From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 024166EC5A; Thu, 2 Sep 2021 12:16:16 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 024166EC5A DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1630574176; bh=GwBQMJYd4fC70Tu2GpkUfx9MBrAymELTIkskIkkvsvY=; h=To:Cc:References:In-Reply-To:Date:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=m4pSMeQN0UB/0vMIA6gDOSePyXdiooSSXvxxF87hOQdHN4+geMHv/UkylQdupLZRd xBBpI/kAzL/6FiWBpOS+WBJXclToscgDlkevLk3Gx7QAeQN2rno1tz1x4Zjv0mO5pS dze7rHAyTvrncCq9U/1/9jMqS7uZpX3ZMaTjEuzk= Received: from smtp57.i.mail.ru (smtp57.i.mail.ru [217.69.128.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 0F4026EC5A for ; Thu, 2 Sep 2021 12:16:15 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 0F4026EC5A Received: by smtp57.i.mail.ru with esmtpa (envelope-from ) id 1mLipS-0001js-4T; Thu, 02 Sep 2021 12:16:14 +0300 To: Cc: References: <9beadd2600ef349c5bf5142716784526423b317c.1630572128.git.imeevma@gmail.com> In-Reply-To: <9beadd2600ef349c5bf5142716784526423b317c.1630572128.git.imeevma@gmail.com> Date: Thu, 2 Sep 2021 12:15:50 +0300 Message-ID: <069e01d79fdb$1fac2ab0$5f048010$@tarantool.org> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQIP78GZeSC7nQ42XH+19AOOEQNMrKsf1X0w Content-Language: ru X-4EC0790: 10 X-7564579A: B8F34718100C35BD X-77F55803: 4F1203BC0FB41BD9EE8D69D3379D80C4D4372D9D0A048EC97FC5358F90773914182A05F5380850402A08806D3BBFF97AA47D5BA6AFF55B409B7BFF7EE95D5B13725B1717B38956EE X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE79E25BE5045FD62C0EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F79006372CFCDE0CF3C283B78638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D836B2AAF7712AF19E5B8D5B115314D585117882F4460429724CE54428C33FAD305F5C1EE8F4F765FCF1175FABE1C0F9B6A471835C12D1D9774AD6D5ED66289B52BA9C0B312567BB23117882F446042972877693876707352033AC447995A7AD182CC0D3CB04F14752D2E47CDBA5A96583BA9C0B312567BB2376E601842F6C81A19E625A9149C048EEC65AC60A1F0286FE9735652A29929C6C4AD6D5ED66289B52698AB9A7B718F8C46E0066C2D8992A16725E5C173C3A84C3D6B8D1F75A55B56D3AA81AA40904B5D9DBF02ECDB25306B2201CA6A4E26CD07C3BBE47FD9DD3FB595F5C1EE8F4F765FC72CEEB2601E22B093A03B725D353964B0B7D0EA88DDEDAC722CA9DD8327EE4930A3850AC1BE2E735B58781B77DE60D36C4224003CC83647689D4C264860C145E X-B7AD71C0: AC4F5C86D027EB782CDD5689AFBDA7A213B5FB47DCBC3458834459D11680B505805610DC81B169AA6EAD3D9BA09FBB01 X-C1DE0DAB: 0D63561A33F958A54A0590E6F2C77A830CD05EADA743BBDDE697076DA06DC25FD59269BC5F550898D99A6476B3ADF6B47008B74DF8BB9EF7333BD3B22AA88B938A852937E12ACA752546FE575EB473F1410CA545F18667F91A7EA1CDA0B5A7A0 X-C8649E89: 4E36BF7865823D7055A7F0CF078B5EC49A30900B95165D34CAFBC0A7A4BEEE01BC220475898E2AD30CBC6A311751F42B5DC9838DA329C431761BD7ABA1ECE88E1D7E09C32AA3244CD363EB9D96994012508AB39F34DD8C65F165894D92D62706729B2BEF169E0186 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojK/h3ZnmlPjELALzMbD5YAg== X-Mailru-Sender: 6CA451E36783D721CBEA96CEA26D325D77A6D7D4392A24EE2CE80A9D86F2EC05B7CBEF92542CD7C82F97C478340294DCC77752E0C033A69E0F0C7111264B8915FF1320A92A5534336C18EFA0BB12DBB0 X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH v1 1/1] sql: fix error on copy empty string in mem_copy() X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Timur