[Tarantool-patches] [PATCH v1 1/1] sql: fix error on copy empty string in mem_copy()
Mergen Imeev
imeevma at tarantool.org
Fri Aug 27 18:22:23 MSK 2021
Thank you for the review! My answers and new patch below. I didn't include diff
since I reworked most psrt of the patch.
On Thu, Aug 26, 2021 at 10:21:01PM +0200, Vladislav Shpilevoy wrote:
> Hi! Thanks for the patch!
>
> See 3 comments below.
>
> > diff --git a/test/sql-tap/gh-6157-unnecessary-free-on-string.c b/test/sql-tap/gh-6157-unnecessary-free-on-string.c
> > new file mode 100644
> > index 000000000..ce928d494
> > --- /dev/null
> > +++ b/test/sql-tap/gh-6157-unnecessary-free-on-string.c
> > @@ -0,0 +1,10 @@
> > +#include "msgpuck.h"
> > +#include "module.h"
> > +
> > +int
> > +f(box_function_ctx_t* ctx, const char* args, const char* args_end)
>
> 1. '*' must be right before variable name, not after the types.
>
Dropped this funcion.
> > +{
> > + char res[16];
> > + char *end = mp_encode_str(res, "stub", strlen("stub"));
> > + return box_return_mp(ctx, res, end);
> > +}
>
> 2. Why do you need a C function? Can't you reproduce it with Lua?
>
Dropped.
> > diff --git a/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua
> > new file mode 100755
> > index 000000000..326570aea
> > --- /dev/null
> > +++ b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua
> > @@ -0,0 +1,38 @@
> > +#!/usr/bin/env tarantool
> > +local build_path = os.getenv("BUILDDIR")
> > +package.cpath = build_path..'/test/sql-tap/?.so;'..build_path..'/test/sql-tap/?.dylib;'..package.cpath
> > +
> > +local test = require("sqltester")
> > +test:plan(1)
> > +
> > +box.schema.func.create("gh-6157.f", {
> > + language = "C",
> > + param_list = {"string"},
> > + returns = "string",
> > + exports = {"SQL"}
> > +})
> > +
> > +box.execute([[CREATE TABLE ts(s STRING PRIMARY KEY);]])
> > +box.execute([[INSERT INTO ts VALUES ('');]])
> > +box.execute([[CREATE TABLE ti(i INT PRIMARY KEY);]])
> > +for i = 1, 100 do
> > + box.execute([[INSERT INTO ti VALUES(]]..i..[[);]])
>
> 3. Why do you need a space to reproduce this bug? It does not seem related.
As I understood, there is two bugs: first - seems like lookaside is leaking, but
not sure if this is a bug. Created a new issue - #6401. The second is the one
fixed in this patch. I reworked this test and now it is a lot simpler.
Also, I added checks for the result of mem_copy() since before we couldn't be
sure where exactly these errors appear, since only part of mem_copy() was
executed, but error was set improperly.
New patch:
commit c7e823516c5fdf91ff9b04fc3a0642e3ced9ad3e
Author: Mergen Imeev <imeevma at gmail.com>
Date: Mon Aug 23 11:54:09 2021 +0300
sql: fix error on copy empty string in mem_copy()
This patch fixes the problem with copying an empty string in mem_copy().
Previously, because the string length was 0, an error was thrown, but
the diag was not set, which could lead to an error due to an empty diag
or to a double free.
Closes #6157
diff --git a/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md b/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md
new file mode 100644
index 000000000..e5f747414
--- /dev/null
+++ b/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md
@@ -0,0 +1,5 @@
+## bugfix/sql
+
+* Now, when copying an empty string, an error will not be set
+ unnecessarily (gh-6157).
