MDEV-22387: Do not pass null pointer to some memcpy()

Passing a null pointer to a nonnull argument is not only undefined
behaviour, but it also grants the compiler the permission to optimize
away further checks whether the pointer is null. GCC -O2 at least
starting with version 8 may do that, potentially causing SIGSEGV.

These problems were caught in a WITH_UBSAN=ON build with the
Bug#7024 test in main.view.

5 files changed, 17 insertions, 9 deletions

diff --git a/mysys/mf_iocache.c b/mysys/mf_iocache.c
index 1245a622262..11f7bbd81b4 100644
--- a/mysys/mf_iocache.c
+++ b/mysys/mf_iocache.c
@@ -1,6 +1,6 @@
 /*
    Copyright (c) 2000, 2011, Oracle and/or its affiliates
-   Copyright (c) 2010, 2015, MariaDB
+   Copyright (c) 2010, 2020, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -703,7 +703,8 @@ int _my_b_cache_read(IO_CACHE *info, uchar *Buffer, size_t Count)
   info->read_pos=info->buffer+Count;
   info->read_end=info->buffer+length;
   info->pos_in_file=pos_in_file;
-  memcpy(Buffer, info->buffer, Count);
+  if (Count)
+    memcpy(Buffer, info->buffer, Count);
   DBUG_RETURN(0);
 }
 
@@ -1206,7 +1207,8 @@ static int _my_b_cache_read_r(IO_CACHE *cache, uchar *Buffer, size_t Count)
       DBUG_RETURN(1);
     }
     cnt= (len > Count) ? Count : len;
-    memcpy(Buffer, cache->read_pos, cnt);
+    if (cnt)
+      memcpy(Buffer, cache->read_pos, cnt);
     Count -= cnt;
     Buffer+= cnt;
     left_length+= cnt;
diff --git a/mysys/my_alloc.c b/mysys/my_alloc.c
index 3b614cb4c15..5bfcb455b8a 100644
--- a/mysys/my_alloc.c
+++ b/mysys/my_alloc.c
@@ -1,5 +1,6 @@
 /*
    Copyright (c) 2000, 2010, Oracle and/or its affiliates
+   Copyright (c) 2010, 2020, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -449,7 +450,8 @@ char *strmake_root(MEM_ROOT *root, const char *str, size_t len)
   char *pos;
   if ((pos=alloc_root(root,len+1)))
   {
-    memcpy(pos,str,len);
+    if (len)
+      memcpy(pos,str,len);
     pos[len]=0;
   }
   return pos;
diff --git a/sql/debug_sync.cc b/sql/debug_sync.cc
index 591ce5800a8..79f3a241907 100644
--- a/sql/debug_sync.cc
+++ b/sql/debug_sync.cc
@@ -1,4 +1,5 @@
 /* Copyright (c) 2009, 2013, Oracle and/or its affiliates.
+   Copyright (c) 2013, 2020, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -319,7 +320,8 @@ static char *debug_sync_bmove_len(char *to, char *to_end,
   DBUG_ASSERT(to_end);
   DBUG_ASSERT(!length || from);
   set_if_smaller(length, (size_t) (to_end - to));
-  memcpy(to, from, length);
+  if (length)
+    memcpy(to, from, length);
   return (to + length);
 }
 
diff --git a/sql/net_serv.cc b/sql/net_serv.cc
index ea5e4353c83..22eee6297c9 100644
--- a/sql/net_serv.cc
+++ b/sql/net_serv.cc
@@ -1,5 +1,5 @@
 /* Copyright (c) 2000, 2016, Oracle and/or its affiliates.
-   Copyright (c) 2012, 2017, MariaDB Corporation
+   Copyright (c) 2012, 2020, MariaDB Corporation.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -577,7 +577,8 @@ net_write_buff(NET *net, const uchar *packet, ulong len)
       return net_real_write(net, packet, len) ? 1 : 0;
     /* Send out rest of the blocks as full sized blocks */
   }
-  memcpy((char*) net->write_pos,packet,len);
+  if (len)
+    memcpy((char*) net->write_pos,packet,len);
   net->write_pos+= len;
   return 0;
 }
diff --git a/sql/sql_string.h b/sql/sql_string.h
index 6fd3d7a10db..fe756fe1cdf 100644
--- a/sql/sql_string.h
+++ b/sql/sql_string.h
@@ -3,7 +3,7 @@
 
 /*
    Copyright (c) 2000, 2013, Oracle and/or its affiliates.
-   Copyright (c) 2008, 2013, Monty Program Ab.
+   Copyright (c) 2008, 2020, MariaDB Corporation.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -512,7 +512,8 @@ public:
   }
   void q_append(const char *data, uint32 data_len)
   {
-    memcpy(Ptr + str_length, data, data_len);
+    if (data_len)
+      memcpy(Ptr + str_length, data, data_len);
     str_length += data_len;
   }