Bug #58175 | xml functions read initialized bytes when conversions happen | ||
---|---|---|---|
Submitted: | 13 Nov 2010 12:55 | Modified: | 13 Dec 2010 5:43 |
Reporter: | Shane Bester (Platinum Quality Contributor) | Email Updates: | |
Status: | Closed | Impact on me: | |
Category: | MySQL Server: XML functions | Severity: | S2 (Serious) |
Version: | 5.5.7, 5.5.8-debug | OS: | Any |
Assigned to: | Alexander Barkov | CPU Architecture: | Any |
Tags: | regression, updatexml, valgrind |
[13 Nov 2010 12:55]
Shane Bester
[13 Nov 2010 21:45]
Valeriy Kravchuk
Verified on 32-bit Ubuntu 10.04: ==25085== 1 errors in context 3 of 5: ==25085== Use of uninitialised value of size 4 ==25085== at 0x835C971: nr_of_decimals(char const*, char const*) (item.cc:5535) ==25085== by 0x835CB75: Item_float::Item_float(char const*, unsigned int) (item.cc:5564) ==25085== by 0x846AFEA: my_xpath_parse_Number(my_xpath_st*) (item_xmlfunc.cc:2371) ==25085== by 0x846A2A8: my_xpath_parse_PrimaryExpr(my_xpath_st*) (item_xmlfunc.cc:1871) ==25085== by 0x846A623: my_xpath_parse_FilterExpr(my_xpath_st*) (item_xmlfunc.cc:2018) ==25085== by 0x846A53C: my_xpath_parse_FilterExpr_opt_slashes_RelativeLocationPath(my_xpath_st*) (item_xmlfunc.cc:1976) ==25085== by 0x846A5FD: my_xpath_parse_PathExpr(my_xpath_st*) (item_xmlfunc.cc:1995) ==25085== by 0x846A426: my_xpath_parse_UnionExpr(my_xpath_st*) (item_xmlfunc.cc:1939) ==25085== by 0x846AE94: my_xpath_parse_UnaryExpr(my_xpath_st*) (item_xmlfunc.cc:2325) ==25085== by 0x846AD1D: my_xpath_parse_MultiplicativeExpr(my_xpath_st*) (item_xmlfunc.cc:2282) ==25085== by 0x846ABB9: my_xpath_parse_AdditiveExpr(my_xpath_st*) (item_xmlfunc.cc:2234) ==25085== by 0x846AA84: my_xpath_parse_RelationalExpr(my_xpath_st*) (item_xmlfunc.cc:2192) ==25085== ...
[18 Nov 2010 19:20]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/124284 3135 Alexander Barkov 2010-11-18 Bug#58175 xml functions read initialized bytes when conversions happen Problem: nr_of_decimals could read behind the end of the buffer in case of a non-null-terminated string, which caused valgring warnings. Fix: fixing nr_of_decimals not to read behind the "end" pointer.
[19 Nov 2010 15:40]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/124484 3137 Alexander Barkov 2010-11-19 Bug#58175 xml functions read initialized bytes when conversions happen Problem: nr_of_decimals could read behind the end of the buffer in case of a non-null-terminated string, which caused valgring warnings. Fix: fixing nr_of_decimals not to read behind the "end" pointer. modified: @ mysql-test/r/xml.result @ mysql-test/t/xml.test @ sql/item.cc
[19 Nov 2010 19:30]
Alexander Barkov
Pushed into mysql-5.5-bugteam [5.5.8] Pushed into mysql-trunk-bugteam [5.6.1-m5]
[24 Nov 2010 13:07]
Jon Stephens
Effects not visible to end users, so nothing to document. Closed.
[5 Dec 2010 12:40]
Bugs System
Pushed into mysql-trunk 5.6.1 (revid:alexander.nozdrin@oracle.com-20101205122447-6x94l4fmslpbttxj) (version source revid:alexander.nozdrin@oracle.com-20101205122447-6x94l4fmslpbttxj) (merge vers: 5.6.1) (pib:23)
[13 Dec 2010 5:43]
Jon Stephens
returning to Closed state; see my previous comment.
[16 Dec 2010 22:30]
Bugs System
Pushed into mysql-5.5 5.5.9 (revid:jonathan.perkin@oracle.com-20101216101358-fyzr1epq95a3yett) (version source revid:jonathan.perkin@oracle.com-20101216101358-fyzr1epq95a3yett) (merge vers: 5.5.9) (pib:24)