MDEV-38904 Strings: Fix my_convert infinite loop and latin7 collation#4749
Open
itzanway wants to merge 2 commits intoMariaDB:mainfrom
Open
MDEV-38904 Strings: Fix my_convert infinite loop and latin7 collation#4749itzanway wants to merge 2 commits intoMariaDB:mainfrom
itzanway wants to merge 2 commits intoMariaDB:mainfrom
Conversation
The server hangs at 100% CPU when encountering malformed bytes because my_convert_using_func and my_convert_fix did not explicitly force pointer advancement when mb_wc returned a length of 0. This patch adds an explicit from++ advancement when cnvres == 0 to ensure termination. Additionally, this adjusts the sort_order_latin7_general_ci weights to resolve a transitivity violation where the hyphen (0x2D) and space (0x20) caused index compression collisions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR addresses MDEV-38904, which involves a transitivity violation causing false index corruption in
latin7tables, and a subsequent vulnerability where the server hangs at 100% CPU during string conversion of malformed data.1. Failsafe Loop Fix:
my_convertInfinite Loop (strings/ctype.c)The Problem: Even in cases of severe table corruption or malformed byte sequences, the server should never hang. The previous implementation of
my_convert_using_funcandmy_convert_fixfailed to explicitly force a pointer advancement when the character set'smb_wcfunction returned a length of0(which occurs when reading corrupted byte sequences).The Fix: Added an explicit
from++advancement whencnvres == 0. This ensures the conversion loop always strictly terminates, replacing the unreadable/malformed bytes with a?placeholder instead of looping infinitely.2. Collation Logic Fix:
latin7_general_ci(strings/ctype-extra.c)The Problem:
A transitivity violation existed in the
latin7_general_cicollation. In thesort_order_latin7_general_ciarray, the hyphen (-, 0x2D) and the space (, 0x20) were assigned overlapping weights. During MyISAM/Aria index compression, these collisions resulted in circular B-tree pointers, causingCHECK TABLEto falsely report "Key in wrong position" and flagging healthy tables as corrupted.The Proposed Fix:
Adjusted the
sort_order_latin7_general_ciweights to ensure that the space character (Index 32) is uniquely weighted as the minimum printable value, and that the hyphen (Index 45) has a strictly distinct weight to prevent B-tree sorting collisions.I have updated this PR to address the requested housekeeping items:
CODING_STANDARDS.md.mdev_38904.test) to reliably verify the loop termination andCHECK TABLEbehavior.Regarding the Collation Weights (Backwards Compatibility):
I completely understand and agree with your warning. Adjusting the existing weights on
latin7_general_ciwill break backwards compatibility for on-disk B-tree indexes across existing deployments.I have left the adjusted logic in this commit solely so you can review the proposed transitivity fix. Moving forward to the final review, how would you prefer to architect this to protect user data? Should we implement these corrected weights under a brand new collation ID/name, or is there a preferred versioning mechanism MariaDB uses for patching existing collations?
Looking forward to your guidance!