FirebirdSQL / firebird

Firebird server, client and tools
https://firebirdsql.org
1.26k stars 217 forks source link

Memory leak is possible for UDF array arguments #7817

Closed dmitry-lipetsk closed 1 year ago

dmitry-lipetsk commented 1 year ago

FB v4.0.4.2988

If this line throws https://github.com/FirebirdSQL/firebird/blob/9591891e906df94d66589063fcab3b0333445607/src/jrd/fun.epp#L1018 you do not release the allocated memory in 'data' https://github.com/FirebirdSQL/firebird/blob/9591891e906df94d66589063fcab3b0333445607/src/jrd/fun.epp#L1005

Bricks for reproducing this problem:

DECLARE EXTERNAL FUNCTION MY_UDF__GET_DIM
 INTEGER BY SCALAR_ARRAY
RETURNS INTEGER BY VALUE
ENTRY_POINT 'fn_get_dim__i4__sa'
MODULE_NAME 'lcpi.test.udf.01.dll'

select MY_UDF__GET_DIM(cast('12311111111111111111111111111111111111111111111111111111111111111111111111111111111' as blob)) from rdb$database

image

Memory releases after disconnect.

dyemanov commented 1 year ago

Please verify the fix and I will port it to other versions.

dmitry-lipetsk commented 1 year ago

Good time of day.

Fix looks ok.

image

image

Another simple tests work fine, too.

Source code of test UDF:

#include "source/fn.h"
#include <cstddef>

////////////////////////////////////////////////////////////////////////////////

using SSHORT=std::int16_t;
using SLONG =std::int32_t;
using SCHAR =char;

////////////////////////////////////////////////////////////////////////////////

typedef struct dsc
{
 UCHAR  dsc_dtype;
 SCHAR  dsc_scale;
 USHORT dsc_length;
 SSHORT dsc_sub_type;
 USHORT dsc_flags;
 UCHAR* dsc_address; // Used either as offset in a message or as a pointer
} DSC;

struct scalar_array_desc
{
 DSC   sad_desc;
 SLONG sad_dimensions;

 struct sad_repeat
 {
  SLONG sad_lower;
  SLONG sad_upper;
 } sad_rpt[1];
};//struct scalar_array_desc

////////////////////////////////////////////////////////////////////////////////

std::int32_t FBUDF_API fn_get_dim__i4__sa(const scalar_array_desc* const descr)
{
 if(descr->sad_desc.dsc_address==nullptr)
  return 0;

 return descr->sad_dimensions;
}//fn_get_dim__i4__sa

////////////////////////////////////////////////////////////////////////////////
onlylunix commented 1 year ago

Will there be a fix for version 3.0.11?

dyemanov commented 1 year ago

Will there be a fix for version 3.0.11?

Backported.