diff options
| author | Jan Lindström <jan.lindstrom@mariadb.com> | 2020-08-24 16:50:53 +0300 |
|---|---|---|
| committer | Jan Lindström <jan.lindstrom@mariadb.com> | 2020-08-24 19:57:20 +0300 |
| commit | 48a110eb0b2611aea7a05b128fcfa024dafb21a5 (patch) | |
| tree | 25c5c97ef44d2e29a27fd8ad6396549d66f11ced | |
| parent | d03ddf3c1955ddb969eab1debe5581b301d70a18 (diff) | |
| download | mariadb-git-bb-10.4-MDEV-22055.tar.gz | |
MDEV-23558: Galera heap-buffer-overflow at wsrep_schema.cc:1067bb-10.4-MDEV-22055
Key buffer needs to contain max field widths i.e. add MAX_FIELD_WIDTH.
| -rw-r--r-- | sql/wsrep_schema.cc | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sql/wsrep_schema.cc b/sql/wsrep_schema.cc index 619a535f916..df9c7b78c9b 100644 --- a/sql/wsrep_schema.cc +++ b/sql/wsrep_schema.cc @@ -935,7 +935,7 @@ int Wsrep_schema::update_fragment_meta(THD* thd, Wsrep_schema_impl::binlog_off binlog_off(thd); int error; - uchar key[MAX_KEY_LENGTH]; + uchar key[MAX_KEY_LENGTH+MAX_FIELD_WIDTH]; key_part_map key_map= 0; TABLE* frag_table= 0; @@ -997,7 +997,7 @@ static int remove_fragment(THD* thd, seqno.get()); int ret= 0; int error; - uchar key[MAX_KEY_LENGTH]; + uchar key[MAX_KEY_LENGTH+MAX_FIELD_WIDTH]; key_part_map key_map= 0; DBUG_ASSERT(server_id.is_undefined() == false); @@ -1120,7 +1120,7 @@ int Wsrep_schema::replay_transaction(THD* orig_thd, int ret= 1; int error; TABLE* frag_table= 0; - uchar key[MAX_KEY_LENGTH]; + uchar key[MAX_KEY_LENGTH+MAX_FIELD_WIDTH]; key_part_map key_map= 0; for (std::vector<wsrep::seqno>::const_iterator i= fragments.begin(); |