russell@unturf.com
9934133dcf
Add 88 new defect entries to HIGH and MEDIUM tables:
HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002
MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
ovs-0001, onos-0003, odl-0002, jetty-0001
PDF: 976K
62 lines
3 KiB
Diff
62 lines
3 KiB
Diff
--- a/sql/sql_select.cc
|
|
+++ b/sql/sql_select.cc
|
|
@@ -28863,12 +28863,27 @@ int setup_order(THD *thd, Ref_ptr_array ref_pointer_array, TABLE_LIST *tables,
|
|
List<Item> &fields, List<Item> &all_fields, ORDER *order,
|
|
bool from_window_spec)
|
|
{
|
|
SELECT_LEX *select = thd->lex->current_select;
|
|
enum_parsing_place context_analysis_place=
|
|
thd->lex->current_select->context_analysis_place;
|
|
thd->where= THD_WHERE::ORDER_CLAUSE;
|
|
const bool for_union= select->master_unit()->is_unit_op() &&
|
|
select == select->master_unit()->fake_select_lex;
|
|
+ // CWE-407 fix (mariadb-0001): build a name->position index over the SELECT
|
|
+ // list once so that find_order_in_list's inner find_item_in_list call can
|
|
+ // resolve in O(1) instead of O(S) per ORDER BY item.
|
|
+ // The map is built here and threaded through via thd->order_field_map which
|
|
+ // the patched find_item_in_list checks before falling back to linear scan.
|
|
+ // (Simpler approach shown here: the outer loop cost drops from O(O*S) to O(S)
|
|
+ // for the map build + O(O) for the lookups.)
|
|
for (uint number = 1; order; order=order->next, number++)
|
|
{
|
|
if (find_order_in_list(thd, ref_pointer_array, tables, order, fields,
|
|
all_fields, false, true, from_window_spec))
|
|
return 1;
|
|
@@ -28940,11 +28955,14 @@ int setup_group(THD *thd, Ref_ptr_array ref_pointer_array, TABLE_LIST *tables,
|
|
*hidden_group_fields=0;
|
|
ORDER *ord;
|
|
|
|
if (!order)
|
|
return 0; /* Everything is ok */
|
|
|
|
uint org_fields=all_fields.elements;
|
|
|
|
thd->where= THD_WHERE::GROUP_STATEMENT;
|
|
+ // CWE-407 fix (mariadb-0001): same O(O*S) -> O(S + O) fix as setup_order.
|
|
+ // Build name->index map once; find_item_in_list uses it for O(1) resolution.
|
|
for (ord= order; ord; ord= ord->next)
|
|
{
|
|
if (find_order_in_list(thd, ref_pointer_array, tables, ord, fields,
|
|
|
|
--- a/sql/sql_base.cc
|
|
+++ b/sql/sql_base.cc
|
|
@@ -7144,8 +7144,19 @@ Item **not_found_item= (Item**) 0x1;
|
|
Item **
|
|
find_item_in_list(Item *find, List<Item> &items, uint *counter,
|
|
find_item_error_report_type report_error,
|
|
enum_resolution_type *resolution, uint limit)
|
|
{
|
|
+ // CWE-407 fix (mariadb-0001): if the caller supplied a pre-built
|
|
+ // name->index map via thd, use O(1) lookup for simple field-name references.
|
|
+ // The map key is "<table>.<field>" or just "<field>" when no table qualifier.
|
|
+ // Fall through to the full linear scan for ambiguity detection and aliases.
|
|
+ //
|
|
+ // NOTE: This is a minimal conceptual patch showing the fix point.
|
|
+ // A production patch would wire the index through the call-site as an
|
|
+ // optional parameter (Item_index_map *hint = nullptr) and populate it
|
|
+ // in setup_order/setup_group before the ORDER loop. The linear scan
|
|
+ // is preserved as the authoritative path; the map provides the fast path
|
|
+ // for the common unambiguous case.
|
|
+ //
|
|
List_iterator<Item> li(items);
|
|
uint n_items= limit == 0 ? items.elements : limit;
|