Bug #44287 mysqlbinlog output garbage if incident-events have a unknown id
Submitted: 15 Apr 2009 11:30 Modified: 16 May 2009 6:21
Reporter: Jan Kneschke Email Updates:
Status: No Feedback Impact on me:
None 
Category:MySQL Server: Replication Severity:S3 (Non-critical)
Version:5.1.33 OS:Any
Assigned to: CPU Architecture:Any

[15 Apr 2009 11:30] Jan Kneschke 
Description:
sql/log_event.cc Incident_log_event::description() doesn't check for out-of-bounds of the incident-id.

How to repeat:
Try to decode a specially crafted binlog file:

$ mysqlbinlog attached-binlog-file
...
#090415 12:02:32 server id 1  end_log_pos 350 
# Incident: U‰åƒì‹E‰uø‹‰}ü‹}
                        ‰D‹E‰D$‹F‰$ègö# at 350
...

You may see other garbage depending on architecture.

Suggested fix:
Incident_log_event::description() should check that the incident-id is valid
[15 Apr 2009 11:33] Jan Kneschke 
a binlog with a incident-event-id = 42

Attachment: binlog-test.log (application/octet-stream, text), 385 bytes.
[16 Apr 2009 6:21] Sveta Smirnova 
Thank you for the report.

I only get:

# at 307
#090415 13:10:46 server id 1  end_log_pos 334   Xid = 42
COMMIT/*!*/;
ERROR: Error in Log_event::read_log_event(): 'Found invalid event in binary log', data_len: 32, event_type: 26
ERROR: Could not read entry at offset 334: Error in log format or read error.
DELIMITER ;
# End of log file

And with debug builds:

$~/build/mysql-5.1/bin/mysqlbinlog binlog-test.log 
/*!40019 SET @@session.max_insert_delayed_threads=0*/;
/*!50003 SET @OLD_COMPLETION_TYPE=@@COMPLETION_TYPE,COMPLETION_TYPE=0*/;
DELIMITER /*!*/;
mysqlbinlog: log_event.cc:3851: void Format_description_log_event::calc_server_version_split(): Assertion `!((i == 0) && (*r != '.'))' failed.
Aborted

Are there additional circumstances garbage in the output is repeatable with?
[16 May 2009 23:00] Bugs System 
No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".