From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 669E36EC55; Fri, 27 Aug 2021 18:22:26 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 669E36EC55 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1630077746; bh=jXKI2AcMbouq9zVZd2h7GNEem6cWvoY35RzdCOsiry4=; h=Date:To:Cc:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=Q+oBKbAYuOoirrvIva4Jw4uHfgFyjlusFg/lZS74JRZ70NcGQ0nUH1ACHcD4p5ap/ WHtTX0QnmVhGwRgxM9JlM1IVP0bV7eVRazQCsKs3FJhustGa1BI0xb4mtesZGeSzGk fsh+rlZD43EZ7QtWp7gQZtV9Dsx96sfOP2QtSIPQ= Received: from smtpng2.i.mail.ru (smtpng2.i.mail.ru [94.100.179.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id AC9986EC55 for ; Fri, 27 Aug 2021 18:22:25 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org AC9986EC55 Received: by smtpng2.m.smailru.net with esmtpa (envelope-from ) id 1mJdgW-0005Gb-Sj; Fri, 27 Aug 2021 18:22:25 +0300 Date: Fri, 27 Aug 2021 18:22:23 +0300 To: Vladislav Shpilevoy Cc: tarantool-patches@dev.tarantool.org Message-ID: <20210827152223.GA435770@tarantool.org> References: <7c4620245d61624883115541490cd94d10626c00.1629976113.git.imeevma@gmail.com> <40a89d61-e252-731c-d419-6c162eecefb4@tarantool.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <40a89d61-e252-731c-d419-6c162eecefb4@tarantool.org> X-4EC0790: 10 X-7564579A: B8F34718100C35BD X-77F55803: 4F1203BC0FB41BD92087353F0EC44DD9ECFD080E047A606F6525B29142351271182A05F5380850402F6C6ED532C57E5CB582015D01EE75560C2B1F652D844DC88C15F50400C0E1FD X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7F544D30F1A6FA191EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637F08BD7C3AB07DC7F8638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D81EB5C58273BD0EF4DC3020463EA2AE31117882F4460429724CE54428C33FAD305F5C1EE8F4F765FCAA867293B0326636D2E47CDBA5A96583BD4B6F7A4D31EC0BC014FD901B82EE079FA2833FD35BB23D27C277FBC8AE2E8BF1175FABE1C0F9B6A471835C12D1D977C4224003CC8364762BB6847A3DEAEFB0F43C7A68FF6260569E8FC8737B5C2249EC8D19AE6D49635B68655334FD4449CB9ECD01F8117BC8BEAAAE862A0553A39223F8577A6DFFEA7CFA80D66F452D417A43847C11F186F3C59DAA53EE0834AAEE X-C1DE0DAB: 0D63561A33F958A5A50DDEAC0DABB1462D8D6680338C977B15B9CE0F093970D3D59269BC5F550898D99A6476B3ADF6B47008B74DF8BB9EF7333BD3B22AA88B938A852937E12ACA756665624D6DDF07B5410CA545F18667F91A7EA1CDA0B5A7A0 X-C8649E89: 4E36BF7865823D7055A7F0CF078B5EC49A30900B95165D34EB7BD66E9101C100F16B8CCFF91522452CBA801BC7D2BF2E17837212C72B071B5E77AC3F4652F6751D7E09C32AA3244CB1E1491DCAEC2E326762DF2E71BB700D1E098CBE561D6343729B2BEF169E0186 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2bioj+bzRAXO2P1SZmOATojvqbg== X-Mailru-Sender: 689FA8AB762F7393C37E3C1AEC41BA5DC35B21BD79F35870868EAFDB3B642D0683D72C36FC87018B9F80AB2734326CD2FB559BB5D741EB96352A0ABBE4FDA4210A04DAD6CC59E33667EA787935ED9F1B X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH v1 1/1] sql: fix error on copy empty string in mem_copy() X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Mergen Imeev via Tarantool-patches Reply-To: Mergen Imeev Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Thank you for the review! My answers and new patch below. I didn't include diff since I reworked most psrt of the patch. On Thu, Aug 26, 2021 at 10:21:01PM +0200, Vladislav Shpilevoy wrote: > Hi! Thanks for the patch! > > See 3 comments below. > > > diff --git a/test/sql-tap/gh-6157-unnecessary-free-on-string.c b/test/sql-tap/gh-6157-unnecessary-free-on-string.c > > new file mode 100644 > > index 000000000..ce928d494 > > --- /dev/null > > +++ b/test/sql-tap/gh-6157-unnecessary-free-on-string.c > > @@ -0,0 +1,10 @@ > > +#include "msgpuck.h" > > +#include "module.h" > > + > > +int > > +f(box_function_ctx_t* ctx, const char* args, const char* args_end) > > 1. '*' must be right before variable name, not after the types. > Dropped this funcion. > > +{ > > + char res[16]; > > + char *end = mp_encode_str(res, "stub", strlen("stub")); > > + return box_return_mp(ctx, res, end); > > +} > > 2. Why do you need a C function? Can't you reproduce it with Lua? > Dropped. > > diff --git a/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua > > new file mode 100755 > > index 000000000..326570aea > > --- /dev/null > > +++ b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua > > @@ -0,0 +1,38 @@ > > +#!/usr/bin/env tarantool > > +local build_path = os.getenv("BUILDDIR") > > +package.cpath = build_path..'/test/sql-tap/?.so;'..build_path..'/test/sql-tap/?.dylib;'..package.cpath > > + > > +local test = require("sqltester") > > +test:plan(1) > > + > > +box.schema.func.create("gh-6157.f", { > > + language = "C", > > + param_list = {"string"}, > > + returns = "string", > > + exports = {"SQL"} > > +}) > > + > > +box.execute([[CREATE TABLE ts(s STRING PRIMARY KEY);]]) > > +box.execute([[INSERT INTO ts VALUES ('');]]) > > +box.execute([[CREATE TABLE ti(i INT PRIMARY KEY);]]) > > +for i = 1, 100 do > > + box.execute([[INSERT INTO ti VALUES(]]..i..[[);]]) > > 3. Why do you need a space to reproduce this bug? It does not seem related. As I understood, there is two bugs: first - seems like lookaside is leaking, but not sure if this is a bug. Created a new issue - #6401. The second is the one fixed in this patch. I reworked this test and now it is a lot simpler. Also, I added checks for the result of mem_copy() since before we couldn't be sure where exactly these errors appear, since only part of mem_copy() was executed, but error was set improperly. New patch: commit c7e823516c5fdf91ff9b04fc3a0642e3ced9ad3e Author: Mergen Imeev Date: Mon Aug 23 11:54:09 2021 +0300 sql: fix error on copy empty string in mem_copy() This patch fixes the problem with copying an empty string in mem_copy(). Previously, because the string length was 0, an error was thrown, but the diag was not set, which could lead to an error due to an empty diag or to a double free. Closes #6157 diff --git a/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md b/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md new file mode 100644 index 000000000..e5f747414 --- /dev/null +++ b/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md @@ -0,0 +1,5 @@ +## bugfix/sql + +* Now, when copying an empty string, an error will not be set + unnecessarily (gh-6157). + diff --git a/src/box/sql/func.c b/src/box/sql/func.c index c063552d6..9009f9e4f 100644 --- a/src/box/sql/func.c +++ b/src/box/sql/func.c @@ -1771,13 +1771,15 @@ minmaxStep(sql_context * context, int NotUsed, sql_value ** argv) bool is_max = (func->flags & SQL_FUNC_MAX) != 0; int cmp = mem_cmp_scalar(pBest, pArg, pColl); if ((is_max && cmp < 0) || (!is_max && cmp > 0)) { - mem_copy(pBest, pArg); + if (mem_copy(pBest, pArg) != 0) + context->is_aborted = true; } else { sqlSkipAccumulatorLoad(context); } } else { pBest->db = sql_context_db_handle(context); - mem_copy(pBest, pArg); + if (mem_copy(pBest, pArg) != 0) + context->is_aborted = true; } } diff --git a/src/box/sql/mem.c b/src/box/sql/mem.c index 4c40f15dc..819d9b094 100644 --- a/src/box/sql/mem.c +++ b/src/box/sql/mem.c @@ -1913,7 +1913,8 @@ mem_copy(struct Mem *to, const struct Mem *from) assert((to->flags & MEM_Zero) == 0 || to->type == MEM_TYPE_BIN); if ((to->flags & MEM_Zero) != 0) return sqlVdbeMemExpandBlob(to); - to->zMalloc = sqlDbReallocOrFree(to->db, to->zMalloc, to->n); + to->zMalloc = sqlDbRealloc(to->db, to->zMalloc, MAX(32, to->n)); + assert(to->zMalloc != NULL || sql_get()->mallocFailed != 0); if (to->zMalloc == NULL) return -1; to->szMalloc = sqlDbMallocSize(to->db, to->zMalloc); diff --git a/src/box/sql/vdbe.c b/src/box/sql/vdbe.c index 7f86fa7b3..44533fb3e 100644 --- a/src/box/sql/vdbe.c +++ b/src/box/sql/vdbe.c @@ -978,7 +978,8 @@ case OP_Copy: { pOut = &aMem[pOp->p2]; assert(pOut!=pIn1); while( 1) { - mem_copy(pOut, pIn1); + if (mem_copy(pOut, pIn1) != 0) + goto abort_due_to_error; REGISTER_TRACE(p, pOp->p2+pOp->p3-n, pOut); if ((n--)==0) break; pOut++; diff --git a/src/box/sql/vdbeapi.c b/src/box/sql/vdbeapi.c index 8031ee0dc..e44d73a16 100644 --- a/src/box/sql/vdbeapi.c +++ b/src/box/sql/vdbeapi.c @@ -232,7 +232,8 @@ sql_result_text64(sql_context * pCtx, void sql_result_value(sql_context * pCtx, sql_value * pValue) { - mem_copy(pCtx->pOut, pValue); + if (mem_copy(pCtx->pOut, pValue) != 0) + pCtx->is_aborted = true; } void diff --git a/src/box/sql/vdbeaux.c b/src/box/sql/vdbeaux.c index 2d7800b17..beb8cee04 100644 --- a/src/box/sql/vdbeaux.c +++ b/src/box/sql/vdbeaux.c @@ -2318,8 +2318,12 @@ sqlVdbeGetBoundValue(struct Vdbe *v, int iVar) Mem *pMem = &v->aVar[iVar - 1]; if (!mem_is_null(pMem)) { sql_value *pRet = sqlValueNew(v->db); - if (pRet != NULL) - mem_copy(pRet, pMem); + if (pRet == NULL) + return NULL; + if (mem_copy(pRet, pMem) != 0) { + sqlDbFree(sql_get(), pRet); + return NULL; + } return pRet; } } diff --git a/test/sql-tap/engine.cfg b/test/sql-tap/engine.cfg index 587adbed9..c35d1dced 100644 --- a/test/sql-tap/engine.cfg +++ b/test/sql-tap/engine.cfg @@ -35,6 +35,7 @@ "built-in-functions.test.lua": { "memtx": {"engine": "memtx"} }, + "gh-6157-unnecessary-free-on-string.test.lua": {}, "gh-4077-iproto-execute-no-bind.test.lua": {}, "gh-6375-assert-on-unsupported-ext.test.lua": {}, "*": { diff --git a/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua new file mode 100755 index 000000000..e0c09a325 --- /dev/null +++ b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua @@ -0,0 +1,18 @@ +#!/usr/bin/env tarantool +local tap = require('tap') +local test = tap.test('test wrong error in mem_copy()') + +-- +-- Make sure there is no assert due to an incorrectly set error in mem_copy(). +-- How this test works: We have 128 mempool cells in SQL ("lookaside"), and +-- until those 128 cells are filled in, the error cannot be reproduced. Also, we +-- have to get '' from somewhere because if we just enter it, it will be of type +-- STATIC and no memory will be allocated. +-- +local s = "NULLIF(SUBSTR('123', 1, 0), NULL)" +for i = 1, 5 do s = s..', '..s end +local res = box.execute("SELECT "..s).rows[1] + +test:plan(1) +test:is(#res, 32, 'wrong error in mem_copy() was set') +os.exit(test:check() and 0 or 1)