Skip to content

Commit

Permalink
MDEV-26139 Spider crashes with segmentation fault (signal 11) on CREA…
Browse files Browse the repository at this point in the history
…TE TABLE when COMMENT does not contain embedded double quotes

The root cause of the bug MDEV-26139 is the lack of NULL checking
on the variable `dq`.

Comments on if (dq && (!sq || sq > dq)) {...} else {...}:

  * The if block corresponds to the case where parameters are
    quoted by double quotes. In that case, a single quote doesn't
    appear at all or only appears in the middle of double quotes.

  * The else block corresponds to the case where parameters are
    quoted by single quotes. In that case, a double quote doesn't
    appear at all or only appears in the middle of single quotes.

  * If the program reaches the if-else statement, `sq || dq` holds.
    Thus, the negation of `dq && (!sq || sq > dq)` is equivalent to
    `sq && (!dq || sq <= dq)`.
  • Loading branch information
nayuta-yanagisawa committed Jul 14, 2021
1 parent 78735dc commit e3814a7
Show file tree
Hide file tree
Showing 3 changed files with 16 additions and 2 deletions.
6 changes: 6 additions & 0 deletions storage/spider/mysql-test/spider/r/basic_sql.result
Original file line number Diff line number Diff line change
Expand Up @@ -721,6 +721,12 @@ connection master_1;
create table t2345678911234567892123456789312345678941234567895123234234(id int) ENGINE=SPIDER
COMMENT='host "192.168.21.1", user "spider", password "password", database "test32738123123123"';
drop table t2345678911234567892123456789312345678941234567895123234234;
#
# MDEV-26139 Spider crashes with segmentation fault (signal 11) on CREATE TABLE when COMMENT does not contain embedded double quotes
#
create table mdev_26139 (id int) ENGINE=SPIDER
COMMENT="host '192.168.21.1', user 'spider', password 'password', database 'test'";
drop table mdev_26139;

deinit
connection master_1;
Expand Down
7 changes: 7 additions & 0 deletions storage/spider/mysql-test/spider/t/basic_sql.test
Original file line number Diff line number Diff line change
Expand Up @@ -2682,6 +2682,13 @@ create table t2345678911234567892123456789312345678941234567895123234234(id int)
COMMENT='host "192.168.21.1", user "spider", password "password", database "test32738123123123"';
drop table t2345678911234567892123456789312345678941234567895123234234;

--echo #
--echo # MDEV-26139 Spider crashes with segmentation fault (signal 11) on CREATE TABLE when COMMENT does not contain embedded double quotes
--echo #
create table mdev_26139 (id int) ENGINE=SPIDER
COMMENT="host '192.168.21.1', user 'spider', password 'password', database 'test'";
drop table mdev_26139;

--echo
--echo deinit
--disable_warnings
Expand Down
5 changes: 3 additions & 2 deletions storage/spider/spd_table.h
Original file line number Diff line number Diff line change
Expand Up @@ -189,7 +189,8 @@ typedef struct st_spider_param_string_parse
{
DBUG_RETURN(print_param_error());
}
else if (!sq || sq > dq)

if (dq && (!sq || sq > dq))
{
while (1)
{
Expand Down Expand Up @@ -227,7 +228,7 @@ typedef struct st_spider_param_string_parse
}
}
}
else
else /* sq && (!dq || sq <= dq) */
{
while (1)
{
Expand Down

0 comments on commit e3814a7

Please sign in to comment.