[Tarantool-patches] [PATCH v1 1/1] sql: fix error on copy empty string in mem_copy()

[Mergen Imeev via Tarantool-patches <tarantool-patches@dev.tarantool.org>]

This patch fixes the problem with copying an empty string in mem_copy().
Previously, because the string length was 0, an error was thrown, but
the diag was not set, which could lead to an error due to an empty diag
or to a double free.

Closes #6157
---
https://github.com/tarantool/tarantool/issues/6157
https://github.com/tarantool/tarantool/tree/imeevma/gh-6157-fix-error-on-empty-str

 .../gh-6157-fix-error-on-copy-empty-str.md    |  5 +++
 src/box/sql/mem.c                             |  3 +-
 test/sql-tap/CMakeLists.txt                   |  1 +
 test/sql-tap/engine.cfg                       |  1 +
 .../gh-6157-unnecessary-free-on-string.c      | 10 +++++
 ...h-6157-unnecessary-free-on-string.test.lua | 38 +++++++++++++++++++
 6 files changed, 57 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md
 create mode 100644 test/sql-tap/gh-6157-unnecessary-free-on-string.c
 create mode 100755 test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua

diff --git a/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md b/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md
new file mode 100644
index 000000000..e5f747414
--- /dev/null
+++ b/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md
@@ -0,0 +1,5 @@
+## bugfix/sql
+
+* Now, when copying an empty string, an error will not be set
+  unnecessarily (gh-6157).
+
diff --git a/src/box/sql/mem.c b/src/box/sql/mem.c
index 0aca76112..c91fc8396 100644
--- a/src/box/sql/mem.c
+++ b/src/box/sql/mem.c
@@ -1913,7 +1913,8 @@ mem_copy(struct Mem *to, const struct Mem *from)
 	assert((to->flags & MEM_Zero) == 0 || to->type == MEM_TYPE_BIN);
 	if ((to->flags & MEM_Zero) != 0)
 		return sqlVdbeMemExpandBlob(to);
-	to->zMalloc = sqlDbReallocOrFree(to->db, to->zMalloc, to->n);
+	to->zMalloc = sqlDbRealloc(to->db, to->zMalloc, MAX(32, to->n));
+	assert(to->zMalloc != NULL || sql_get()->mallocFailed != 0);
 	if (to->zMalloc == NULL)
 		return -1;
 	to->szMalloc = sqlDbMallocSize(to->db, to->zMalloc);
diff --git a/test/sql-tap/CMakeLists.txt b/test/sql-tap/CMakeLists.txt
index 87f23b2f7..2e215032b 100644
--- a/test/sql-tap/CMakeLists.txt
+++ b/test/sql-tap/CMakeLists.txt
@@ -3,3 +3,4 @@ build_module(gh-5938-wrong-string-length gh-5938-wrong-string-length.c)
 build_module(gh-6024-funcs-return-bin gh-6024-funcs-return-bin.c)
 build_module(sql_uuid sql_uuid.c)
 build_module(decimal decimal.c)
+build_module(gh-6157 gh-6157-unnecessary-free-on-string.c)
diff --git a/test/sql-tap/engine.cfg b/test/sql-tap/engine.cfg
index 35754f769..f6f7752af 100644
--- a/test/sql-tap/engine.cfg
+++ b/test/sql-tap/engine.cfg
@@ -35,6 +35,7 @@
     "built-in-functions.test.lua": {
         "memtx": {"engine": "memtx"}
     },
+    "gh-6157-unnecessary-free-on-string.test.lua": {},
     "gh-4077-iproto-execute-no-bind.test.lua": {},
     "*": {
         "memtx": {"engine": "memtx"},
diff --git a/test/sql-tap/gh-6157-unnecessary-free-on-string.c b/test/sql-tap/gh-6157-unnecessary-free-on-string.c
new file mode 100644
index 000000000..ce928d494
--- /dev/null
+++ b/test/sql-tap/gh-6157-unnecessary-free-on-string.c
@@ -0,0 +1,10 @@
+#include "msgpuck.h"
+#include "module.h"
+
+int
+f(box_function_ctx_t* ctx, const char* args, const char* args_end)
+{
+	char res[16];
+	char *end = mp_encode_str(res, "stub", strlen("stub"));
+	return box_return_mp(ctx, res, end);
+}
diff --git a/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua
new file mode 100755
index 000000000..326570aea
--- /dev/null
+++ b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua
@@ -0,0 +1,38 @@
+#!/usr/bin/env tarantool
+local build_path = os.getenv("BUILDDIR")
+package.cpath = build_path..'/test/sql-tap/?.so;'..build_path..'/test/sql-tap/?.dylib;'..package.cpath
+
+local test = require("sqltester")
+test:plan(1)
+
+box.schema.func.create("gh-6157.f", {
+    language = "C",
+    param_list = {"string"},
+    returns = "string",
+    exports = {"SQL"}
+})
+
+box.execute([[CREATE TABLE ts(s STRING PRIMARY KEY);]])
+box.execute([[INSERT INTO ts VALUES ('');]])
+box.execute([[CREATE TABLE ti(i INT PRIMARY KEY);]])
+for i = 1, 100 do
+    box.execute([[INSERT INTO ti VALUES(]]..i..[[);]])
+end
+
+test:do_execsql_test(
+    "gh-6157",
+    [[
+        SELECT COUNT("gh-6157.f"('')), (SELECT s FROM ts WHERE s = '') FROM ti;
+        SELECT COUNT("gh-6157.f"('')), (SELECT s FROM ts WHERE s = '') FROM ti;
+        SELECT COUNT("gh-6157.f"('')), (SELECT s FROM ts WHERE s = '') FROM ti;
+        SELECT COUNT("gh-6157.f"('')), (SELECT s FROM ts WHERE s = '') FROM ti;
+        SELECT COUNT("gh-6157.f"('')), (SELECT s FROM ts WHERE s = '') FROM ti;
+    ]], {
+        100, ""
+    })
+
+box.space._func.index['name']:delete("gh-6157.f")
+box.execute([[DROP TABLE ts;]])
+box.execute([[DROP TABLE ti;]])
+
+test:finish_test()
-- 
2.25.1