_2;
17+
connection server_1;
18+
connection server_2;
19+
connection server_2;
20+
connection server_1;
21+
connection server_1;
Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
--source include/master-slave.inc
2+
--source include/have_binlog_format_mixed.inc
3+
4+
--enable_connect_log
5+
6+
create role r1;
7+
set role r1;
8+
grant select on db.* to current_role;
9+
revoke all privileges, grant option from current_role;
10+
drop role r1;
11+
12+
--source include/rpl_end.inc

sql/log_event.cc

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3631,10 +3631,25 @@ Query_log_event::Query_log_event(const char* buf, uint event_len,
36313631
if (time_zone_len)
36323632
copy_str_and_move(&time_zone_str, &start, time_zone_len);
36333633

3634-
if (user.length > 0)
3634+
if (user.length)
3635+
{
36353636
copy_str_and_move((const char **)&(user.str), &start, user.length);
3636-
if (host.length > 0)
3637+
}
3638+
else
3639+
{
3640+
user.str= (char *) start++;
3641+
user.str[0]= '\0';
3642+
}
3643+
3644+
if (host.length)
3645+
{
36373646
copy_str_and_move((const char **)&(host.str), &start, host.length);
3647+
}
3648+
else
3649+
{
3650+
host.str= (char *) start++;
3651+
host.str[0]= '\0';
3652+
}
36383653

36393654
/**
36403655
if time_zone_len or catalog_len are 0, then time_zone and catalog

0 commit comments

Comments
 (0)