From e963f4e82bdc5b85499ea04cf51e7dbf7aa2fe8f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Markus=20M=C3=A4kel=C3=A4?= Date: Wed, 11 Jul 2018 19:26:08 +0300 Subject: [PATCH] Fix reading of past-the-end memory The buffer that binlogrouter allocated for the error message was too small. ASAN happened to catch this. --- .../modules/routing/binlogrouter/blr_master.cc | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/server/modules/routing/binlogrouter/blr_master.cc b/server/modules/routing/binlogrouter/blr_master.cc index d138db331..6f58fc26d 100644 --- a/server/modules/routing/binlogrouter/blr_master.cc +++ b/server/modules/routing/binlogrouter/blr_master.cc @@ -222,17 +222,12 @@ static void blr_start_master(void* data) router->retry_count++; spinlock_release(&router->lock); /* Set reconnection task */ - static const char master[] = "Master"; - char *name = (char *)MXS_MALLOC(strlen(router->service->name) + sizeof(master)); - if (name) - { - sprintf(name, "%s %s", router->service->name, master); - hktask_add(name, - blr_start_master_in_main, - router, - connect_retry); - MXS_FREE(name); - } + std::string name = router->service->name; + name += " Master"; + hktask_add(name.c_str(), + blr_start_master_in_main, + router, + connect_retry); MXS_ERROR("%s: failure while connecting to master server '%s', " "retrying in %d seconds",