MDEV-30732 : wsrep_store_key_val_for_row() may invoke memcpy() on nul… #4314
+650
−126
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
janlindstrom
force-pushed
the
10.11-MDEV-30732
branch
from
888d218 to
33023ba
Compare
janlindstrom
force-pushed
the
10.11-MDEV-30732
branch
from
33023ba to
d1697ce
Compare
dr-m
requested changes
Oct 3, 2025
janlindstrom
force-pushed
the
10.11-MDEV-30732
branch
2 times, most recently
from
99415e3 to
4e53039
Compare
dr-m
reviewed
Oct 7, 2025
janlindstrom
force-pushed
the
10.11-MDEV-30732
branch
2 times, most recently
from
12a363a to
fa1fec8
Compare
janlindstrom
force-pushed
the
10.11-MDEV-30732
branch
from
fa1fec8 to
d5bc80a
Compare
…lptr Problem was that row_mysql_read_blob_ref can return NULL in case when blob datatype is used in a key and its real value is NULL. This NULL pointer is then used in memcpy function in wsrep_store_key_val_for_row. However, memcpy is defined so that argument 2 must not be NULL. Fixed by adding conditions before memcpy functions so that argument 2 is always non NULL. Additional fixes after review - Removed unnecessary copying key data from one buffer to another. Use original key data buffer as input and temporary buffer as output. Extra output buffer is needed because strnxfrm might expand input buffer contents. - Removed unnecessary initialization of variables and move declaration where first time needed. - Removed unnecessary intitialization of temporary buffer because we already keep track actual filled length. - Remove unneccessary extra call to charset->strnxfrm
janlindstrom
force-pushed
the
10.11-MDEV-30732
branch
from
d5bc80a to
2effebc
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
…lptr
Description
Problem was that row_mysql_read_blob_ref can return NULL in case when blob datatype is used in a key and its real value is NULL. This NULL pointer is then used in memcpy function in wsrep_store_key_val_for_row. However,
memcpy is defined so that argument 2 must not be NULL.
Fixed by adding conditions before memcpy functions so that argument 2 is always non NULL.
Release Notes
TODO: What should the release notes say about this change?
Include any changed system variables, status variables or behaviour. Optionally list any https://mariadb.com/kb/ pages that need changing.
How can this PR be tested?
TODO: modify the automated test suite to verify that the PR causes MariaDB to behave as intended.
Consult the documentation on "Writing good test cases".
If the changes are not amenable to automated testing, please explain why not and carefully describe how to test manually.
Basing the PR against the correct MariaDB version
mainbranch.PR quality check