diff options
| author | Marko Mäkelä <marko.makela@mariadb.com> | 2018-05-17 15:16:55 +0300 |
|---|---|---|
| committer | Marko Mäkelä <marko.makela@mariadb.com> | 2018-05-17 15:21:32 +0300 |
| commit | b2f56085d4249e2cf3ed9f80d284b3ce837e9e29 (patch) | |
| tree | 2892ff12079dce2d9896cea7fbf821c1c24ffaf7 /storage/innobase/log | |
| parent | 10d44db5d49a138ed25b227912ac938100d666fa (diff) | |
| download | mariadb-git-b2f56085d4249e2cf3ed9f80d284b3ce837e9e29.tar.gz | |
MDEV-16045: Fix a heap allocation
Since commit baa5a43d8cb2f747eeb70d394a362fb5f3fdd194
changed the allocation of log_t::files::file_header_bufs[],
a memory overrun could occur when running with a non-default
setting of innodb_log_files_in_group.
log_t::files::create(): Correctly allocate n_files*2048 + 512
bytes of memory, to be aligned at a 512-byte boundary.
Diffstat (limited to 'storage/innobase/log')
| -rw-r--r-- | storage/innobase/log/log0log.cc | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/storage/innobase/log/log0log.cc b/storage/innobase/log/log0log.cc index b057caf38fd..b099e50cd9e 100644 --- a/storage/innobase/log/log0log.cc +++ b/storage/innobase/log/log0log.cc @@ -675,9 +675,8 @@ void log_t::files::create(ulint n_files) lsn= LOG_START_LSN; lsn_offset= LOG_FILE_HDR_SIZE; - byte* ptr= static_cast<byte*>(ut_zalloc_nokey(LOG_FILE_HDR_SIZE - + OS_FILE_LOG_BLOCK_SIZE - * n_files)); + byte* ptr= static_cast<byte*>(ut_zalloc_nokey(LOG_FILE_HDR_SIZE * n_files + + OS_FILE_LOG_BLOCK_SIZE)); file_header_bufs_ptr= ptr; ptr= static_cast<byte*>(ut_align(ptr, OS_FILE_LOG_BLOCK_SIZE)); |