Bug #105587 Possible Uninitialized Value in sql/sql_help.cc

• Submitted: 16 Nov 2021 8:57
• Modified: 16 Nov 2021 9:17
• Reporter: Li Zhong
• Status: Verified
• Category: MySQL Server: Optimizer
• Severity: S2 (Serious)
• Version: 8.0.26
• OS: Any
• CPU Architecture: Any

[16 Nov 2021 8:57] Li Zhong

Description:
In the newest version of mysql-8.0 from github repo, in file sql/tztime.cc function sec_to_TIME(), the variable 'yleap' is possibly be used without initialized. 

If the execution path does not evaluate the second condition in while block at https://github.com/mysql/mysql-server/blob/3290a66c89eb1625a7058e0ef732432b6952b435/sql/tz..., the variable 'yleap' is not assigned with any value. But 'yleap' will get used in  https://github.com/mysql/mysql-server/blob/3290a66c89eb1625a7058e0ef732432b6952b435/sql/tz....

Since C compiler does not initialize 'yleap' as 0 by default, the variable 'yleap' may be assigned with a undefined value, which leads to code bugs like overflow.

How to repeat:
It's in the source code of mysql-server-8.0.26

Suggested fix:
Initialize yleap with 0

[16 Nov 2021 9:17] MySQL Verification Team

Hello Li Zhong,

Thank you for the report.

regards,
Umesh