Safin via Tarantool-patches Reply-To: Timur Safin Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" You intentionally increase memory usage here (before we had a chance to release memory for empty literals, nowadays you leave 32-bytes hanging longer. And why 32, and not, say, 8 bytes - which is lowest allocation granularity). I don't like it in a longer-term, but as a short term dirty work-around - that's ok. We will reshake LGTM Timur > -----Original Message----- > From: imeevma@tarantool.org > Sent: Thursday, September 2, 2021 11:43 AM > To: tsafin@tarantool.org > Cc: tarantool-patches@dev.tarantool.org > Subject: [PATCH v1 1/1] sql: fix error on copy empty string in > mem_copy() > > This patch fixes the problem with copying an empty string in > mem_copy(). > Previously, because the string length was 0, an error was thrown, but > the diag was not set, which could lead to an error due to an empty > diag > or to a double free. > > Closes #6157 > Closes #6399 > --- > https://github.com/tarantool/tarantool/issues/6157 > https://github.com/tarantool/tarantool/issues/6399 > https://github.com/tarantool/tarantool/tree/imeevma/gh-6157-fix- > error-on-empty-str > > .../gh-6157-fix-error-on-copy-empty-str.md | 4 ++++ > src/box/sql/func.c | 6 ++++-- > src/box/sql/mem.c | 3 ++- > src/box/sql/vdbe.c | 3 ++- > src/box/sql/vdbeapi.c | 3 ++- > src/box/sql/vdbeaux.c | 8 +++++-- > test/sql-tap/engine.cfg | 1 + > ...h-6157-unnecessary-free-on-string.test.lua | 21 > +++++++++++++++++++ > 8 files changed, 42 insertions(+), 7 deletions(-) > create mode 100644 changelogs/unreleased/gh-6157-fix-error-on-copy- > empty-str.md > create mode 100755 test/sql-tap/gh-6157-unnecessary-free-on- > string.test.lua > > diff --git a/changelogs/unreleased/gh-6157-fix-error-on-copy-empty- > str.md b/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md > new file mode 100644 > index 000000000..398b6e31d > --- /dev/null > +++ b/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md > @@ -0,0 +1,4 @@ > +## bugfix/sql > + > +* Now, when copying an empty string, an error will not be set > + unnecessarily (gh-6157, gh-6399). > diff --git a/src/box/sql/func.c b/src/box/sql/func.c > index c063552d6..9009f9e4f 100644 > --- a/src/box/sql/func.c > +++ b/src/box/sql/func.c > @@ -1771,13 +1771,15 @@ minmaxStep(sql_context * context, int > NotUsed, sql_value ** argv) > bool is_max = (func->flags & SQL_FUNC_MAX) != 0; > int cmp = mem_cmp_scalar(pBest, pArg, pColl); > if ((is_max && cmp < 0) || (!is_max && cmp > 0)) { > - mem_copy(pBest, pArg); > + if (mem_copy(pBest, pArg) != 0) > + context->is_aborted = true; > } else { > sqlSkipAccumulatorLoad(context); > } > } else { > pBest->db = sql_context_db_handle(context); > - mem_copy(pBest, pArg); > + if (mem_copy(pBest, pArg) != 0) > + context->is_aborted = true; > } > } > > diff --git a/src/box/sql/mem.c b/src/box/sql/mem.c > index 24de26548..48755a017 100644 > --- a/src/box/sql/mem.c > +++ b/src/box/sql/mem.c > @@ -1913,7 +1913,8 @@ mem_copy(struct Mem *to, const struct Mem > *from) > assert((to->flags & MEM_Zero) == 0 || to->type == MEM_TYPE_BIN); > if ((to->flags & MEM_Zero) != 0) > return sqlVdbeMemExpandBlob(to); > - to->zMalloc = sqlDbReallocOrFree(to->db, to->zMalloc, to->n); > + to->zMalloc = sqlDbRealloc(to->db, to->zMalloc, MAX(32, to->n)); > + assert(to->zMalloc != NULL || sql_get()->mallocFailed != 0); > if (to->zMalloc == NULL) > return -1; > to->szMalloc = sqlDbMallocSize(to->db, to->zMalloc); > diff --git a/src/box/sql/vdbe.c b/src/box/sql/vdbe.c > index 7f86fa7b3..44533fb3e 100644 > --- a/src/box/sql/vdbe.c > +++ b/src/box/sql/vdbe.c > @@ -978,7 +978,8 @@ case OP_Copy: { > pOut = &aMem[pOp->p2]; > assert(pOut!=pIn1); > while( 1) { > - mem_copy(pOut, pIn1); > + if (mem_copy(pOut, pIn1) != 0) > + goto abort_due_to_error; > REGISTER_TRACE(p, pOp->p2+pOp->p3-n, pOut); > if ((n--)==0) break; > pOut++; > diff --git a/src/box/sql/vdbeapi.c b/src/box/sql/vdbeapi.c > index 77df0e4cc..115940227 100644 > --- a/src/box/sql/vdbeapi.c > +++ b/src/box/sql/vdbeapi.c > @@ -232,7 +232,8 @@ sql_result_text64(sql_context * pCtx, > void > sql_result_value(sql_context * pCtx, sql_value * pValue) > { > - mem_copy(pCtx->pOut, pValue); > + if (mem_copy(pCtx->pOut, pValue) != 0) > + pCtx->is_aborted = true; > } > > void > diff --git a/src/box/sql/vdbeaux.c b/src/box/sql/vdbeaux.c > index 2d7800b17..8148ed8b0 100644 > --- a/src/box/sql/vdbeaux.c > +++ b/src/box/sql/vdbeaux.c > @@ -2318,8 +2318,12 @@ sqlVdbeGetBoundValue(struct Vdbe *v, int iVar) > Mem *pMem = &v->aVar[iVar - 1]; > if (!mem_is_null(pMem)) { > sql_value *pRet = sqlValueNew(v->db); > - if (pRet != NULL) > - mem_copy(pRet, pMem); > + if (pRet == NULL) > + return NULL; > + if (mem_copy(pRet, pMem) != 0) { > + sqlValueFree(pRet); > + return NULL; > + } > return pRet; > } > } > diff --git a/test/sql-tap/engine.cfg b/test/sql-tap/engine.cfg > index 587adbed9..c35d1dced 100644 > --- a/test/sql-tap/engine.cfg > +++ b/test/sql-tap/engine.cfg > @@ -35,6 +35,7 @@ > "built-in-functions.test.lua": { > "memtx": {"engine": "memtx"} > }, > + "gh-6157-unnecessary-free-on-string.test.lua": {}, > "gh-4077-iproto-execute-no-bind.test.lua": {}, > "gh-6375-assert-on-unsupported-ext.test.lua": {}, > "*": { > diff --git a/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua > b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua > new file mode 100755 > index 000000000..ebe69906a > --- /dev/null > +++ b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua > @@ -0,0 +1,21 @@ > +#!/usr/bin/env tarantool > +local test = require("sqltester") > +test:plan(1) > + > +-- > +-- Make sure there is no assert due to an incorrectly set error in > mem_copy(). > +-- How this test works: We have 128 mempool cells in SQL > ("lookaside"), and > +-- until those 128 cells are filled in, the error cannot be > reproduced. Also, we > +-- have to get '' from somewhere because if we just enter it, it > will be of type > +-- STATIC and no memory will be allocated. > +-- > +local query = "NULLIF(SUBSTR('123', 1, 0), NULL)" > +for _ = 1, 7 do query = query..', '..query end > +query = "SELECT "..query..", NULLIF(SUBSTR('123', 1, 0), NULL);" > +-- The "query" variable contains 129 expressions. > +local result = {} > +for _ = 1, 129 do table.insert(result, '') end > + > +test:do_execsql_test("gh-6157", query, result) > + > +test:finish_test() > -- > 2.25.1