From cd156e2c3e8576ee42ff470235d3af005daee274 Mon Sep 17 00:00:00 2001 From: Sergei Golubchik Date: Mon, 4 Nov 2019 18:30:48 +0100 Subject: MDEV-20971 ASAN heap-use-after-free in list_delete / heap_close Don't save/restore HP_INFO as it could be changed by a concurrent thread. different parts of HP_INFO are protected by different mutexes and the mutex that protect most of the HP_INFO does not protect its open_list data. As a bonus, make heap_check_heap() to take const HP_INFO* and not make any changes there whatsoever. --- include/heap.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/heap.h b/include/heap.h index 63d961b577a..014ec042671 100644 --- a/include/heap.h +++ b/include/heap.h @@ -245,7 +245,7 @@ int hp_panic(enum ha_panic_function flag); int heap_rkey(HP_INFO *info, uchar *record, int inx, const uchar *key, key_part_map keypart_map, enum ha_rkey_function find_flag); extern uchar * heap_find(HP_INFO *info,int inx,const uchar *key); -extern int heap_check_heap(HP_INFO *info, my_bool print_status); +extern int heap_check_heap(const HP_INFO *info, my_bool print_status); extern uchar *heap_position(HP_INFO *info); /* The following is for programs that uses the old HEAP interface where -- cgit v1.2.1