Skip to content

Conversation

@catenacyber
Copy link

Finds a buffer off by one overread with SELECT@@SELECT

==23857==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000001a5f at pc 0x7f04fa2568d6 bp 0x7ffe0c645080 sp 0x7ffe0c645078 READ of size 1 at 0x502000001a5f thread T0 #0 0x7f04fa2568d5 in Lex_input_stream::yyPeek() const /src/mysql-server/sql/sql_lex.h:3524:12 #1 0x7f04fa259968 in consume_optimizer_hints(Lex_input_stream*) /src/mysql-server/sql/sql_lex.cc:866:18 #2 0x7f04fa258326 in find_keyword(Lex_input_stream*, unsigned int, bool) /src/mysql-server/sql/sql_lex.cc:927:11 #3 0x7f04fa240bf3 in lex_one_token(Lexer_yystype*, THD*) /src/mysql-server/sql/sql_lex.cc:2109:23 #4 0x7f04fa23e109 in my_sql_parser_lex(MY_SQL_PARSER_STYPE*, MY_SQL_PARSER_LTYPE*, THD*) /src/mysql-server/sql/sql_lex.cc:1392:11 #5 0x7f04fdeff656 in my_sql_parser_parse(THD*, Parse_tree_root**) /src/mysql-server/build/sql/sql_yacc.cc:26517:16 #6 0x7f04fa1ee3bf in THD::sql_parser() /src/mysql-server/sql/sql_class.cc:3176:7 #7 0x7f04fa760005 in parse_sql(THD*, Parser_state*, Object_creation_ctx*) /src/mysql-server/sql/sql_parse.cc:7218:40 #8 0x55e9f16f7048 in LLVMFuzzerTestOneInput /src/mysql-server/sql/fuzz/fuzz_sql_parse.cc:140:5 
@mysql-oca-bot
Copy link

Hi, thank you for your contribution. Please confirm this code is submitted under the terms of the OCA (Oracle's Contribution Agreement) you have previously signed by cutting and pasting the following text as a comment:
"I confirm the code being submitted is offered under the terms of the OCA, and that I am authorized to contribute it."
Thanks

@catenacyber
Copy link
Author

I confirm the code being submitted is offered under the terms of the OCA, and that I am authorized to contribute it.

@mysql-oca-bot
Copy link

Hi, thank you for your contribution. Your code has been assigned to an internal queue. Please follow
bug http://bugs.mysql.com/bug.php?id=118349 for updates.
Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

2 participants