Skip to content
  • Joao Gramacho's avatar
    72f463ef
    Bug#22109863 BINLOG_SENDER::READ_EVENT MAY ACCESS FREED EVENT BUFFER · 72f463ef
    Joao Gramacho authored
    Problem:
    
    It was reported an intermittent ASan error on rpl.rpl_checksum_cache.
    
    The error informed that the binlog sender did a heap-use-after-free on
    a given memory address.
    
    Analysis:
    
    The binlog sender read_event function will read an event from the
    binary log an will return, among other things, a pointer to a buffer
    containing the event.
    
    The read_event function will pre-allocate the space needed to read an
    event from the binary log to memory by calling reset_transmit_packet
    function.
    
    Then, it sets the pointer of the buffer that will contain the event to
    be returned to the caller.
    
    After setting the pointer, it calls Log_event::read_log_event function,
    that might change the buffer size (replacing its pointer) if needed.
    
    This is happening sometimes because of the need of memory alignment of
    the buffer.
    
    When read_log_event replaced the buffer, the previously pointer set
    became invalid, and that is the error ASan is getting.
    
    Fix:
    
    Moved the event pointer attribution to a safer place.
    
    Fixed a condition at grow_packet to avoid a packet to be resized when
    calling read_log_event.
    
    Fixed also an synchronization issue in the test case itself.
    72f463ef
    Bug#22109863 BINLOG_SENDER::READ_EVENT MAY ACCESS FREED EVENT BUFFER
    Joao Gramacho authored
    Problem:
    
    It was reported an intermittent ASan error on rpl.rpl_checksum_cache.
    
    The error informed that the binlog sender did a heap-use-after-free on
    a given memory address.
    
    Analysis:
    
    The binlog sender read_event function will read an event from the
    binary log an will return, among other things, a pointer to a buffer
    containing the event.
    
    The read_event function will pre-allocate the space needed to read an
    event from the binary log to memory by calling reset_transmit_packet
    function.
    
    Then, it sets the pointer of the buffer that will contain the event to
    be returned to the caller.
    
    After setting the pointer, it calls Log_event::read_log_event function,
    that might change the buffer size (replacing its pointer) if needed.
    
    This is happening sometimes because of the need of memory alignment of
    the buffer.
    
    When read_log_event replaced the buffer, the previously pointer set
    became invalid, and that is the error ASan is getting.
    
    Fix:
    
    Moved the event pointer attribution to a safer place.
    
    Fixed a condition at grow_packet to avoid a packet to be resized when
    calling read_log_event.
    
    Fixed also an synchronization issue in the test case itself.
Loading