Skip to content

MDEV-40854 Use of uninitialized table_will_be_deleted in federated engine - #5726

Open
midenok wants to merge 1 commit into
10.11from
10.11-midenok-MDEV-40854
Open

midenok wants to merge 1 commit into
10.11from
10.11-midenok-MDEV-40854

Conversation

@midenok

@midenok midenok commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

MemorySanitizer report:

==851408==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 ha_federated::end_bulk_insert() storage/federated/ha_federated.cc:2035:30
#1 mysql_insert(THD*, ...) sql/sql_insert.cc:1258:11
...
Memory was marked as uninitialized
#0 __msan_allocated_memory
#1 my_malloc mysys/my_malloc.c:116:7
SUMMARY: MemorySanitizer: use-of-uninitialized-value ... end_bulk_insert()

table_will_be_deleted is a handler member with no in-class initializer, and the handler object itself is heap-allocated via my_malloc(), so it starts out as garbage. It was only ever set in extra(HA_EXTRA_PREPARE_FOR_DROP) and in external_lock(). For a TEMPORARY table, statement execution can reach
end_bulk_insert()/write_row(), which reads the flag, without external_lock() having run first, so the read sees uninitialized memory.

The fix initializes table_will_be_deleted in reset(), which runs at the start of every statement regardless of locking path.

Copilot AI lite review requested due to automatic review settings September 21, 2026 14:26
@midenok midenok changed the title MDEV-40854 Use of uninitialized table_will_be_deleted in federated en… MDEV-40854 Use of uninitialized table_will_be_deleted in federated engine Sep 21, 2026
@midenok
midenok force-pushed the 10.11-midenok-MDEV-40854 branch from 61f4663 to dde3439 Compare September 21, 2026 14:27
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

This comment was marked as outdated.

…gine

MemorySanitizer report:

==851408==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 ha_federated::end_bulk_insert() storage/federated/ha_federated.cc:2035:30
    #1 mysql_insert(THD*, ...) sql/sql_insert.cc:1258:11
    ...
  Memory was marked as uninitialized
    #0 __msan_allocated_memory
    #1 my_malloc mysys/my_malloc.c:116:7
SUMMARY: MemorySanitizer: use-of-uninitialized-value ... end_bulk_insert()

table_will_be_deleted is a handler member with no in-class
initializer, and the handler object itself is heap-allocated via
my_malloc(), so it starts out as garbage. It was only ever set in
extra(HA_EXTRA_PREPARE_FOR_DROP) and in external_lock().  For a
TEMPORARY table, statement execution can reach
end_bulk_insert()/write_row(), which reads the flag, without
external_lock() having run first, so the read sees uninitialized
memory.

The fix initializes table_will_be_deleted in reset(), which runs at
the start of every statement regardless of locking path.
@midenok
midenok force-pushed the 10.11-midenok-MDEV-40854 branch from 0631150 to 2738489 Compare September 21, 2026 14:32
@midenok
midenok requested a balanced review from Copilot September 21, 2026 14:33

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

Both handlers initialize the flag before use, and the regression test covers the temporary-table bulk-insert path.

Review effort: Lite
Findings: None

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants