Tarantool development patches archive
 help / color / mirror / Atom feed
* [Tarantool-patches] [PATCH v1 1/1] sql: fix error on copy empty string in mem_copy()
@ 2021-09-02  8:43 Mergen Imeev via Tarantool-patches
  2021-09-02  9:15 ` Timur Safin via Tarantool-patches
  2021-09-02  9:17 ` Timur Safin via Tarantool-patches
  0 siblings, 2 replies; 12+ messages in thread
From: Mergen Imeev via Tarantool-patches @ 2021-09-02  8:43 UTC (permalink / raw)
  To: tsafin; +Cc: tarantool-patches

This patch fixes the problem with copying an empty string in mem_copy().
Previously, because the string length was 0, an error was thrown, but
the diag was not set, which could lead to an error due to an empty diag
or to a double free.

Closes #6157
Closes #6399
---
https://github.com/tarantool/tarantool/issues/6157
https://github.com/tarantool/tarantool/issues/6399
https://github.com/tarantool/tarantool/tree/imeevma/gh-6157-fix-error-on-empty-str

 .../gh-6157-fix-error-on-copy-empty-str.md    |  4 ++++
 src/box/sql/func.c                            |  6 ++++--
 src/box/sql/mem.c                             |  3 ++-
 src/box/sql/vdbe.c                            |  3 ++-
 src/box/sql/vdbeapi.c                         |  3 ++-
 src/box/sql/vdbeaux.c                         |  8 +++++--
 test/sql-tap/engine.cfg                       |  1 +
 ...h-6157-unnecessary-free-on-string.test.lua | 21 +++++++++++++++++++
 8 files changed, 42 insertions(+), 7 deletions(-)
 create mode 100644 changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md
 create mode 100755 test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua

diff --git a/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md b/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md
new file mode 100644
index 000000000..398b6e31d
--- /dev/null
+++ b/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md
@@ -0,0 +1,4 @@
+## bugfix/sql
+
+* Now, when copying an empty string, an error will not be set
+  unnecessarily (gh-6157, gh-6399).
diff --git a/src/box/sql/func.c b/src/box/sql/func.c
index c063552d6..9009f9e4f 100644
--- a/src/box/sql/func.c
+++ b/src/box/sql/func.c
@@ -1771,13 +1771,15 @@ minmaxStep(sql_context * context, int NotUsed, sql_value ** argv)
 		bool is_max = (func->flags & SQL_FUNC_MAX) != 0;
 		int cmp = mem_cmp_scalar(pBest, pArg, pColl);
 		if ((is_max && cmp < 0) || (!is_max && cmp > 0)) {
-			mem_copy(pBest, pArg);
+			if (mem_copy(pBest, pArg) != 0)
+				context->is_aborted = true;
 		} else {
 			sqlSkipAccumulatorLoad(context);
 		}
 	} else {
 		pBest->db = sql_context_db_handle(context);
-		mem_copy(pBest, pArg);
+		if (mem_copy(pBest, pArg) != 0)
+			context->is_aborted = true;
 	}
 }
 
