diff options
| author | Jan Lindström <jan.lindstrom@mariadb.com> | 2020-08-24 16:50:53 +0300 |
|---|---|---|
| committer | Jan Lindström <jan.lindstrom@mariadb.com> | 2020-08-25 06:53:52 +0300 |
| commit | 88e70f4caea34e0d7677b1fa646151b8b87dd3ab (patch) | |
| tree | 38c4c7f4d325083cda07172bfd4f092fec0c404d /sql/wsrep_schema.cc | |
| parent | a16f4927dbde19c546b1ba3726529914f8c91730 (diff) | |
| download | mariadb-git-88e70f4caea34e0d7677b1fa646151b8b87dd3ab.tar.gz | |
MDEV-23558: Galera heap-buffer-overflow at wsrep_schema.cc:1067
Key buffer needs to contain max field widths i.e. add MAX_FIELD_WIDTH.
Diffstat (limited to 'sql/wsrep_schema.cc')
| -rw-r--r-- | sql/wsrep_schema.cc | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sql/wsrep_schema.cc b/sql/wsrep_schema.cc index 619a535f916..df9c7b78c9b 100644 --- a/sql/wsrep_schema.cc +++ b/sql/wsrep_schema.cc @@ -935,7 +935,7 @@ int Wsrep_schema::update_fragment_meta(THD* thd, Wsrep_schema_impl::binlog_off binlog_off(thd); int error; - uchar key[MAX_KEY_LENGTH]; + uchar key[MAX_KEY_LENGTH+MAX_FIELD_WIDTH]; key_part_map key_map= 0; TABLE* frag_table= 0; @@ -997,7 +997,7 @@ static int remove_fragment(THD* thd, seqno.get()); int ret= 0; int error; - uchar key[MAX_KEY_LENGTH]; + uchar key[MAX_KEY_LENGTH+MAX_FIELD_WIDTH]; key_part_map key_map= 0; DBUG_ASSERT(server_id.is_undefined() == false); @@ -1120,7 +1120,7 @@ int Wsrep_schema::replay_transaction(THD* orig_thd, int ret= 1; int error; TABLE* frag_table= 0; - uchar key[MAX_KEY_LENGTH]; + uchar key[MAX_KEY_LENGTH+MAX_FIELD_WIDTH]; key_part_map key_map= 0; for (std::vector<wsrep::seqno>::const_iterator i= fragments.begin(); |