From 40d596c200bd03b5fb01ba5b9af5912d65cc586d Mon Sep 17 00:00:00 2001 From: unknown Date: Sat, 28 Jul 2007 15:01:29 +0400 Subject: Bug#29856: Insufficient buffer space led to a server crash. The subst_spvars function is used to create query string with SP variables substituted with their values. This string is used later for the binary log and for the query cache. The problem is that the query_cache_send_result_to_client function requires some additional space after the query to store database name and query cache flags. This space wasn't reserved by the subst_spvars function which led to a memory corruption and crash. Now the subst_spvars function reserves additional space for the query cache. mysql-test/t/query_cache.test: Added a test case for the bug#29856: Insufficient buffer space led to a server crash. mysql-test/r/query_cache.result: Added a test case for the bug#29856: Insufficient buffer space led to a server crash. sql/sp_head.cc: Bug#29856: Insufficient buffer space led to a server crash. Now the subst_spvars function reserves additional space for the query cache. --- sql/sp_head.cc | 144 +++++++++++++++++++++++++++++++-------------------------- 1 file changed, 78 insertions(+), 66 deletions(-) (limited to 'sql/sp_head.cc') diff --git a/sql/sp_head.cc b/sql/sp_head.cc index d939fd20b9b..94d3a967b8c 100644 --- a/sql/sp_head.cc +++ b/sql/sp_head.cc @@ -767,7 +767,8 @@ int cmp_splocal_locations(Item_splocal * const *a, Item_splocal * const *b) /* - Replace thd->query{_length} with a string that one can write to the binlog. + Replace thd->query{_length} with a string that one can write to the binlog + or the query cache. SYNOPSIS subst_spvars() @@ -779,7 +780,9 @@ int cmp_splocal_locations(Item_splocal * const *a, Item_splocal * const *b) DESCRIPTION The binlog-suitable string is produced by replacing references to SP local - variables with NAME_CONST('sp_var_name', value) calls. + variables with NAME_CONST('sp_var_name', value) calls. To make this string + suitable for the query cache this function allocates some additional space + for the query cache flags. RETURN FALSE on success @@ -792,80 +795,89 @@ static bool subst_spvars(THD *thd, sp_instr *instr, LEX_STRING *query_str) { DBUG_ENTER("subst_spvars"); - if (thd->prelocked_mode == NON_PRELOCKED && mysql_bin_log.is_open()) - { - Dynamic_array sp_vars_uses; - char *pbuf, *cur, buffer[512]; - String qbuf(buffer, sizeof(buffer), &my_charset_bin); - int prev_pos, res; - /* Find all instances of Item_splocal used in this statement */ - for (Item *item= instr->free_list; item; item= item->next) - { - if (item->is_splocal()) - { - Item_splocal *item_spl= (Item_splocal*)item; - if (item_spl->pos_in_query) - sp_vars_uses.append(item_spl); - } - } - if (!sp_vars_uses.elements()) - DBUG_RETURN(FALSE); - - /* Sort SP var refs by their occurences in the query */ - sp_vars_uses.sort(cmp_splocal_locations); + Dynamic_array sp_vars_uses; + char *pbuf, *cur, buffer[512]; + String qbuf(buffer, sizeof(buffer), &my_charset_bin); + int prev_pos, res, buf_len; - /* - Construct a statement string where SP local var refs are replaced - with "NAME_CONST(name, value)" - */ - qbuf.length(0); - cur= query_str->str; - prev_pos= res= 0; - for (Item_splocal **splocal= sp_vars_uses.front(); - splocal < sp_vars_uses.back(); splocal++) + /* Find