diff --git a/src/box/sql/mem.c b/src/box/sql/mem.c
index 24de26548..48755a017 100644
--- a/src/box/sql/mem.c
+++ b/src/box/sql/mem.c
@@ -1913,7 +1913,8 @@ mem_copy(struct Mem *to, const struct Mem *from)
 	assert((to->flags & MEM_Zero) == 0 || to->type == MEM_TYPE_BIN);
 	if ((to->flags & MEM_Zero) != 0)
 		return sqlVdbeMemExpandBlob(to);
-	to->zMalloc = sqlDbReallocOrFree(to->db, to->zMalloc, to->n);
+	to->zMalloc = sqlDbRealloc(to->db, to->zMalloc, MAX(32, to->n));
+	assert(to->zMalloc != NULL || sql_get()->mallocFailed != 0);
 	if (to->zMalloc == NULL)
 		return -1;
 	to->szMalloc = sqlDbMallocSize(to->db, to->zMalloc);
diff --git a/src/box/sql/vdbe.c b/src/box/sql/vdbe.c
index 7f86fa7b3..44533fb3e 100644
--- a/src/box/sql/vdbe.c
+++ b/src/box/sql/vdbe.c
@@ -978,7 +978,8 @@ case OP_Copy: {
 	pOut = &aMem[pOp->p2];
 	assert(pOut!=pIn1);
 	while( 1) {
-		mem_copy(pOut, pIn1);
+		if (mem_copy(pOut, pIn1) != 0)
+			goto abort_due_to_error;
 		REGISTER_TRACE(p, pOp->p2+pOp->p3-n, pOut);
 		if ((n--)==0) break;
 		pOut++;
diff --git a/src/box/sql/vdbeapi.c b/src/box/sql/vdbeapi.c
index 77df0e4cc..115940227 100644
--- a/src/box/sql/vdbeapi.c
+++ b/src/box/sql/vdbeapi.c
@@ -232,7 +232,8 @@ sql_result_text64(sql_context * pCtx,
 void
 sql_result_value(sql_context * pCtx, sql_value * pValue)
 {
-	mem_copy(pCtx->pOut, pValue);
+	if (mem_copy(pCtx->pOut, pValue) != 0)
+		pCtx->is_aborted = true;
 }
 
 void
diff --git a/src/box/sql/vdbeaux.c b/src/box/sql/vdbeaux.c
index 2d7800b17..8148ed8b0 100644
--- a/src/box/sql/vdbeaux.c
+++ b/src/box/sql/vdbeaux.c
@@ -2318,8 +2318,12 @@ sqlVdbeGetBoundValue(struct Vdbe *v, int iVar)
 		Mem *pMem = &v->aVar[iVar - 1];
 		if (!mem_is_null(pMem)) {
 			sql_value *pRet = sqlValueNew(v->db);
-			if (pRet != NULL)
-				mem_copy(pRet, pMem);
+			if (pRet == NULL)
+				return NULL;
+			if (mem_copy(pRet, pMem) != 0) {
+				sqlValueFree(pRet);
+				return NULL;
+			}
 			return pRet;
 		}
 	}
diff --git a/test/sql-tap/engine.cfg b/test/sql-tap/engine.cfg
index 587adbed9..c35d1dced 100644
--- a/test/sql-tap/engine.cfg
+++ b/test/sql-tap/engine.cfg
@@ -35,6 +35,7 @@
     "built-in-functions.test.lua": {
         "memtx": {"engine": "memtx"}
     },
+    "gh-6157-unnecessary-free-on-string.test.lua": {},
     "gh-4077-iproto-execute-no-bind.test.lua": {},
     "gh-6375-assert-on-unsupported-ext.test.lua": {},
     "*": {
diff --git a/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua
new file mode 100755
index 000000000..ebe69906a
--- /dev/null
+++ b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua
@@ -0,0 +1,21 @@
+#!/usr/bin/env tarantool
+local test = require("sqltester")
+test:plan(1)
+
+--
+-- Make sure there is no assert due to an incorrectly set error in mem_copy().
+-- How this test works: We have 128 mempool cells in SQL ("lookaside"), and
+-- until those 128 cells are filled in, the error cannot be reproduced. Also, we
+-- have to get '' from somewhere because if we just enter it, it will be of type
+-- STATIC and no memory will be allocated.
+--
+local query = "NULLIF(SUBSTR('123', 1, 0), NULL)"
+for _ = 1, 7 do query = query..', '..query end
+query = "SELECT "..query..", NULLIF(SUBSTR('123', 1, 0), NULL);"
+-- The "query" variable contains 129 expressions.
+local result = {}
+for _ = 1, 129 do table.insert(result, '') end
+
+test:do_execsql_test("gh-6157", query, result)
+
+test:finish_test()
-- 
2.25.1


^ permalink raw reply	[flat|nested] 12+ messages in thread
* [Tarantool-patches] [PATCH v1 1/1] sql: fix error on copy empty string in mem_copy()
@ 2021-08-26 11:09 Mergen Imeev via Tarantool-patches
  2021-08-26 20:21 ` Vladislav Shpilevoy via Tarantool-patches
  0 siblings, 1 reply; 12+ messages in thread
From: Mergen Imeev via Tarantool-patches @ 2021-08-26 11:09 UTC (permalink / raw)
  To: v.shpilevoy; +Cc: tarantool-patches

This patch fixes the problem with copying an empty string in mem_copy().
Previously, because the string length was 0, an error was thrown, but
the diag was not set, which could lead to an error due to an empty diag
or to a double free.

Closes #6157
---
https://github.com/tarantool/tarantool/issues/6157
https://github.com/tarantool/tarantool/tree/imeevma/gh-6157-fix-error-on-empty-str

 .../gh-6157-fix-error-on-copy-empty-str.md    |  5 +++
 src/box/sql/mem.c                             |  3 +-
 test/sql-tap/CMakeLists.txt                   |  1 +
 test/sql-tap/engine.cfg                       |  1 +
 .../gh-6157-unnecessary-free-on-string.c      | 10 +++++
 ...h-6157-unnecessary-free-on-string.test.lua | 38 +++++++++++++++++++
 6 files changed, 57 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md
 create mode 100644 test/sql-tap/gh-6157-unnecessary-free-on-string.c
 create mode 100755 test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua

