Skip to content

MDEV-35516 sp_lex_keeper use after free #5527

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
grooverdan wants to merge 1 commit into
base: 11.4
Choose a base branch
from
+10 −8
Open

MDEV-35516 sp_lex_keeper use after free #5527

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 10 additions & 8 deletions sql/sp_instr.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,7 +274,7 @@ class sp_lex_keeper final
lex->sp_lex_in_use= true;
}

~sp_lex_keeper()
void destroy()
{
if (m_lex_resp)
{
Expand All @@ -286,6 +286,8 @@ class sp_lex_keeper final
delete m_lex;
}
}
~sp_lex_keeper()
{ destroy(); }

/**
Prepare execution of instruction using LEX, if requested check whenever
Expand Down Expand Up @@ -410,15 +412,15 @@ class sp_lex_instr : public sp_instr
{
/*
Free items owned by an instance of sp_lex_instr and call m_lex_keeper's
destructor explicitly to avoid referencing a deallocated memory
owned by the memory root m_mem_root_for_reparsing that else would take
place in case their implicit invocations (in that case, m_lex_keeper's
destructor and the method free_items() called by ~sp_instr are invoked
after the memory owned by the memory root m_mem_root_for_reparsing
be freed, that would result in abnormal server termination)
destroy explicitly to release memory it uses. m_lex_keeper memory is on
a different mem_root so its destructor examines one basic member and then
the object is freed.
m_lex_keeper's destructor and the method free_items() called by ~sp_instr
are invoked after the memory owned by the memory root m_mem_root_for_reparsing
be freed, that would result in abnormal server termination.
*/
free_items();
m_lex_keeper.~sp_lex_keeper();
m_lex_keeper.destroy();

/*
Ignore the OOM error explicitly since we are inside destructor
Expand Down