-
Arun Kuruvila authored
SHOW_ROUTINE_GRANTS | SQL/SQL_ACL.CC:6873 Description:- Renaming the "mysql.procs_priv" table and executing SHOW GRANTS results in a server crash. Analysis:- After renaming the "mysql.procs_priv" table, even though FLUSH PRIVILEGES will throw an error "ERROR 1146 (42S02): Table 'mysql.procs_priv' doesn't exist", "grant_reload_procs_priv()" is not freeing the existing "proc_priv_hash" and "func_priv_hash" structures. This results in a server crash while executing SHOW GRANTS. The server crash is due to the invalid memory access in "mysql_show_grants()", which occurs because of the freeing of MEM_ROOT in "grant_reload()" as a part of loading the "table_priv" and "columns_priv" structures. Due to this, "mysql_show_grants()" is unable to use old values. Fix:- In "grant_reload_procs_priv()", "proc_priv_hash" and "func_priv_hash" structure are freed if open_and_lock_tables()" fails for 'mysql.procs_priv' table". This same behaviour is done for "mysql.user", "mysql.db", "mysql.proxies_priv", "mysql.tables_priv" and "mysql.columns_priv" tables. If "open_and_lock_tables()" fails for any of these tables, then the correspoding structures are freed.
Arun Kuruvila authoredSHOW_ROUTINE_GRANTS | SQL/SQL_ACL.CC:6873 Description:- Renaming the "mysql.procs_priv" table and executing SHOW GRANTS results in a server crash. Analysis:- After renaming the "mysql.procs_priv" table, even though FLUSH PRIVILEGES will throw an error "ERROR 1146 (42S02): Table 'mysql.procs_priv' doesn't exist", "grant_reload_procs_priv()" is not freeing the existing "proc_priv_hash" and "func_priv_hash" structures. This results in a server crash while executing SHOW GRANTS. The server crash is due to the invalid memory access in "mysql_show_grants()", which occurs because of the freeing of MEM_ROOT in "grant_reload()" as a part of loading the "table_priv" and "columns_priv" structures. Due to this, "mysql_show_grants()" is unable to use old values. Fix:- In "grant_reload_procs_priv()", "proc_priv_hash" and "func_priv_hash" structure are freed if open_and_lock_tables()" fails for 'mysql.procs_priv' table". This same behaviour is done for "mysql.user", "mysql.db", "mysql.proxies_priv", "mysql.tables_priv" and "mysql.columns_priv" tables. If "open_and_lock_tables()" fails for any of these tables, then the correspoding structures are freed.
Loading