hcq/MaxScale
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Double free prevented.

Browse Source 
routeQuery calls route_single_stmt, which requires the GWBUF to be
contiguous. Earlier it was made contiguous (if needed) in
route_single_stmt. However, since the process of making a GWBUF
contiguous causes the original buffer to be freed, this would lead
to a double free later in routeQuery that frees the passed buffer.

This is prevented now by making the buffer contiguous before calling
route_single_stmt.
This commit is contained in:
Johan Wikman
2015-09-29 10:37:56 +03:00
parent 6f3ec723b1
commit db0e2e881f
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
server/modules/routing/readwritesplit/readwritesplit.c
View File

@ -2022,6 +2022,9 @@ static int routeQuery(
} }
else else
{ {
/** route_single_stmt expects the buffer to be contiguous. */
querybuf = gwbuf_make_contiguous(querybuf);
succp = route_single_stmt(inst, router_cli_ses, querybuf); succp = route_single_stmt(inst, router_cli_ses, querybuf);
} }
} }
@ -2053,6 +2056,9 @@ static int routeQuery(
} }
else else
{ {
/** route_single_stmt expects the buffer to be contiguous. */
querybuf = gwbuf_make_contiguous(querybuf);
succp = route_single_stmt(inst, router_cli_ses, querybuf); succp = route_single_stmt(inst, router_cli_ses, querybuf);
} }
@ -2108,6 +2114,7 @@ static bool route_single_stmt(
int rlag_max = MAX_RLAG_UNDEFINED; int rlag_max = MAX_RLAG_UNDEFINED;
backend_type_t btype; /*< target backend type */ backend_type_t btype; /*< target backend type */
ss_dassert(querybuf->next == NULL); // The buffer must be contiguous.
ss_dassert(!GWBUF_IS_TYPE_UNDEFINED(querybuf)); ss_dassert(!GWBUF_IS_TYPE_UNDEFINED(querybuf));
/** /**
@ -2131,12 +2138,6 @@ static bool route_single_stmt(
goto retblock; goto retblock;
} }
/** If buffer is not contiguous, make it such */
if (querybuf->next != NULL)
{
querybuf = gwbuf_make_contiguous(querybuf);
}
packet = GWBUF_DATA(querybuf); packet = GWBUF_DATA(querybuf);
packet_len = gw_mysql_get_byte3(packet); packet_len = gw_mysql_get_byte3(packet);