MySQL Bugs: #94500: Contribution by Facebook: Fix writing Format Description Event

Bug #94500	Contribution by Facebook: Fix writing Format Description Event
Submitted:	27 Feb 2019 20:01	Modified:	29 Apr 2019 12:14
Reporter:	FBContrib Admin	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Replication	Severity:	S3 (Non-critical)
Version:	8.0.13	OS:	Any
Assigned to:		CPU Architecture:	Any

Description:
Background innformation provided by Facebook:

Different versions of mysqld have different number of binlog event types. The Format_description_event log has an array whose size is based on the number of events supported by the mysqld version. So a 5.6 mysqld generates a FDE with 35 types while 8.0 mysqld generates a FDE with 39 types. When 8.0 mysqld attempts to read a 5.6 generated FDE and then rewrite out the 5.6 FDE, it uses its own value of LOG_EVENT_TYPES (39) to determine the length of the array, which is actually only 35 types.

The copy accesses undefined memory to generate the FDE.

Fix this by using the length of the FDE recorded in the array instead of
LOG_EVENT_TYPES.

Use case:
We have 5.6 masters which replicate to 8.0 slaves and we run ASAN builds during testing to help detect problems. This bug trips asan alerts. While non-asan builds can run successfully with it, we feel it is better to fix the problem rather than let 8.0 copy random memory contents into the relay binlog.

Repo: https://github.com/mysql/mysql-server
Patch on top of 8.0.13: https://github.com/mysql/mysql-server/commit/e4924f36486f971f8a04252e01c803457a2c72f7

How to repeat:
See description

Suggested fix:
See contribution code attached

Fix writing Format Description Event 
(*) This code is contributed under the Facebook agreement

Contribution: fb_patch_110.txt (text/plain), 2.72 KiB.

This fixes https://bugs.mysql.com/bug.php?id=94319

Posted by developer:
 
Changelog entry added for MySQL 8.0.17 and 5.7.27:

        When events generated by one MySQL server instance were written
        to the binary log of another instance, the second server
        implicitly assumed that the first server supported the same
        number of binary log event types as itself. Where this was not
        the case, the event header was handled incorrectly. The issue
        has now been fixed. Thanks to Facebook for the contribution.

Thanks for Facebook for the contribution