• Varun Gupta's avatar
    MDEV-12350: Heap corruption, overrun buffer, ASAN errors, server crash in my_fill_8bit / filesort · 924db8b4
    Varun Gupta authored
    In the function make_sortkey a tmp buffer was defined and in the absence of
    param->tmp_buffer, tmp buffer used the sort_keys buffer. sort_keys buffer
    has a length defined in sort_field->length, while param->tmp_buffer is
    stored in param->rec_length. Make sure to use the appropriate length
    based on which buffer we are using otherwise we'll overflow.
    
    Also added a type cast to size_t during the calculation of the sort keys
    buffer size to avoid an oveflow if the buffer size exceeds 32 bits.
    924db8b4
group_by.test 59.2 KB