diff options
| author | Marko Mäkelä <marko.makela@mariadb.com> | 2021-07-23 17:20:57 +0300 |
|---|---|---|
| committer | Marko Mäkelä <marko.makela@mariadb.com> | 2021-07-23 17:20:57 +0300 |
| commit | 173e562dc2bd339de32d17de73b720e7ca863ff2 (patch) | |
| tree | e295abdd444203d6a4c93c4449df0ce315441a31 /storage/innobase | |
| parent | 4c4237e63fb9d766a99fb1d45049d6955fd7f8f2 (diff) | |
| download | mariadb-git-173e562dc2bd339de32d17de73b720e7ca863ff2.tar.gz | |
MDEV-26228 ASAN heap-use-after-free with ON UPDATE CASCADE
In commit 83d2e0841ee30727c609f23957cc592399a3aca4 (MDEV-24041)
we failed to notice that in addition to the bug with
DELETE and ON DELETE CASCADE, there is another bug with
UPDATE and ON UPDATE CASCADE.
row_ins_foreign_fill_virtual(): Use the correct memory heap
for everything that will be reachable from the cascade->update
that we return to the caller.
Note: It is correct to use the shorter-lived cascade->heap for
rec_get_offsets(), because that memory will be abandoned when
row_ins_foreign_fill_virtual() returns.
Diffstat (limited to 'storage/innobase')
| -rw-r--r-- | storage/innobase/row/row0ins.cc | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/storage/innobase/row/row0ins.cc b/storage/innobase/row/row0ins.cc index 4dc9c66a536..929d3683ce6 100644 --- a/storage/innobase/row/row0ins.cc +++ b/storage/innobase/row/row0ins.cc @@ -1,7 +1,7 @@ /***************************************************************************** Copyright (c) 1996, 2016, Oracle and/or its affiliates. All Rights Reserved. -Copyright (c) 2016, 2020, MariaDB Corporation. +Copyright (c) 2016, 2021, MariaDB Corporation. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software @@ -969,8 +969,8 @@ row_ins_foreign_fill_virtual( upd_field = update->fields + n_diff; upd_field->old_v_val = static_cast<dfield_t*>( - mem_heap_alloc(cascade->heap, - sizeof *upd_field->old_v_val)); + mem_heap_alloc(update->heap, + sizeof *upd_field->old_v_val)); dfield_copy(upd_field->old_v_val, vfield); |