+
diff --git a/src/box/sql/func.c b/src/box/sql/func.c
index c063552d6..9009f9e4f 100644
--- a/src/box/sql/func.c
+++ b/src/box/sql/func.c
@@ -1771,13 +1771,15 @@ minmaxStep(sql_context * context, int NotUsed, sql_value ** argv)
bool is_max = (func->flags & SQL_FUNC_MAX) != 0;
int cmp = mem_cmp_scalar(pBest, pArg, pColl);
if ((is_max && cmp < 0) || (!is_max && cmp > 0)) {
- mem_copy(pBest, pArg);
+ if (mem_copy(pBest, pArg) != 0)
+ context->is_aborted = true;
} else {
sqlSkipAccumulatorLoad(context);
}
} else {
pBest->db = sql_context_db_handle(context);
- mem_copy(pBest, pArg);
+ if (mem_copy(pBest, pArg) != 0)
+ context->is_aborted = true;
}
}
diff --git a/src/box/sql/mem.c b/src/box/sql/mem.c
index 4c40f15dc..819d9b094 100644
--- a/src/box/sql/mem.c
+++ b/src/box/sql/mem.c
@@ -1913,7 +1913,8 @@ mem_copy(struct Mem *to, const struct Mem *from)
assert((to->flags & MEM_Zero) == 0 || to->type == MEM_TYPE_BIN);
if ((to->flags & MEM_Zero) != 0)
return sqlVdbeMemExpandBlob(to);
- to->zMalloc = sqlDbReallocOrFree(to->db, to->zMalloc, to->n);
+ to->zMalloc = sqlDbRealloc(to->db, to->zMalloc, MAX(32, to->n));
+ assert(to->zMalloc != NULL || sql_get()->mallocFailed != 0);
if (to->zMalloc == NULL)
return -1;
to->szMalloc = sqlDbMallocSize(to->db, to->zMalloc);
diff --git a/src/box/sql/vdbe.c b/src/box/sql/vdbe.c
index 7f86fa7b3..44533fb3e 100644
--- a/src/box/sql/vdbe.c
+++ b/src/box/sql/vdbe.c
@@ -978,7 +978,8 @@ case OP_Copy: {
pOut = &aMem[pOp->p2];
assert(pOut!=pIn1);
while( 1) {
- mem_copy(pOut, pIn1);
+ if (mem_copy(pOut, pIn1) != 0)
+ goto abort_due_to_error;
REGISTER_TRACE(p, pOp->p2+pOp->p3-n, pOut);
if ((n--)==0) break;
pOut++;
diff --git a/src/box/sql/vdbeapi.c b/src/box/sql/vdbeapi.c
index 8031ee0dc..e44d73a16 100644
--- a/src/box/sql/vdbeapi.c
+++ b/src/box/sql/vdbeapi.c
@@ -232,7 +232,8 @@ sql_result_text64(sql_context * pCtx,
void
sql_result_value(sql_context * pCtx, sql_value * pValue)
{
- mem_copy(pCtx->pOut, pValue);
+ if (mem_copy(pCtx->pOut, pValue) != 0)
+ pCtx->is_aborted = true;
}
void
diff --git a/src/box/sql/vdbeaux.c b/src/box/sql/vdbeaux.c
index 2d7800b17..beb8cee04 100644
--- a/src/box/sql/vdbeaux.c
+++ b/src/box/sql/vdbeaux.c
@@ -2318,8 +2318,12 @@ sqlVdbeGetBoundValue(struct Vdbe *v, int iVar)
Mem *pMem = &v->aVar[iVar - 1];
if (!mem_is_null(pMem)) {
sql_value *pRet = sqlValueNew(v->db);
- if (pRet != NULL)
- mem_copy(pRet, pMem);
+ if (pRet == NULL)
+ return NULL;
+ if (mem_copy(pRet, pMem) != 0) {
+ sqlDbFree(sql_get(), pRet);
+ return NULL;
+ }
return pRet;
}
}
diff --git a/test/sql-tap/engine.cfg b/test/sql-tap/engine.cfg
index 587adbed9..c35d1dced 100644
--- a/test/sql-tap/engine.cfg
+++ b/test/sql-tap/engine.cfg
@@ -35,6 +35,7 @@
"built-in-functions.test.lua": {
"memtx": {"engine": "memtx"}
},
+ "gh-6157-unnecessary-free-on-string.test.lua": {},
"gh-4077-iproto-execute-no-bind.test.lua": {},
"gh-6375-assert-on-unsupported-ext.test.lua": {},
"*": {
diff --git a/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua
new file mode 100755
index 000000000..e0c09a325
--- /dev/null
+++ b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua
@@ -0,0 +1,18 @@
+#!/usr/bin/env tarantool
+local tap = require('tap')
+local test = tap.test('test wrong error in mem_copy()')
+
+--
+-- Make sure there is no assert due to an incorrectly set error in mem_copy().
+-- How this test works: We have 128 mempool cells in SQL ("lookaside"), and
+-- until those 128 cells are filled in, the error cannot be reproduced. Also, we
+-- have to get '' from somewhere because if we just enter it, it will be of type
+-- STATIC and no memory will be allocated.
+--
+local s = "NULLIF(SUBSTR('123', 1, 0), NULL)"
+for i = 1, 5 do s = s..', '..s end
+local res = box.execute("SELECT "..s).rows[1]
+
+test:plan(1)
+test:is(#res, 32, 'wrong error in mem_copy() was set')
+os.exit(test:check() and 0 or 1)
More information about the Tarantool-patches
mailing list