Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

plugin crash with very long query #145

Closed
RickPizzi opened this issue Jul 18, 2016 · 15 comments
Closed

plugin crash with very long query #145

RickPizzi opened this issue Jul 18, 2016 · 15 comments

Comments

@RickPizzi
Copy link
Contributor

We are suffering a plugin crash when a very long query is issued. The crash does not happen in the plugin itself, however, it has been verified that the crash does not happen when the audit plugin is not loaded, so here we are.

`stack_bottom = 7f6b4ec34d40 thread_stack 0x40000
/usr/sbin/mysqld(my_print_stacktrace+0x2c)[0x8d2e0c]
/usr/sbin/mysqld(handle_fatal_signal+0x461)[0x6580b1]
/lib64/libpthread.so.0[0x3ba2a0f7e0]
/usr/sbin/mysqld(my_hash_first+0xb)[0x8b5abb]
/usr/sbin/mysqld(my_hash_search+0x11)[0x8b5b21]
/usr/sbin/mysqld(_Z23check_grant_all_columnsP3THDmP24Field_iterator_table_ref+0x125)[0x6713d5]
/usr/sbin/mysqld(_Z13insert_fieldsP3THDP23Name_resolution_contextPKcS4_P13List_iteratorI4ItemEb+0x709)[0x691e39]
/usr/sbin/mysqld(_Z10setup_wildP3THDP10TABLE_LISTR4ListI4ItemEPS5_j+0x23d)[0x69224d]
/usr/sbin/mysqld(_ZN4JOIN7prepareEP10TABLE_LISTjP4ItemjP8st_orderS5_S3_P13st_select_lexP18st_select_lex_unit+0x291)[0x6f7921]
/usr/sbin/mysqld(_ZN18st_select_lex_unit7prepareEP3THDP13select_resultm+0x88b)[0x7451ab]
/usr/sbin/mysqld(_Z21mysql_derived_prepareP3THDP3LEXP10TABLE_LIST+0x12f)[0x6b312f]
/usr/sbin/mysqld(_Z20mysql_handle_derivedP3LEXPFbP3THDS0_P10TABLE_LISTE+0x66)[0x6b2f96]
/usr/sbin/mysqld(_Z30open_normal_and_derived_tablesP3THDP10TABLE_LISTj+0x90)[0x6956e0]
/usr/sbin/mysqld[0x55c704]
/usr/sbin/mysqld(_Z21mysql_execute_commandP3THD+0x1a9c)[0x6da75c]
/usr/lib64/mysql/plugin/libaudit_plugin.so(+0xed36)[0x7f8094736d36]
/usr/sbin/mysqld(_Z11mysql_parseP3THDPcjP12Parser_state+0x5a8)[0x6dfe18]
/usr/sbin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x106f)[0x6e161f]
/usr/sbin/mysqld(_Z24do_handle_one_connectionP3THD+0x162)[0x6adec2]
/usr/sbin/mysqld(handle_one_connection+0x40)[0x6adfb0]
/usr/sbin/mysqld(pfs_spawn_thread+0x143)[0xb39f23]
/lib64/libpthread.so.0[0x3ba2a07aa1]
/lib64/libc.so.6(clone+0x6d)[0x3ba26e893d]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (7f6a2c040280): is an invalid pointer
`

The query itself is about 3.8 MB in size (!!) and although I agree the query is ugly, the plugin should not make mysqld crash. I will post a piece of it below, it is much longer than this but you get the idea as it is like that until the end.

`SELECT * FROM ( SELECT * FROM HOTELS WHERE ID_CITY = '-100027' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM
HOTELS WHERE ID_CITY = '-1000786' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-10
0088' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1001060' AND ID_PROVIDER=2 AND
NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1001125' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excels
ior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-100132' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOT
ELS WHERE ID_CITY = '-1001954' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-100215
6' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1002850' AND ID_PROVIDER=2 AND NAM
E LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1002866' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior
%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-100290' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS
WHERE ID_CITY = '-1003154' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1003232'
AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1003248' AND ID_PROVIDER=2 AND NAME L
IKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1003555' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%'
UNION SELECT * FROM HOTELS WHERE ID_CITY = '-100356' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WH
ERE ID_CITY = '-1003585' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-100452' AND
ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1004589' AND ID_PROVIDER=2 AND NAME LIKE
'%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1004815' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNIO
N SELECT * FROM HOTELS WHERE ID_CITY = '-100499' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE
ID_CITY = '-1005165' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-100534' AND ID_P
ROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1005604' AND ID_PROVIDER=2 AND NAME LIKE '%Br
itannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1006230' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SE
LECT * FROM HOTELS WHERE ID_CITY = '-1006376' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_
CITY = '-1007067' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1007299' AND ID_PRO
VIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1007511' AND ID_PROVIDER=2 AND NAME LIKE '%Brit
annia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1007821' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELE
CT * FROM HOTELS WHERE ID_CITY = '-1008239' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CI
TY = '-1008370' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-100853' AND ID_PROVID
ER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1009158' AND ID_PROVIDER=2 AND NAME LIKE '%Britann
ia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1009225' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT

  • FROM HOTELS WHERE ID_CITY = '-100939' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ....`
@RickPizzi
Copy link
Contributor Author

BTW: tested with latest version of plugin

@aharonrobbins
Copy link

Hi. Can you send me a tarball with the query and with minimal statements to create the table that corresponds to the select? We will try to reproduce and fix.