all instances of Item_splocal used in this statement */ + for (Item *item= instr->free_list; item; item= item->next) + { + if (item->is_splocal()) { - Item *val; + Item_splocal *item_spl= (Item_splocal*)item; + if (item_spl->pos_in_query) + sp_vars_uses.append(item_spl); + } + } + if (!sp_vars_uses.elements()) + DBUG_RETURN(FALSE); + + /* Sort SP var refs by their occurences in the query */ + sp_vars_uses.sort(cmp_splocal_locations); - char str_buffer[STRING_BUFFER_USUAL_SIZE]; - String str_value_holder(str_buffer, sizeof(str_buffer), - &my_charset_latin1); - String *str_value; - - /* append the text between sp ref occurences */ - res|= qbuf.append(cur + prev_pos, (*splocal)->pos_in_query - prev_pos); - prev_pos= (*splocal)->pos_in_query + (*splocal)->m_name.length; - - /* append the spvar substitute */ - res|= qbuf.append(STRING_WITH_LEN(" NAME_CONST('")); - res|= qbuf.append((*splocal)->m_name.str, (*splocal)->m_name.length); - res|= qbuf.append(STRING_WITH_LEN("',")); - res|= (*splocal)->fix_fields(thd, (Item **) splocal); + /* + Construct a statement string where SP local var refs are replaced + with "NAME_CONST(name, value)" + */ + qbuf.length(0); + cur= query_str->str; + prev_pos= res= 0; + for (Item_splocal **splocal= sp_vars_uses.front(); + splocal < sp_vars_uses.back(); splocal++) + { + Item *val; - if (res) - break; + char str_buffer[STRING_BUFFER_USUAL_SIZE]; + String str_value_holder(str_buffer, sizeof(str_buffer), + &my_charset_latin1); + String *str_value; + + /* append the text between sp ref occurences */ + res|= qbuf.append(cur + prev_pos, (*splocal)->pos_in_query - prev_pos); + prev_pos= (*splocal)->pos_in_query + (*splocal)->m_name.length; + + /* append the spvar substitute */ + res|= qbuf.append(STRING_WITH_LEN(" NAME_CONST('")); + res|= qbuf.append((*splocal)->m_name.str, (*splocal)->m_name.length); + res|= qbuf.append(STRING_WITH_LEN("',")); + res|= (*splocal)->fix_fields(thd, (Item **) splocal); - val= (*splocal)->this_item(); - DBUG_PRINT("info", ("print %p", val)); - str_value= sp_get_item_value(thd, val, &str_value_holder); - if (str_value) - res|= qbuf.append(*str_value); - else - res|= qbuf.append(STRING_WITH_LEN("NULL")); - res|= qbuf.append(')'); - if (res) - break; - } - res|= qbuf.append(cur + prev_pos, query_str->length - prev_pos); if (res) - DBUG_RETURN(TRUE); + break; - if (!(pbuf= thd->strmake(qbuf.ptr(), qbuf.length()))) - DBUG_RETURN(TRUE); + val= (*splocal)->this_item(); + DBUG_PRINT("info", ("print %p", val)); + str_value= sp_get_item_value(thd, val, &str_value_holder); + if (str_value) + res|= qbuf.append(*str_value); + else + res|= qbuf.append(STRING_WITH_LEN("NULL")); + res|= qbuf.append(')'); + if (res) + break; + } + res|= qbuf.append(cur + prev_pos, query_str->length - prev_pos); + if (res) + DBUG_RETURN(TRUE); - thd->query= pbuf; - thd->query_length= qbuf.length(); + /* + Allocate additional space at the end of the new query string for the + query_cache_send_result_to_client function. + */ + buf_len= qbuf.length() + thd->db_length + 1 + QUERY_CACHE_FLAGS_SIZE + 1; + if ((pbuf= alloc_root(thd->mem_root, buf_len))) + { + memcpy(pbuf, qbuf.ptr(), qbuf.length()); + pbuf[qbuf.length()]= 0; } + else + DBUG_RETURN(TRUE); + + thd->query= pbuf; + thd->query_length= qbuf.length(); + DBUG_RETURN(FALSE); } -- cgit v1.2.1