cossacklabs / acra

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
https://www.cossacklabs.com/acra/
Apache License 2.0
1.35k stars 128 forks source link

Fix multiple prepared stmt registraion #539

Closed G1gg1L3s closed 2 years ago

G1gg1L3s commented 2 years ago

This PR solves double registration of prepared statements. They are registered twice: after Parse and ParseComplete, but because of a race condition, the pending statement can be replaced by another. Then, this triggers registration of a nil value as a statement.

To solve the problem, this PR removes the second registration.

There is one issue though: prepared statements are never cleaned, even ones that contain errors. This requires a large redesigning of the whole packet processing protocol. So, for now, we have a small memory leakage in a connection. But on practice this should not be an issue.

Checklist