Skip to content

Commit 8faae45

Browse files
committed
MDEV-35665 Potential Buffer Overrun in Gtid_log_event::write()
Two-Phase ALTER added a sa_seq_no field, but `Gtid_log_event::write()`'s size calculation doesn't have an addend in its name. This patch resizes the buffer to match `write()`'s code.
1 parent 661daf0 commit 8faae45

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

sql/log_event_server.cc

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3729,7 +3729,12 @@ Gtid_log_event::peek(const uchar *event_start, size_t event_len,
37293729
bool
37303730
Gtid_log_event::write()
37313731
{
3732-
uchar buf[GTID_HEADER_LEN+2+sizeof(XID) + /* flags_extra: */ 1+4];
3732+
uchar buf[GTID_HEADER_LEN+2
3733+
+ sizeof(XID)
3734+
+ 1 // flags_extra:
3735+
+ 1 // extra_engines
3736+
+ 8 // sa_seq_no
3737+
];
37333738
size_t write_len= 13;
37343739

37353740
int8store(buf, seq_no);

0 commit comments

Comments
 (0)