Bug #34779 | crash in checksum table on federated tables with blobs containing nulls | ||
---|---|---|---|
Submitted: | 23 Feb 2008 18:23 | Modified: | 16 Sep 2008 4:21 |
Reporter: | Shane Bester (Platinum Quality Contributor) | Email Updates: | |
Status: | Closed | Impact on me: | |
Category: | MySQL Server: Federated storage engine | Severity: | S1 (Critical) |
Version: | 5.0.56, 5.1.23 | OS: | Any |
Assigned to: | Ramil Kalimullin | CPU Architecture: | Any |
Tags: | BLOB, checksum table, DoS, null |
[23 Feb 2008 18:23]
Shane Bester
[23 Feb 2008 18:57]
MySQL Verification Team
in mysql_checksum_table(), we have this: for (uint i= 0; i < t->s->fields; i++ ) { Field *f= t->field[i]; if ((f->type() == MYSQL_TYPE_BLOB) || (f->type() == MYSQL_TYPE_VARCHAR)) { String tmp; f->val_str(&tmp); row_crc= my_checksum(row_crc, (uchar*) tmp.ptr(), tmp.length());<--crash } crash happens because tmp is 0xa5a5a5a5 uninitialized.
[23 Feb 2008 19:25]
MySQL Verification Team
seems related to table cache + blobs! try this deterministic testcase in debug version. if that doesn't crash, only then try the .c app ! flush tables; create database if not exists `realdb`; create database if not exists `test`; use `realdb`; drop table if exists `t1`; create table `t1`(`a` longblob,`b` longblob) engine=myisam; insert into `t1` values ('aaaaaaaaaaaaaaaaaaaaaaaaaaaa',null); use `test`; drop table if exists `t1`; create table `t1`(`a` longblob,`b` longblob) connection='mysql://root@127.0.0.1:3306/realdb/t1' engine=federated; flush tables; checksum table `t1`;
[23 Feb 2008 20:41]
Valeriy Kravchuk
Last test case does not lead to crash for me in 5.1.23-debug on Windows XP.
[24 Feb 2008 0:10]
MySQL Verification Team
Thank you for the bug report. c:\dbs>5.1\bin\mysql -uroot test Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 1 Server version: 5.1.24-rc-nt-debug-log Source distribution Type 'help;' or '\h' for help. Type '\c' to clear the buffer. mysql> flush tables; Query OK, 0 rows affected (0.03 sec) mysql> create database if not exists `realdb`; Query OK, 1 row affected (0.03 sec) mysql> create database if not exists `test`; Query OK, 0 rows affected, 1 warning (0.00 sec) mysql> use `realdb`; Database changed mysql> drop table if exists `t1`; Query OK, 0 rows affected, 1 warning (0.06 sec) mysql> create table `t1`(`a` longblob,`b` longblob) engine=myisam; Query OK, 0 rows affected (0.08 sec) mysql> insert into `t1` values ('aaaaaaaaaaaaaaaaaaaaaaaaaaaa',null); Query OK, 1 row affected (0.03 sec) mysql> use `test`; Database changed mysql> drop table if exists `t1`; Query OK, 0 rows affected (0.06 sec) mysql> create table `t1`(`a` longblob,`b` longblob) -> connection='mysql://root@127.0.0.1:3306/realdb/t1' engine=federated; Query OK, 0 rows affected (0.16 sec) mysql> flush tables; Query OK, 0 rows affected (0.00 sec) mysql> checksum table `t1`; ERROR 2013 (HY000): Lost connection to MySQL server during query mysql> >mysqld-debug.exe!crc32_little(unsigned long crc=2465757603, const unsigned char * buf=0xa5a5a5a5, unsigned int len=2779096485) Line 273 + 0x3 C mysqld-debug.exe!crc32(unsigned long crc=2465757603, const unsigned char * buf=0xa5a5a5a5, unsigned int len=2779096485) Line 237 + 0x11 C mysqld-debug.exe!my_checksum(unsigned int crc=2465757603, const unsigned char * pos=0xa5a5a5a5, unsigned int length=2779096485) Line 39 + 0x11 C mysqld-debug.exe!mysql_checksum_table(THD * thd=0x0171bbc8, TABLE_LIST * tables=0x01747e08, st_ha_check_opt * check_opt=0x0171d1f0) Line 7259 + 0x24 C++ mysqld-debug.exe!mysql_execute_command(THD * thd=0x0171bbc8) Line 2747 + 0x17 C++ mysqld-debug.exe!mysql_parse(THD * thd=0x0171bbc8, const char * inBuf=0x01747d60, unsigned int length=19, const char * * found_semicolon=0x038bfd00) Line 5622 + 0x9 C++ mysqld-debug.exe!dispatch_command(enum_server_command command=COM_QUERY, THD * thd=0x0171bbc8, char * packet=0x0173fcb1, unsigned int packet_length=19) Line 1121 + 0x1e C++ mysqld-debug.exe!do_command(THD * thd=0x0171bbc8) Line 781 + 0x1b C++ mysqld-debug.exe!handle_one_connection(void * arg=0x0171bbc8) Line 1120 + 0x9 C++ mysqld-debug.exe!pthread_start(void * param=0x011ef5e0) Line 85 + 0x9 C mysqld-debug.exe!_threadstart(void * ptd=0x0173a4f8) Line 196 + 0xd C kernel32.dll!7c80b683()
[5 May 2008 3:31]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/46341 ChangeSet@1.2613, 2008-05-05 08:31:15+05:00, ramil@mysql.com +3 -0 Fix for bug #34779: crash in checksum table on federated tables with blobs containing nulls Problem: FEDERATED SE improperly stores NULL fields in the record buffer. Fix: store them properly.
[15 Aug 2008 6:40]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/51696 2662 Ramil Kalimullin 2008-08-15 Fix for bug #34779: crash in checksum table on federated tables with blobs containing nulls Problem: FEDERATED SE improperly stores NULL fields in the record buffer. Fix: store them properly.
[15 Aug 2008 6:42]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/51697 2662 Ramil Kalimullin 2008-08-15 Fix for bug #34779: crash in checksum table on federated tables with blobs containing nulls Problem: FEDERATED SE improperly stores NULL fields in the record buffer. Fix: store them properly.
[21 Aug 2008 18:17]
Bugs System
Pushed into 5.1.28 (revid:ramil@mysql.com-20080815064005-yex49cj5dknqlwf6) (version source revid:sergefp@mysql.com-20080819132519-eimtstp3bx89ya9d) (pib:3)
[27 Aug 2008 2:28]
Paul DuBois
Noted in 5.1.28 changelog. Table checksum calculation could cause a server crash for FEDERATED tables with BLOB columns containing NULL values. Setting report to NDI pending push into 6.0.x.
[14 Sep 2008 1:35]
Bugs System
Pushed into 6.0.7-alpha (revid:ramil@mysql.com-20080815064005-yex49cj5dknqlwf6) (version source revid:timothy.smith@sun.com-20080813081634-s8rre51iveicu311) (pib:3)
[16 Sep 2008 4:21]
Paul DuBois
Noted in 6.0.7 changelog.