MDEV-39450: Memory corruption: overlapping memory ranges in Field_longstr::compress on UPDATE of compressed column#5256
MDEV-39450: Memory corruption: overlapping memory ranges in Field_longstr::compress on UPDATE of compressed column#5256raghunandanbhat wants to merge 1 commit into
Field_longstr::compress on UPDATE of compressed column#5256Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request fixes a memory corruption issue (MDEV-39450) caused by overlapping memory ranges in Field_longstr::compress during an UPDATE of a compressed column by replacing memcpy with memmove in sql/field.cc. It also adds corresponding regression tests. Feedback points out a typo in the test file (10.6s instead of 10.6) that will cause a mismatch with the expected result file and lead to test failures.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
…ngstr::compress` on UPDATE of compressed column Problem: Values shorter than `column_compression_threshold` (default 100) are stored uncompressed. Reading such a column returns a pointer into that buffer rather than a copy. When the new value is a substring of the column that aliases this buffer at a non-zero offset, e.g. `RIGHT(c,n)` or `SUBSTRING(c,n)`, the source and destination overlap, and the `memcpy()` in the "store uncompressed" path copies overlapping regions, which is undefined behaviour. Fix: Replace `memcpy` with `memmove` to avoid copying between overlapping memory regions.
raghunandanbhat
force-pushed
the
10.6-mdev-39450
branch
from
0670c4a to
1d16297
Compare
2 participants
fixes MDEV-39450
Problem:
Values shorter than
column_compression_threshold(default 100) are stored uncompressed. Reading such a column returns a pointer into that buffer rather than a copy.When the new value is a substring of the column that aliases this buffer at a non-zero offset, e.g.
RIGHT(c,n)orSUBSTRING(c,n), the source and destination overlap, and thememcpy()in the "store uncompressed" path copies overlapping regions, which is undefined behaviour.Fix:
Replace
memcpywithmemmoveto avoid copying between overlapping memory regions.