firebird
firebird copied to clipboard
[UDF, AV] Server incorrectly calculates a memory size for scalar_array_desc
Hello,
sizeof(scalar_array_desc) == 32
Note - it is a size of an array descriptor with one dimension.
When I call the UDF
DECLARE EXTERNAL FUNCTION IBP_UDF__ADIM__I4
INTEGER BY SCALAR_ARRAY
RETURNS INTEGER BY VALUE
ENTRY_POINT 'fn_get_arr_dim__i4__sa'
MODULE_NAME 'lcpi.ibp.test.udf.01.dll'
I see the following situation in this code:
https://github.com/FirebirdSQL/firebird/blob/6340df17fa22dc8a641f4a1673e515c5e0242eca/src/jrd/fun.epp#L377-L380
Server allocates 16+8 bytes here.
And it uses this memory below: https://github.com/FirebirdSQL/firebird/blob/6340df17fa22dc8a641f4a1673e515c5e0242eca/src/jrd/fun.epp#L479-L483
There are two mistakes
- function->fun_temp_length is calculated incorrectly
- It won't work with multidimensional arrays - get_scalar_array must allocate scalar_array_desc.
Server crashes in MemPool::releaseMemory