Skip to content

Commit bd6b2f0

Browse files
author
Tor Didriksen
committed
Bug#28008107 MAKE UBSAN ERROR REPORTING FAIL-FAST
Post-push fix. Some callers of dynstr_append_mem() apparently depend on the side-effects of zero-termination when appending a zero-sized string. This is from clang version 6.0.0-1ubuntu2 with ASAN: ==25852==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000189d40 at pc 0x0000004e076c bp 0x7ffd77220550 sp 0x7ffd7721fd00 READ of size 17 at 0x604000189d40 thread T0 #0 0x4e076b in __interceptor_strlen.part.30 asan_interceptors.cc.o:? mysql#1 0x5b0496 in init_dynamic_string(DYNAMIC_STRING*, char const*, unsigned long, unsigned long) mysys/my_string.cc:51 mysql#2 0x56accd in do_connect(st_command*) client/mysqltest.cc:5970 mysql#3 0x5680c9 in main client/mysqltest.cc:8945 mysql#4 0x7f027e87db96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310 The fix is to skip memcpy() only, if length == zero, rather than skipping the entire function. Change-Id: I10540d7c87ae1cfed3bc6967e42290401f5d1f8d
1 parent b1b76e9 commit bd6b2f0

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

mysys/my_string.cc

+1-2
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,6 @@ bool dynstr_append(DYNAMIC_STRING *str, const char *append) {
106106

107107
bool dynstr_append_mem(DYNAMIC_STRING *str, const char *append, size_t length) {
108108
char *new_ptr;
109-
if (length == 0) return false;
110109
if (str->length + length >= str->max_length) {
111110
size_t new_length =
112111
(str->length + length + str->alloc_increment) / str->alloc_increment;
@@ -117,7 +116,7 @@ bool dynstr_append_mem(DYNAMIC_STRING *str, const char *append, size_t length) {
117116
str->str = new_ptr;
118117
str->max_length = new_length;
119118
}
120-
memcpy(str->str + str->length, append, length);
119+
if (length > 0) memcpy(str->str + str->length, append, length);
121120
str->length += length;
122121
str->str[str->length] = 0; /* Safety for C programs */
123122
return false;

0 commit comments

Comments
 (0)