diff --git a/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md b/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md
new file mode 100644
index 000000000..e5f747414
--- /dev/null
+++ b/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md
@@ -0,0 +1,5 @@
+## bugfix/sql
+
+* Now, when copying an empty string, an error will not be set
+  unnecessarily (gh-6157).
+
diff --git a/src/box/sql/mem.c b/src/box/sql/mem.c
index 0aca76112..c91fc8396 100644
--- a/src/box/sql/mem.c
+++ b/src/box/sql/mem.c
@@ -1913,7 +1913,8 @@ mem_copy(struct Mem *to, const struct Mem *from)
 	assert((to->flags & MEM_Zero) == 0 || to->type == MEM_TYPE_BIN);
 	if ((to->flags & MEM_Zero) != 0)
 		return sqlVdbeMemExpandBlob(to);
-	to->zMalloc = sqlDbReallocOrFree(to->db, to->zMalloc, to->n);
+	to->zMalloc = sqlDbRealloc(to->db, to->zMalloc, MAX(32, to->n));
+	assert(to->zMalloc != NULL || sql_get()->mallocFailed != 0);
 	if (to->zMalloc == NULL)
 		return -1;
 	to->szMalloc = sqlDbMallocSize(to->db, to->zMalloc);
diff --git a/test/sql-tap/CMakeLists.txt b/test/sql-tap/CMakeLists.txt
index 87f23b2f7..2e215032b 100644
--- a/test/sql-tap/CMakeLists.txt
+++ b/test/sql-tap/CMakeLists.txt
@@ -3,3 +3,4 @@ build_module(gh-5938-wrong-string-length gh-5938-wrong-string-length.c)
 build_module(gh-6024-funcs-return-bin gh-6024-funcs-return-bin.c)
 build_module(sql_uuid sql_uuid.c)
 build_module(decimal decimal.c)
+build_module(gh-6157 gh-6157-unnecessary-free-on-string.c)
diff --git a/test/sql-tap/engine.cfg b/test/sql-tap/engine.cfg
index 35754f769..f6f7752af 100644
--- a/test/sql-tap/engine.cfg
+++ b/test/sql-tap/engine.cfg
@@ -35,6 +35,7 @@
     "built-in-functions.test.lua": {
         "memtx": {"engine": "memtx"}
     },
+    "gh-6157-unnecessary-free-on-string.test.lua": {},
     "gh-4077-iproto-execute-no-bind.test.lua": {},
     "*": {
         "memtx": {"engine": "memtx"},
diff --git a/test/sql-tap/gh-6157-unnecessary-free-on-string.c b/test/sql-tap/gh-6157-unnecessary-free-on-string.c
new file mode 100644
index 000000000..ce928d494
--- /dev/null
+++ b/test/sql-tap/gh-6157-unnecessary-free-on-string.c
@@ -0,0 +1,10 @@
+#include "msgpuck.h"
+#include "module.h"
+
+int
+f(box_function_ctx_t* ctx, const char* args, const char* args_end)
+{
+	char res[16];
+	char *end = mp_encode_str(res, "stub", strlen("stub"));
+	return box_return_mp(ctx, res, end);
+}
diff --git a/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua
new file mode 100755
index 000000000..326570aea
--- /dev/null
+++ b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua
@@ -0,0 +1,38 @@
+#!/usr/bin/env tarantool
+local build_path = os.getenv("BUILDDIR")
+package.cpath = build_path..'/test/sql-tap/?.so;'..build_path..'/test/sql-tap/?.dylib;'..package.cpath
+
+local test = require("sqltester")
+test:plan(1)
+
+box.schema.func.create("gh-6157.f", {
+    language = "C",
+    param_list = {"string"},
+    returns = "string",
+    exports = {"SQL"}
+})
+
+box.execute([[CREATE TABLE ts(s STRING PRIMARY KEY);]])
+box.execute([[INSERT INTO ts VALUES ('');]])
+box.execute([[CREATE TABLE ti(i INT PRIMARY KEY);]])
+for i = 1, 100 do
+    box.execute([[INSERT INTO ti VALUES(]]..i..[[);]])
+end
+
+test:do_execsql_test(
+    "gh-6157",
+    [[
+        SELECT COUNT("gh-6157.f"('')), (SELECT s FROM ts WHERE s = '') FROM ti;
+        SELECT COUNT("gh-6157.f"('')), (SELECT s FROM ts WHERE s = '') FROM ti;
+        SELECT COUNT("gh-6157.f"('')), (SELECT s FROM ts WHERE s = '') FROM ti;
+        SELECT COUNT("gh-6157.f"('')), (SELECT s FROM ts WHERE s = '') FROM ti;
+        SELECT COUNT("gh-6157.f"('')), (SELECT s FROM ts WHERE s = '') FROM ti;
+    ]], {
+        100, ""
+    })
+
+box.space._func.index['name']:delete("gh-6157.f")
+box.execute([[DROP TABLE ts;]])
+box.execute([[DROP TABLE ti;]])
+
+test:finish_test()
-- 
2.25.1


^ permalink raw reply	[flat|nested] 12+ messages in thread

end of thread, other threads:[~2021-09-02  9:35 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-02  8:43 [Tarantool-patches] [PATCH v1 1/1] sql: fix error on copy empty string in mem_copy() Mergen Imeev via Tarantool-patches
2021-09-02  9:15 ` Timur Safin via Tarantool-patches
2021-09-02  9:35   ` Mergen Imeev via Tarantool-patches
2021-09-02  9:17 ` Timur Safin via Tarantool-patches
  -- strict thread matches above, loose matches on Subject: below --
2021-08-26 11:09 Mergen Imeev via Tarantool-patches
2021-08-26 20:21 ` Vladislav Shpilevoy via Tarantool-patches
2021-08-27 15:22   ` Mergen Imeev via Tarantool-patches
2021-08-27 21:44     ` Vladislav Shpilevoy via Tarantool-patches
2021-08-30  5:57       ` Mergen Imeev via Tarantool-patches
2021-08-30 21:32         ` Vladislav Shpilevoy via Tarantool-patches
2021-08-31  8:55           ` Mergen Imeev via Tarantool-patches
2021-09-01 21:34             ` Vladislav Shpilevoy via Tarantool-patches

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox