Skip to content

Commit 1a1ffe7

Browse files
Sergey GlukhovSergey Glukhov
Sergey Glukhov
authored and
Sergey Glukhov
committed
Bug#44798 MySQL engine crashes when creating stored procedures with execute_priv=N
The crash happens because of uninitialized lex->ssl_cipher, lex->x509_subject, lex->x509_issuer variables. The fix is to add initialization of these variables for stored procedures&functions.
1 parent 83ec6e0 commit 1a1ffe7

File tree

3 files changed

+25
-0
lines changed

3 files changed

+25
-0
lines changed

mysql-test/r/sp_notembedded.result

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,3 +219,10 @@ GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION
219219
drop user mysqltest_1@localhost;
220220
drop procedure 15298_1;
221221
drop procedure 15298_2;
222+
INSERT INTO mysql.user (Host, User, Password, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv, Create_view_priv, Show_view_priv, Create_routine_priv, Alter_routine_priv, Create_user_priv, ssl_type, ssl_cipher, x509_issuer, x509_subject, max_questions, max_updates, max_connections, max_user_connections)
223+
VALUES('%', 'mysqltest_1', password(''), 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'N', 'N', 'N', 'N', 'N', 'N', 'Y', 'Y', 'N', 'N', 'Y', 'Y', 'N', 'N', 'N', 'N', 'N', 'Y', 'Y', 'N', '', '', '', '', '0', '0', '0', '0');
224+
FLUSH PRIVILEGES;
225+
CREATE PROCEDURE p1(i INT) BEGIN END;
226+
DROP PROCEDURE p1;
227+
DELETE FROM mysql.user WHERE User='mysqltest_1';
228+
FLUSH PRIVILEGES;

mysql-test/t/sp_notembedded.test

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -292,6 +292,23 @@ drop user mysqltest_1@localhost;
292292
drop procedure 15298_1;
293293
drop procedure 15298_2;
294294

295+
#
296+
# Bug#44798 MySQL engine crashes when creating stored procedures with execute_priv=N
297+
#
298+
INSERT INTO mysql.user (Host, User, Password, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv, Create_view_priv, Show_view_priv, Create_routine_priv, Alter_routine_priv, Create_user_priv, ssl_type, ssl_cipher, x509_issuer, x509_subject, max_questions, max_updates, max_connections, max_user_connections)
299+
VALUES('%', 'mysqltest_1', password(''), 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'N', 'N', 'N', 'N', 'N', 'N', 'Y', 'Y', 'N', 'N', 'Y', 'Y', 'N', 'N', 'N', 'N', 'N', 'Y', 'Y', 'N', '', '', '', '', '0', '0', '0', '0');
300+
FLUSH PRIVILEGES;
301+
302+
connect (con1, localhost, mysqltest_1,,);
303+
connection con1;
304+
CREATE PROCEDURE p1(i INT) BEGIN END;
305+
disconnect con1;
306+
connection default;
307+
DROP PROCEDURE p1;
308+
309+
DELETE FROM mysql.user WHERE User='mysqltest_1';
310+
FLUSH PRIVILEGES;
311+
295312
# Wait till all disconnects are completed
296313
--source include/wait_until_count_sessions.inc
297314

sql/sql_acl.cc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5911,6 +5911,7 @@ int sp_grant_privileges(THD *thd, const char *sp_db, const char *sp_name,
59115911
DBUG_RETURN(TRUE);
59125912

59135913
thd->lex->ssl_type= SSL_TYPE_NOT_SPECIFIED;
5914+
thd->lex->ssl_cipher= thd->lex->x509_subject= thd->lex->x509_issuer= 0;
59145915
bzero((char*) &thd->lex->mqh, sizeof(thd->lex->mqh));
59155916

59165917
result= mysql_routine_grant(thd, tables, is_proc, user_list,

0 commit comments

Comments
 (0)