sprintf overlapping in MYSQL_BIN_LOG::handle_binlog_flush_or_sync_error()

[Vlad Lesin]

void MYSQL_BIN_LOG::handle_binlog_flush_or_sync_error(THD *thd,
                                                      bool need_lock_log)
{
  char errmsg[MYSQL_ERRMSG_SIZE];
  sprintf(errmsg, "An error occurred during %s stage of the commit. "
          "'binlog_error_action' is set to '%s'.",
          thd->commit_error== THD::CE_FLUSH_ERROR ? "flush" : "sync",
          binlog_error_action == ABORT_SERVER ? "ABORT_SERVER" : "IGNORE_ERROR");
  if (binlog_error_action == ABORT_SERVER)
  {
    sprintf(errmsg, "%s Hence aborting the server.", errmsg);
    exec_binlog_error_action_abort(errmsg);
  }
...
}

"C99 and POSIX.1-2001 specify that the results are undefined if a call to sprintf(), snprintf(), vsprintf(), or vsnprintf() would cause
 copying to take place between objects that overlap (e.g., if the target string array and one of the supplied input arguments refer to the same buffer). See NOTES."

This string:

sprintf(errmsg, "%s Hence aborting the server.", errmsg);

leads to undefined behaviour, as a result binlog_error_action test fails.

Suggested fix:

void MYSQL_BIN_LOG::handle_binlog_flush_or_sync_error(THD *thd,
                                                      bool need_lock_log)
{
  char errmsg[MYSQL_ERRMSG_SIZE];
  snprintf(errmsg, sizeof(errmsg), "An error occurred during %s stage of the commit. "
          "'binlog_error_action' is set to '%s'.",
          thd->commit_error== THD::CE_FLUSH_ERROR ? "flush" : "sync",
          binlog_error_action == ABORT_SERVER ? "ABORT_SERVER" : "IGNORE_ERROR");
  if (binlog_error_action == ABORT_SERVER)
  {
    char errmsg_for_abort[MYSQL_ERRMSG_SIZE];
    snprintf(errmsg_for_abort, sizeof(errmsg_for_abort), "%s Hence aborting the server.", errmsg);
    exec_binlog_error_action_abort(errmsg_for_abort);
  }
...
}

[Vlad Lesin (vlad-lesin)]

http://bugs.mysql.com/bug.php?id=80138

[Shahriyar Rzayev (rzayev-sehriyar)]

Percona now uses JIRA for bug reports so this bug report is migrated to: https://jira.percona.com/browse/PS-962