Skip to content

Commit ee50c87

Browse files
committed
Bug#37512526 Signal dump code can read out of bounds
Avoid reading signal section pointers that are not present. Change-Id: Ifdc5ae688ae2f3d3c64c895ca7a062b1ab0ccc6a
1 parent 0d64463 commit ee50c87

File tree

1 file changed

+20
-4
lines changed
  • storage/ndb/src/kernel/vm

1 file changed

+20
-4
lines changed

storage/ndb/src/kernel/vm/mt.cpp

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Copyright (c) 2008, 2022, Oracle and/or its affiliates.
1+
/* Copyright (c) 2008, 2025, Oracle and/or its affiliates.
22
33
This program is free software; you can redistribute it and/or modify
44
it under the terms of the GNU General Public License, version 2.0,
@@ -8304,9 +8304,25 @@ FastScheduler::dumpSignalMemory(Uint32 thr_no, FILE* out)
83048304
signal.header.theReceiversBlockNumber &= NDBMT_BLOCK_MASK;
83058305

83068306
const Uint32 *posptr = reinterpret_cast<const Uint32 *>(s);
8307-
signal.m_sectionPtrI[0] = posptr[siglen + 0];
8308-
signal.m_sectionPtrI[1] = posptr[siglen + 1];
8309-
signal.m_sectionPtrI[2] = posptr[siglen + 2];
8307+
signal.m_sectionPtrI[0] = RNIL;
8308+
signal.m_sectionPtrI[1] = RNIL;
8309+
signal.m_sectionPtrI[2] = RNIL;
8310+
switch (s->m_noOfSections) {
8311+
case 3:
8312+
signal.m_sectionPtrI[2] = posptr[siglen + 2];
8313+
[[fallthrough]];
8314+
case 2:
8315+
signal.m_sectionPtrI[1] = posptr[siglen + 1];
8316+
[[fallthrough]];
8317+
case 1:
8318+
signal.m_sectionPtrI[0] = posptr[siglen + 0];
8319+
[[fallthrough]];
8320+
case 0:
8321+
break;
8322+
default:
8323+
/* Out of range - ignore */
8324+
break;
8325+
};
83108326
bool prioa = signalSequence[seq_end].prioa;
83118327

83128328
/* Make sure to display clearly when there is a gap in the dump. */

0 commit comments

Comments
 (0)