store_temporary_table_record() does not check for handler::clone() failure | possible NULL dereferences in TEMPORARY_TABLES queries

Bug #1206486 reported by Laurynas Biveinis
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Percona Server moved to https://jira.percona.com/projects/PS
Triaged
High
Laurynas Biveinis
5.1
Won't Fix
Medium
Unassigned
5.5
Triaged
Medium
Laurynas Biveinis
5.6
Triaged
High
Laurynas Biveinis

Bug Description

handler::clone() may return NULL. But store_temporary_table_record(), which calls it to fill INFORMATION_SCHEMA.TEMPORARY_TABLES or INFORMATION_SCHEMA.GLOBAL_TEMPORARY_TABLES, does not allow for it returning NULL and thus may proceed with dereferencing the NULL pointer.

This was introduced by the fix to bug 951588.

Related branches

tags: added: i-s-temp-tables
Revision history for this message
Laurynas Biveinis (laurynas-biveinis) wrote :

Actual crash at bug 1205572.

tags: added: low-hanging-fruit
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.