MDEV-18962: ASAN heap-buffer-overflow in Single_line_formatting_helpe…

…r::on_add_str with optimizer trace Fixed a typo
MariaDB · Apr 2, 2019 · eac97ef · eac97ef
1 parent 4d12a64
commit eac97ef
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 4 deletions.
diff --git a/mysql-test/main/opt_trace_index_merge_innodb.result b/mysql-test/main/opt_trace_index_merge_innodb.result
@@ -238,7 +238,16 @@ explain select * from t1 where pk1 != 0  and key1 = 1	{
 }	0	0
 drop table t1;
 set @@optimizer_switch= @tmp_index_merge_ror_cpk;
-set optimizer_trace="enabled=off";
 set global innodb_stats_persistent= @innodb_stats_persistent_save;
 set global innodb_stats_persistent_sample_pages=
 @innodb_stats_persistent_sample_pages_save;
+#
+# MDEV-18962: ASAN heap-buffer-overflow in Single_line_formatting_helper::on_add_str with optimizer trace
+#
+CREATE TABLE t1 (a date not null, b time, key(a), key(b)) ENGINE=InnoDB;
+INSERT INTO t1 VALUES ('1991-09-09','00:00:00'),('2032-08-24','02:22:24');
+SET SESSION optimizer_trace = 'enabled=on';
+SELECT * FROM t1 WHERE b IS NULL AND a = '2000-01-01';
+a	b
+DROP TABLE t1;
+set optimizer_trace="enabled=off";
diff --git a/mysql-test/main/opt_trace_index_merge_innodb.test b/mysql-test/main/opt_trace_index_merge_innodb.test
@@ -36,10 +36,19 @@ explain select * from t1 where pk1 != 0  and key1 = 1;
 select * from information_schema.OPTIMIZER_TRACE;
 drop table t1;
 set @@optimizer_switch= @tmp_index_merge_ror_cpk;
-set optimizer_trace="enabled=off";
-
 
 set global innodb_stats_persistent= @innodb_stats_persistent_save;
 set global innodb_stats_persistent_sample_pages=
              @innodb_stats_persistent_sample_pages_save;
 
+--echo #
+--echo # MDEV-18962: ASAN heap-buffer-overflow in Single_line_formatting_helper::on_add_str with optimizer trace
+--echo #
+
+CREATE TABLE t1 (a date not null, b time, key(a), key(b)) ENGINE=InnoDB;
+INSERT INTO t1 VALUES ('1991-09-09','00:00:00'),('2032-08-24','02:22:24');
+SET SESSION optimizer_trace = 'enabled=on';
+SELECT * FROM t1 WHERE b IS NULL AND a = '2000-01-01';
+DROP TABLE t1;
+
+set optimizer_trace="enabled=off";
diff --git a/sql/my_json_writer.h b/sql/my_json_writer.h
@@ -259,7 +259,7 @@ class Json_value_helper
   void add_str(const char* val, size_t length)
   {
     if (writer)
-      writer->add_str(val);
+      writer->add_str(val, length);
   }
   void add_str(const String &str)
   {