opensrv
opensrv copied to clipboard
bug: use after free in PacketReader::next_async
I discovered this bug while using the opensrv MySQL implementation in Greptime DB. It appears that when parsing a large SQL file, opensrv reuses some of its u8 arrays, leading to a string validation issue with from_utf8. This results in corrupted bytes. I am currently working on a minimal reproducible example, but I can reliably reproduce the issue with a large query (about 500 lines of SQL) in Greptime DB.
This may be related to Issue #49. I am still trying to understand the code, but I suspect that the data race originates from the opensrv crate. I have placed numerous UTF-8 checks in the call stack, and soon after exiting the opensrv call to AsyncMysqlIntermediary.run, the validity of the UTF-8 suddenly fails, resulting in the query &str being corrupted.(Note that the first few check for utf8 is oked after calling AsyncMysqlIntermediary.run
indicating a data race)
edited: I made a fix in https://github.com/datafuselabs/opensrv/pull/67 removing unsafe line