Bug #37150 Risk for crash in User_var_log_event::exec_event()

• Submitted: 3 Jun 2008 8:39
• Modified: 23 Jul 2008 19:57
• Reporter: Mats Kindahl
• Status: Closed
• Category: Server: Replication
• Severity: S2 (Serious)
• Version: 5.0.44
• OS: Any
• Assigned to: Mats Kindahl
• Target Version: 5.0+
• Triage: D1 (Critical) / R1 (None/Negligible) / E1 (None/Negligible)

[3 Jun 2008 8:39] Mats Kindahl

Description:
Inside User_var_log_event::exec_event(), there is the following sequence of calls:

  Item_func_set_user_var e(user_var_name, it);
  e.fix_fields(thd, 0);
  e.update_hash(val, val_len, type, charset, DERIVATION_IMPLICIT, 0);

In the event that fix_fields() fails with a certain set of errors (e.g., out of memory), a
call to update_hash() will try to de-reference a NULL pointer, hence cause a crash.

How to repeat:
Read the code

Suggested fix:
Add a guard so that update_hash() is not called if fix_fields() fail.

[7 Jul 2008 9:58] Bugs System

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/49062

2642 Mats Kindahl	2008-07-07
      Bug #37150  	Risk for crash in User_var_log_event::exec_event()
      
      On certain kinds of errors (e.g., out of stack), a call to Item_func_
      set_user_var::fix_fields() might fail.  Since the return value of this
      call was not checked inside User_var_log_event::exec_event(), continuing
      execution after this will cause a crash inside Item_func_set_user_var::
      update_hash().
      
      The bug is fixed by aborting execution of the event with an error if
      fix_fields() fails, since it is not possible to continue execution anyway.

[9 Jul 2008 14:40] Georgi Kodinov

Pushed into 5.0.66

[23 Jul 2008 11:13] Georgi Kodinov

pushed into 5.1.28 and 6.0.7-alpha

[23 Jul 2008 19:57] Jon Stephens

Documented bugfix in the 5.0.66, 5.1.28, and 6.0.7 changelogs as follows:

        Some kinds of internal errors (such as Out of stack) caused the server to 
        crash.

[28 Jul 2008 15:47] Bugs System

Pushed into 5.0.68  (revid:[e-mail]-20080715152926-s5kgnqhtu93b3c8v) (pib:2)
(Retry automatic marking, to ensure nothing is missed. cm01)

[28 Jul 2008 18:47] Bugs System

Pushed into 5.1.28  (revid:[e-mail]-20080714105031-88hmr2baz5di9xej) (version
source revid:[e-mail]-20080714105031-88hmr2baz5di9xej) (pib:3)

[15 Aug 2008 15:06] Mats Kindahl

Documentation should probably be "certain internal errors, such as out of memory errors,
could cause server to crash when replicating statements with user variables."

It was observed when reading the code, we didn't have a live case.