From: Vladislav Shpilevoy via Tarantool-patches <tarantool-patches@dev.tarantool.org> To: Mergen Imeev <imeevma@tarantool.org> Cc: tarantool-patches@dev.tarantool.org Subject: Re: [Tarantool-patches] [PATCH v1 1/1] sql: fix error on copy empty string in mem_copy() Date: Fri, 27 Aug 2021 23:44:23 +0200 [thread overview] Message-ID: <491db4a6-2fa4-8346-c22f-0924630f7e55@tarantool.org> (raw) In-Reply-To: <20210827152223.GA435770@tarantool.org> Thanks for the fixes! See 3 comments below. > sql: fix error on copy empty string in mem_copy() > > This patch fixes the problem with copying an empty string in mem_copy(). > Previously, because the string length was 0, an error was thrown, but > the diag was not set, which could lead to an error due to an empty diag > or to a double free. > > Closes #6157 1. You also need to add closes 6399, don't you? > diff --git a/src/box/sql/vdbeaux.c b/src/box/sql/vdbeaux.c > index 2d7800b17..beb8cee04 100644 > --- a/src/box/sql/vdbeaux.c > +++ b/src/box/sql/vdbeaux.c > @@ -2318,8 +2318,12 @@ sqlVdbeGetBoundValue(struct Vdbe *v, int iVar) > Mem *pMem = &v->aVar[iVar - 1]; > if (!mem_is_null(pMem)) { > sql_value *pRet = sqlValueNew(v->db); > - if (pRet != NULL) > - mem_copy(pRet, pMem); > + if (pRet == NULL) > + return NULL; > + if (mem_copy(pRet, pMem) != 0) { > + sqlDbFree(sql_get(), pRet); 2. Shouldn't you use sqlValueFree()? > + return NULL; > + } > return pRet; > } > } > diff --git a/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua > new file mode 100755 > index 000000000..e0c09a325 > --- /dev/null > +++ b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua > @@ -0,0 +1,18 @@ > +#!/usr/bin/env tarantool > +local tap = require('tap') > +local test = tap.test('test wrong error in mem_copy()') > + > +-- > +-- Make sure there is no assert due to an incorrectly set error in mem_copy(). > +-- How this test works: We have 128 mempool cells in SQL ("lookaside"), and > +-- until those 128 cells are filled in, the error cannot be reproduced. Also, we > +-- have to get '' from somewhere because if we just enter it, it will be of type > +-- STATIC and no memory will be allocated. 3. You mention 128 cells, but I don't see how 128 or something close is used in this test. > +-- > +local s = "NULLIF(SUBSTR('123', 1, 0), NULL)" > +for i = 1, 5 do s = s..', '..s end > +local res = box.execute("SELECT "..s).rows[1] > + > +test:plan(1) > +test:is(#res, 32, 'wrong error in mem_copy() was set') > +os.exit(test:check() and 0 or 1)
next prev parent reply other threads:[~2021-08-27 21:44 UTC|newest] Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-08-26 11:09 Mergen Imeev via Tarantool-patches 2021-08-26 20:21 ` Vladislav Shpilevoy via Tarantool-patches 2021-08-27 15:22 ` Mergen Imeev via Tarantool-patches 2021-08-27 21:44 ` Vladislav Shpilevoy via Tarantool-patches [this message] 2021-08-30 5:57 ` Mergen Imeev via Tarantool-patches 2021-08-30 21:32 ` Vladislav Shpilevoy via Tarantool-patches 2021-08-31 8:55 ` Mergen Imeev via Tarantool-patches 2021-09-01 21:34 ` Vladislav Shpilevoy via Tarantool-patches 2021-09-02 8:43 Mergen Imeev via Tarantool-patches 2021-09-02 9:15 ` Timur Safin via Tarantool-patches 2021-09-02 9:35 ` Mergen Imeev via Tarantool-patches 2021-09-02 9:17 ` Timur Safin via Tarantool-patches
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=491db4a6-2fa4-8346-c22f-0924630f7e55@tarantool.org \ --to=tarantool-patches@dev.tarantool.org \ --cc=imeevma@tarantool.org \ --cc=v.shpilevoy@tarantool.org \ --subject='Re: [Tarantool-patches] [PATCH v1 1/1] sql: fix error on copy empty string in mem_copy()' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox