valgrind error "Invalid write of size 1" in client.c send_change_user_packet()
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
MariaDB |
Fix Released
|
High
|
Kristian Nielsen |
Bug Description
I'm not sure that mysql_client_test is run under valgrind normally, but the
issue can repeated like this on latest lp:maria/5.2
(revid:<email address hidden>):
(cd mysql-test && ./mtr main.mysql_
valgrind tests/mysql_
#######
1 of (1/1): test_bug31669
#######
==18293== Invalid write of size 1
==18293== at 0x4AD084: strmake (strmake.c:55)
==18293== by 0x4D822C: send_change_
==18293== by 0x4D8D64: client_
==18293== by 0x4DCB05: native_
==18293== by 0x4D9100: run_plugin_auth (client.c:2441)
==18293== by 0x48BE91: mysql_change_user (libmysql.c:695)
==18293== by 0x485BBC: test_bug31669 (mysql_
==18293== by 0x48A8B2: main (mysql_
==18293== Address 0x6ae4fa8 is 1 bytes after a block of size 455 alloc'd
==18293== at 0x4C22FAB: malloc (vg_replace_
==18293== by 0x496528: my_malloc (my_malloc.c:38)
==18293== by 0x4D806F: send_change_
==18293== by 0x4D8D64: client_
==18293== by 0x4DCB05: native_
==18293== by 0x4D9100: run_plugin_auth (client.c:2441)
==18293== by 0x48BE91: mysql_change_user (libmysql.c:695)
==18293== by 0x485BBC: test_bug31669 (mysql_
==18293== by 0x48A8B2: main (mysql_
It looks to me like this buffer in send_change_
couple bytes too short:
buff= my_alloca(
The buffer size seems to be missing space for zero terminators of the
username, database, and plugin name?
Changed in maria: | |
importance: | Undecided → High |
milestone: | none → 5.2 |
status: | New → Confirmed |
Changed in maria: | |
assignee: | nobody → Kristian Nielsen (knielsen) |
status: | Confirmed → Fix Committed |
Changed in maria: | |
status: | Fix Committed → Fix Released |