• sjaakola's avatar
    MDEV-23557 Galera heap-buffer-overflow in wsrep_rec_get_foreign_key · df07ea0b
    sjaakola authored
    This commit contains a fix and extended test case for a ASAN failure
    reported during galera.fk mtr testing.
    The reported heap buffer overflow happens in test case where a cascading
    foreign key constraint is defined for a column of varchar type, and
    galera.fk.test has such vulnerable test scenario.
    
    Troubleshoting revealed that erlier fix for MDEV-19660 has made a fix
    for cascading delete handling to append wsrep keys from pcur->old_rec,
    in row_ins_foreign_check_on_constraint(). And, the ASAN failuer comes from
    later scanning of this old_rec reference.
    
    The fix in this commit, moves the call for wsrep_append_foreign_key() to happen
    somewhat earlier, and inside ongoing mtr, and using clust_rec which is set
    earlier in the same mtr for both update and delete cascade operations.
    for wsrep key populating, it does not matter when the keys are populated,
    all keys just have to be appended before wsrep transaction replicates.
    
    Note that I also tried similar fix for earlier wsrep key append, but using
    the old implementation with pcur->old_rec (instead of clust_rec), and same
    ASAN failure was reported. So it appears that pcur->old_rec is not properly
    set, to be used for wsrep key appending.
    
    galera.galera_fk_cascade_delete test has been extended by two new test scenarios:
    * FK cascade on varchar column.
      This test case reproduces same scenario as galera.fk, and this test scenario
      will also trigger ASAN failure with non fixed MariaDB versions.
    * multi-master conflict with FK cascading.
      this scenario causes a conflict between a replicated FK cascading transaction
      and local transaction trying to modify the cascaded child table row.
      Local transaction should be aborted and get deadlock error.
      This test scenario is passing both with old MariaDB version and with this
      commit as well.
    df07ea0b
row0ins.cc 98.7 KB