Skip to content

Commit

Permalink
Fix table map event processing
Browse files Browse the repository at this point in the history
The table name is also null-terminated so the length plus one byte needs
to be skipped.

If the table map event is not used immediately after the event is read,
the column types would point to possibly freed memory. To avoid this,
memory should be allocated for it.
  • Loading branch information
markus456 committed Jan 18, 2019
1 parent 3b3b492 commit cb013c2
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 3 deletions.
2 changes: 1 addition & 1 deletion include/mariadb_rpl.h
Original file line number Diff line number Diff line change
Expand Up @@ -205,7 +205,7 @@ struct st_mariadb_rpl_table_map_event {
MARIADB_STRING database;
MARIADB_STRING table;
unsigned int column_count;
char *column_types;
MARIADB_STRING column_types;
MARIADB_STRING metadata;
char *null_indicator;
};
Expand Down
6 changes: 4 additions & 2 deletions libmariadb/mariadb_rpl.c
Original file line number Diff line number Diff line change
Expand Up @@ -246,8 +246,10 @@ MARIADB_RPL_EVENT * STDCALL mariadb_rpl_fetch(MARIADB_RPL *rpl, MARIADB_RPL_EVEN
goto mem_error;
ev+= len + 1;
rpl_event->event.table_map.column_count= mysql_net_field_length(&ev);
rpl_event->event.table_map.column_types= (char *)ev;
ev+= rpl_event->event.table_map.column_count;
len= rpl_event->event.table_map.column_count;
if (rpl_alloc_string(rpl_event, &rpl_event->event.table_map.column_types, ev, len))
goto mem_error;
ev+= len;
len= mysql_net_field_length(&ev);
if (rpl_alloc_string(rpl_event, &rpl_event->event.table_map.metadata, ev, len))
goto mem_error;
Expand Down

0 comments on commit cb013c2

Please sign in to comment.