MDEV-40495 KEY_OP_SHIFT redo moves data past the page buffer - #5540
Open
KhaledR57 wants to merge 1 commit into
Open
MDEV-40495 KEY_OP_SHIFT redo moves data past the page buffer#5540KhaledR57 wants to merge 1 commit into
KhaledR57 wants to merge 1 commit into
Conversation
The KEY_OP_SHIFT branch of _ma_apply_redo_index() took the shift length straight from the redo record and used it to form a bmove() source and size, and to update page_length. The only guards were DBUG_ASSERTs, which are compiled out when DBUG_OFF is set. A corrupt record with a negative length could therefore move data from outside the page and wrap page_length. Turn both asserts into runtime checks. The page offset must be set and inside the used page, the resulting page length must still fit the page, and for a negative shift the source must stay inside the used page too. The conditions are the ones the asserts already tested, so debug builds keep the same behaviour. This also fixes MDEV-40496, which covers the page_length side of the same branch. The first check bounds it. The test forges the logged shift length with two new debug keywords, corrupt_shift_down and corrupt_shift_up, then crashes the server so recovery has to replay the record.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
KEY_OP_SHIFTbranch of_ma_apply_redo_index()took the shift length straight from the redo record and used it to form abmove()source and size, and to updatepage_length. The only guards wereDBUG_ASSERTs, which are compiled out whenDBUG_OFFis set. A corrupt record with a negative length could therefore move data from outside the page and wrappage_length.Turn both asserts into runtime checks. The page offset must be set and inside the used page, the resulting page length must still fit the page, and for a negative shift the source must stay inside the used page too. The conditions are the ones the asserts already tested, so debug builds keep the same behaviour.
This also fixes MDEV-40496, which covers the
page_lengthside of the same branch. The first check bounds it.The test forges the logged shift length with two new debug keywords,
corrupt_shift_downandcorrupt_shift_up, then crashes the server so recovery has to replay the record.