Repository navigation
Backport to 3.0 - CORE-6509 and add missing NULL checks on bcb_bdb - #9293
Open
gabrieleciech wants to merge 1 commit into
Open
gabrieleciech wants to merge 1 commit into
gabrieleciech wants to merge 1 commit into
Conversation
…CORE-6509) expand_buffers() sets bcb_count before the new buffer descriptors are allocated, so after a BadAlloc the tail of bcb_rpt has no BufferDesc. Initialise the new tail to NULL (as CORE-6509 did in 4.0) and stop at the first NULL in every loop over bcb_count that dereferences bcb_bdb: flushAll(), CCH_down_grade_dbb(), CCH_flush_ast(), CCH_shutdown() and get_prec_walk_mark(). Refs FirebirdSQL#9289
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #9289 (3.0 part; the 4.0 part is a separate PR). NULL checks only, as suggested there.
expand_buffers()setsbcb_countbefore allocating the newBufferDescs, so after aBadAllocthe tail ofbcb_rpthas no descriptor. In 3.0 that tail is not even initialised.Change
expand_buffers(): initialise the new tail toNULL(as in CORE-6509, e17dfa6).bcb_bdbin every loop up tobcb_countthat dereferences it:flushAll()(as in CORE-6509),CCH_down_grade_dbb(),CCH_flush_ast(),CCH_shutdown()(thecatchpath) andget_prec_walk_mark().breakis enough because descriptors are allocated in order, so the uninitialised entries are always a contiguous tail.CCH_shutdown()was not listed in #9289: it has the same pattern in the cleanup after a failedCCH_flush().Test
Compiled on Ubuntu 18.04, gcc 7.5 (
src/jrd/cch.cpp, Release flags +-Wall). No automated test: reproducing it needs an allocation failure insideexpand_buffers().