Commit 88e70f4c authored by Jan Lindström's avatar Jan Lindström

MDEV-23558: Galera heap-buffer-overflow at wsrep_schema.cc:1067

Key buffer needs to contain max field widths i.e. add MAX_FIELD_WIDTH.
parent a16f4927
...@@ -935,7 +935,7 @@ int Wsrep_schema::update_fragment_meta(THD* thd, ...@@ -935,7 +935,7 @@ int Wsrep_schema::update_fragment_meta(THD* thd,
Wsrep_schema_impl::binlog_off binlog_off(thd); Wsrep_schema_impl::binlog_off binlog_off(thd);
int error; int error;
uchar key[MAX_KEY_LENGTH]; uchar key[MAX_KEY_LENGTH+MAX_FIELD_WIDTH];
key_part_map key_map= 0; key_part_map key_map= 0;
TABLE* frag_table= 0; TABLE* frag_table= 0;
...@@ -997,7 +997,7 @@ static int remove_fragment(THD* thd, ...@@ -997,7 +997,7 @@ static int remove_fragment(THD* thd,
seqno.get()); seqno.get());
int ret= 0; int ret= 0;
int error; int error;
uchar key[MAX_KEY_LENGTH]; uchar key[MAX_KEY_LENGTH+MAX_FIELD_WIDTH];
key_part_map key_map= 0; key_part_map key_map= 0;
DBUG_ASSERT(server_id.is_undefined() == false); DBUG_ASSERT(server_id.is_undefined() == false);
...@@ -1120,7 +1120,7 @@ int Wsrep_schema::replay_transaction(THD* orig_thd, ...@@ -1120,7 +1120,7 @@ int Wsrep_schema::replay_transaction(THD* orig_thd,
int ret= 1; int ret= 1;
int error; int error;
TABLE* frag_table= 0; TABLE* frag_table= 0;
uchar key[MAX_KEY_LENGTH]; uchar key[MAX_KEY_LENGTH+MAX_FIELD_WIDTH];
key_part_map key_map= 0; key_part_map key_map= 0;
for (std::vector<wsrep::seqno>::const_iterator i= fragments.begin(); for (std::vector<wsrep::seqno>::const_iterator i= fragments.begin();
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment