Skip to content

Commit eef94c9

Browse files
committed
MDEV-36248 Connect crashes server because of duplicate 'free()' in GetUser
If connect engineis not able to allocate connect_work_space memory for GetUser() it will call free() twice with the same value (g). g was freed first in user_connect::user_init() which calls PlugExit() on errors and then again in ~user_connect() which also calls PlugExit(). Fixed by setting g to 0 in user_init() after calling PlugExit() This code was tested 'by hand' by setting connect.work_space=600G Other things: - Removed some very old not relevant comments in touched code - Added comments to clarify how some memory was freed - Fixed indentation in changed functions.
1 parent 64a1458 commit eef94c9

File tree

2 files changed

+12
-15
lines changed

2 files changed

+12
-15
lines changed

storage/connect/connect.cc

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -92,11 +92,11 @@ void CntEndDB(PGLOBAL g)
9292

9393
free(dbuserp);
9494

95-
if (trace(1))
96-
htrc("CntEndDB: Freeing Dup\n");
95+
if (trace(1))
96+
htrc("CntEndDB: Freeing Dup\n");
9797

98-
g->Activityp->Aptr = NULL;
99-
} // endif dbuserp
98+
g->Activityp->Aptr = NULL; // Free PlgGetUser() data
99+
} // endif dbuserp
100100

101101
} // end of CntEndDB
102102

storage/connect/user_connect.cc

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -101,9 +101,6 @@ bool user_connect::user_init()
101101
PACTIVITY ap= NULL;
102102
PDBUSER dup= NULL;
103103

104-
// Areasize= 64M because of VEC tables. Should be parameterisable
105-
//g= PlugInit(NULL, 67108864);
106-
//g= PlugInit(NULL, 134217728); // 128M was because of old embedded tests
107104
g= PlugInit(NULL, (size_t)worksize);
108105

109106
// Check whether the initialization is complete
@@ -113,12 +110,13 @@ bool user_connect::user_init()
113110
printf("%s\n", g->Message);
114111

115112
(void) PlugExit(g);
113+
g= 0;
116114

117-
if (dup)
118-
free(dup);
115+
if (dup)
116+
free(dup);
119117

120118
return true;
121-
} // endif g->
119+
} // endif g->
122120

123121
dup->Catalog= new MYCAT(NULL);
124122

@@ -128,17 +126,16 @@ bool user_connect::user_init()
128126
g->Activityp= ap;
129127
g->Activityp->Aptr= dup;
130128

131-
pthread_mutex_lock(&usrmut);
129+
pthread_mutex_lock(&usrmut);
132130
next= to_users;
133131
to_users= this;
134132

135133
if (next)
136134
next->previous= this;
137135

138-
count = 1;
139-
pthread_mutex_unlock(&usrmut);
140-
141-
last_query_id= thdp->query_id;
136+
count = 1;
137+
pthread_mutex_unlock(&usrmut);
138+
last_query_id= thdp->query_id;
142139
return false;
143140
} // end of user_init
144141

0 commit comments

Comments
 (0)