From adeb736f9aa5322e58612cdf1d57826067d3bdb4 Mon Sep 17 00:00:00 2001 From: Thirunarayanan Balathandayuthapani Date: Thu, 23 Jul 2020 16:34:38 +0530 Subject: MDEV-22903 heap-use-after-free while accessing fts cache deleted doc ids Problem: ======= fts_cache_append_deleted_doc_ids() holds the deleted_lock and tries to access size of deleted_doc_ids. In the meantime, fts_cache_clear() clears the sync_heap before clearing deleted_doc_ids. It leads to invalid access of deleted_doc_ids. Fix: === fts_cache_clear() should free the sync_heap after clearing deleted_doc_ids. --- storage/innobase/fts/fts0fts.cc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'storage/innobase/fts') diff --git a/storage/innobase/fts/fts0fts.cc b/storage/innobase/fts/fts0fts.cc index 54cf2f11884..2a1341c4cf0 100644 --- a/storage/innobase/fts/fts0fts.cc +++ b/storage/innobase/fts/fts0fts.cc @@ -1127,14 +1127,14 @@ fts_cache_clear( index_cache->doc_stats = NULL; } - mem_heap_free(static_cast(cache->sync_heap->arg)); - cache->sync_heap->arg = NULL; - cache->total_size = 0; mutex_enter((ib_mutex_t*) &cache->deleted_lock); cache->deleted_doc_ids = NULL; mutex_exit((ib_mutex_t*) &cache->deleted_lock); + + mem_heap_free(static_cast(cache->sync_heap->arg)); + cache->sync_heap->arg = NULL; } /*********************************************************************//** -- cgit v1.2.1