From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 7C8846EC5A; Thu, 2 Sep 2021 11:43:23 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 7C8846EC5A DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1630572203; bh=QTF9VSt8W4s/DCCV8Tw5ILnbpkadqppTNDgEExPuyc8=; h=To:Cc:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:From:Reply-To:From; b=u245kLTLQqZ5bd0oxZy7cIK6jtvPhP/EMbyRpcNqpi0Jljmwyp38tBuuQM0ZofSWD IHNFsqxQr1MrqaDlIQGFV/MhW0pRu7sR6B5yhyBk7hm35uNdzIuqIASS8Wbg5984lc eEuEHTQdl7uYpRh6a+j6bCMBzRTllNTFJu25NZEY= Received: from smtpng1.i.mail.ru (smtpng1.i.mail.ru [94.100.181.251]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 05EDC6EC5A for ; Thu, 2 Sep 2021 11:43:21 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 05EDC6EC5A Received: by smtpng1.m.smailru.net with esmtpa (envelope-from ) id 1mLiJd-0002qY-0y; Thu, 02 Sep 2021 11:43:21 +0300 To: tsafin@tarantool.org Cc: tarantool-patches@dev.tarantool.org Date: Thu, 2 Sep 2021 11:43:20 +0300 Message-Id: <9beadd2600ef349c5bf5142716784526423b317c.1630572128.git.imeevma@gmail.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-7564579A: B8F34718100C35BD X-77F55803: 4F1203BC0FB41BD9EE8D69D3379D80C42C45AB5CDE5BA0670AA85DEB9A5394EF182A05F538085040C1F544DC466009ACA0F1F885443FC41ED5BCD4C52FD137046AA1AF1CBB3004A3 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE75B37E0A1C175363BEA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F790063770BCEBC9193A33448638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D81AD3D8D0245EC5EF47276532EDDFB59D117882F4460429724CE54428C33FAD305F5C1EE8F4F765FC2EE5AD8F952D28FBA471835C12D1D9774AD6D5ED66289B52BA9C0B312567BB23117882F44604297287769387670735201E561CDFBCA1751FC26CFBAC0749D213D2E47CDBA5A96583BA9C0B312567BB231DD303D21008E29813377AFFFEAFD269A417C69337E82CC2E827F84554CEF50127C277FBC8AE2E8BA83251EDC214901ED5E8D9A59859A8B66F6A3E018CF4DC80089D37D7C0E48F6C5571747095F342E88FB05168BE4CE3AF X-C1DE0DAB: C20DE7B7AB408E4181F030C43753B8186998911F362727C414F749A5E30D975C416511BB2D3FAED23ACC01F036CEF71A574728AC5DD74C549C2B6934AE262D3EE7EAB7254005DCEDD39702B95798B1671E0A4E2319210D9B64D260DF9561598F01A9E91200F654B06CE7B4E551862B828E8E86DC7131B365E7726E8460B7C23C X-C8649E89: 4E36BF7865823D7055A7F0CF078B5EC49A30900B95165D3455AC8BF8E3153BA06589B7E5360285CECE833FB80C413AF37A082DEC6A71649E2430AE3A7A9AFED81D7E09C32AA3244C2B0738115510553C96CDF50A6A148439D08D48398F32B4A6729B2BEF169E0186 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojK/h3ZnmlPjHcFp9/GDui0g== X-Mailru-Sender: 689FA8AB762F7393C37E3C1AEC41BA5DCE1CE866D7F943E4DDD96E6C4771123C83D72C36FC87018B9F80AB2734326CD2FB559BB5D741EB96352A0ABBE4FDA4210A04DAD6CC59E33667EA787935ED9F1B X-Mras: Ok Subject: [Tarantool-patches] [PATCH v1 1/1] sql: fix error on copy empty string in mem_copy() X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Mergen Imeev via Tarantool-patches Reply-To: imeevma@tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" This patch fixes the problem with copying an empty string in mem_copy(). Previously, because the string length was 0, an error was thrown, but the diag was not set, which could lead to an error due to an empty diag or to a double free. Closes #6157 Closes #6399 --- https://github.com/tarantool/tarantool/issues/6157 https://github.com/tarantool/tarantool/issues/6399 https://github.com/tarantool/tarantool/tree/imeevma/gh-6157-fix-error-on-empty-str .../gh-6157-fix-error-on-copy-empty-str.md | 4 ++++ src/box/sql/func.c | 6 ++++-- src/box/sql/mem.c | 3 ++- src/box/sql/vdbe.c | 3 ++- src/box/sql/vdbeapi.c | 3 ++- src/box/sql/vdbeaux.c | 8 +++++-- test/sql-tap/engine.cfg | 1 + ...h-6157-unnecessary-free-on-string.test.lua | 21 +++++++++++++++++++ 8 files changed, 42 insertions(+), 7 deletions(-) create mode 100644 changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md create mode 100755 test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua diff --git a/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md b/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md new file mode 100644 index 000000000..398b6e31d --- /dev/null +++ b/changelogs/unreleased/gh-6157-fix-error-on-copy-empty-str.md @@ -0,0 +1,4 @@ +## bugfix/sql + +* Now, when copying an empty string, an error will not be set + unnecessarily (gh-6157, gh-6399). diff --git a/src/box/sql/func.c b/src/box/sql/func.c index c063552d6..9009f9e4f 100644 --- a/src/box/sql/func.c +++ b/src/box/sql/func.c @@ -1771,13 +1771,15 @@ minmaxStep(sql_context * context, int NotUsed, sql_value ** argv) bool is_max = (func->flags & SQL_FUNC_MAX) != 0; int cmp = mem_cmp_scalar(pBest, pArg, pColl); if ((is_max && cmp < 0) || (!is_max && cmp > 0)) { - mem_copy(pBest, pArg); + if (mem_copy(pBest, pArg) != 0) + context->is_aborted = true; } else { sqlSkipAccumulatorLoad(context); } } else { pBest->db = sql_context_db_handle(context); - mem_copy(pBest, pArg); + if (mem_copy(pBest, pArg) != 0) + context->is_aborted = true; } } diff --git a/src/box/sql/mem.c b/src/box/sql/mem.c index 24de26548..48755a017 100644 --- a/src/box/sql/mem.c +++ b/src/box/sql/mem.c @@ -1913,7 +1913,8 @@ mem_copy(struct Mem *to, const struct Mem *from) assert((to->flags & MEM_Zero) == 0 || to->type == MEM_TYPE_BIN); if ((to->flags & MEM_Zero) != 0) return sqlVdbeMemExpandBlob(to); - to->zMalloc = sqlDbReallocOrFree(to->db, to->zMalloc, to->n); + to->zMalloc = sqlDbRealloc(to->db, to->zMalloc, MAX(32, to->n)); + assert(to->zMalloc != NULL || sql_get()->mallocFailed != 0); if (to->zMalloc == NULL) return -1; to->szMalloc = sqlDbMallocSize(to->db, to->zMalloc); diff --git a/src/box/sql/vdbe.c b/src/box/sql/vdbe.c index 7f86fa7b3..44533fb3e 100644 --- a/src/box/sql/vdbe.c +++ b/src/box/sql/vdbe.c @@ -978,7 +978,8 @@ case OP_Copy: { pOut = &aMem[pOp->p2]; assert(pOut!=pIn1); while( 1) { - mem_copy(pOut, pIn1); + if (mem_copy(pOut, pIn1) != 0) + goto abort_due_to_error; REGISTER_TRACE(p, pOp->p2+pOp->p3-n, pOut); if ((n--)==0) break; pOut++; diff --git a/src/box/sql/vdbeapi.c b/src/box/sql/vdbeapi.c index 77df0e4cc..115940227 100644 --- a/src/box/sql/vdbeapi.c +++ b/src/box/sql/vdbeapi.c @@ -232,7 +232,8 @@ sql_result_text64(sql_context * pCtx, void sql_result_value(sql_context * pCtx, sql_value * pValue) { - mem_copy(pCtx->pOut, pValue); + if (mem_copy(pCtx->pOut, pValue) != 0) + pCtx->is_aborted = true; } void diff --git a/src/box/sql/vdbeaux.c b/src/box/sql/vdbeaux.c index 2d7800b17..8148ed8b0 100644 --- a/src/box/sql/vdbeaux.c +++ b/src/box/sql/vdbeaux.c @@ -2318,8 +2318,12 @@ sqlVdbeGetBoundValue(struct Vdbe *v, int iVar) Mem *pMem = &v->aVar[iVar - 1]; if (!mem_is_null(pMem)) { sql_value *pRet = sqlValueNew(v->db); - if (pRet != NULL) - mem_copy(pRet, pMem); + if (pRet == NULL) + return NULL; + if (mem_copy(pRet, pMem) != 0) { + sqlValueFree(pRet); + return NULL; + } return pRet; } } diff --git a/test/sql-tap/engine.cfg b/test/sql-tap/engine.cfg index 587adbed9..c35d1dced 100644 --- a/test/sql-tap/engine.cfg +++ b/test/sql-tap/engine.cfg @@ -35,6 +35,7 @@ "built-in-functions.test.lua": { "memtx": {"engine": "memtx"} }, + "gh-6157-unnecessary-free-on-string.test.lua": {}, "gh-4077-iproto-execute-no-bind.test.lua": {}, "gh-6375-assert-on-unsupported-ext.test.lua": {}, "*": { diff --git a/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua new file mode 100755 index 000000000..ebe69906a --- /dev/null +++ b/test/sql-tap/gh-6157-unnecessary-free-on-string.test.lua @@ -0,0 +1,21 @@ +#!/usr/bin/env tarantool +local test = require("sqltester") +test:plan(1) + +-- +-- Make sure there is no assert due to an incorrectly set error in mem_copy(). +-- How this test works: We have 128 mempool cells in SQL ("lookaside"), and +-- until those 128 cells are filled in, the error cannot be reproduced. Also, we +-- have to get '' from somewhere because if we just enter it, it will be of type +-- STATIC and no memory will be allocated. +-- +local query = "NULLIF(SUBSTR('123', 1, 0), NULL)" +for _ = 1, 7 do query = query..', '..query end +query = "SELECT "..query..", NULLIF(SUBSTR('123', 1, 0), NULL);" +-- The "query" variable contains 129 expressions. +local result = {} +for _ = 1, 129 do table.insert(result, '') end + +test:do_execsql_test("gh-6157", query, result) + +test:finish_test() -- 2.25.1