diff options
author | Sergei Petrunia <psergey@askmonty.org> | 2020-01-12 22:15:55 +0300 |
---|---|---|
committer | Sergei Petrunia <psergey@askmonty.org> | 2020-01-12 22:15:55 +0300 |
commit | d531b4ee3a9bcd89a2fa6b49a2207eaf966f53e3 (patch) | |
tree | fbdc8bb230c6d123f8b2484878acf234caf46810 /sql/sql_trigger.cc | |
parent | 9c3eca85141836548214e3c68f256b3868502509 (diff) | |
download | mariadb-git-bb-10.3-mdev21341-issueSix.tar.gz |
MDEV-21341: Fix UBSAN failures: Issue Sixbb-10.3-mdev21341-issueSix
(Variant #2 of the patch, which keeps the sp_head object inside the
MEM_ROOT that sp_head object owns)
(10.3 version of the fix, with handling for class sp_package)
sp_head::operator new() and operator delete() were dereferencing sp_head*
pointers to memory that didn't hold a valid sp_head object (it was
not created/already destroyed).
This caused UBSan to crash when looking up type information.
Fixed by providing static sp_head::create() and sp_head::destroy() methods.
Diffstat (limited to 'sql/sql_trigger.cc')
-rw-r--r-- | sql/sql_trigger.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sql/sql_trigger.cc b/sql/sql_trigger.cc index b8ce5d743b4..26ec04cb89e 100644 --- a/sql/sql_trigger.cc +++ b/sql/sql_trigger.cc @@ -338,7 +338,7 @@ public: Trigger::~Trigger() { - delete body; + sp_head::destroy(body); } |