Please also send your mysqld configuration and version information (mysql version, plugin version, OS version, 64 vs. 32 bit).

Thanks!

Aharon

Aharon (Arnold) Robbins
Senior Software Engineer
Sensor - Database Security
McAfee. Part of Intel Security.
[cid:[email protected]]

From: Rick Pizzi [mailto:[email protected]]
Sent: Monday, July 18, 2016 14:11
To: mcafee/mysql-audit [email protected]
Subject: [mcafee/mysql-audit] plugin crash with very long query (#145)

We are suffering a plugin crash when a very long query is issued. The crash does not happen in the plugin itself, however, it has been verified that the crash does not happen when the audit plugin is not loaded, so here we are.

`stack_bottom = 7f6b4ec34d40 thread_stack 0x40000
/usr/sbin/mysqld(my_print_stacktrace+0x2c)[0x8d2e0c]
/usr/sbin/mysqld(handle_fatal_signal+0x461)[0x6580b1]
/lib64/libpthread.so.0[0x3ba2a0f7e0]
/usr/sbin/mysqld(my_hash_first+0xb)[0x8b5abb]
/usr/sbin/mysqld(my_hash_search+0x11)[0x8b5b21]
/usr/sbin/mysqld(_Z23check_grant_all_columnsP3THDmP24Field_iterator_table_ref+0x125)[0x6713d5]
/usr/sbin/mysqld(_Z13insert_fieldsP3THDP23Name_resolution_contextPKcS4_P13List_iteratorI4ItemEb+0x709)[0x691e39]
/usr/sbin/mysqld(_Z10setup_wildP3THDP10TABLE_LISTR4ListI4ItemEPS5_j+0x23d)[0x69224d]
/usr/sbin/mysqld(_ZN4JOIN7prepareEP10TABLE_LISTjP4ItemjP8st_orderS5_S3_P13st_select_lexP18st_select_lex_unit+0x291)[0x6f7921]
/usr/sbin/mysqld(_ZN18st_select_lex_unit7prepareEP3THDP13select_resultm+0x88b)[0x7451ab]
/usr/sbin/mysqld(_Z21mysql_derived_prepareP3THDP3LEXP10TABLE_LIST+0x12f)[0x6b312f]
/usr/sbin/mysqld(_Z20mysql_handle_derivedP3LEXPFbP3THDS0_P10TABLE_LISTE+0x66)[0x6b2f96]
/usr/sbin/mysqld(_Z30open_normal_and_derived_tablesP3THDP10TABLE_LISTj+0x90)[0x6956e0]
/usr/sbin/mysqld[0x55c704]
/usr/sbin/mysqld(_Z21mysql_execute_commandP3THD+0x1a9c)[0x6da75c]
/usr/lib64/mysql/plugin/libaudit_plugin.so(+0xed36)[0x7f8094736d36]
/usr/sbin/mysqld(_Z11mysql_parseP3THDPcjP12Parser_state+0x5a8)[0x6dfe18]
/usr/sbin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x106f)[0x6e161f]
/usr/sbin/mysqld(_Z24do_handle_one_connectionP3THD+0x162)[0x6adec2]
/usr/sbin/mysqld(handle_one_connection+0x40)[0x6adfb0]
/usr/sbin/mysqld(pfs_spawn_thread+0x143)[0xb39f23]
/lib64/libpthread.so.0[0x3ba2a07aa1]
/lib64/libc.so.6(clone+0x6d)[0x3ba26e893d]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (7f6a2c040280): is an invalid pointer
`

The query itself is about 3.8 MB in size (!!) and although I agree the query is ugly, the plugin should not make mysqld crash. I will post a piece of it below, it is much longer than this but you get the idea as it is like that until the end.

`SELECT * FROM ( SELECT * FROM HOTELS WHERE ID_CITY = '-100027' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM
HOTELS WHERE ID_CITY = '-1000786' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-10
0088' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1001060' AND ID_PROVIDER=2 AND
NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1001125' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excels
ior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-100132' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOT
ELS WHERE ID_CITY = '-1001954' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-100215
6' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1002850' AND ID_PROVIDER=2 AND NAM
E LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1002866' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior
%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-100290' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS
WHERE ID_CITY = '-1003154' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1003232'
AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1003248' AND ID_PROVIDER=2 AND NAME L
IKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1003555' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%'
UNION SELECT * FROM HOTELS WHERE ID_CITY = '-100356' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WH
ERE ID_CITY = '-1003585' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-100452' AND
ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1004589' AND ID_PROVIDER=2 AND NAME LIKE
'%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1004815' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNIO
N SELECT * FROM HOTELS WHERE ID_CITY = '-100499' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE
ID_CITY = '-1005165' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-100534' AND ID_P
ROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1005604' AND ID_PROVIDER=2 AND NAME LIKE '%Br
itannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1006230' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SE
LECT * FROM HOTELS WHERE ID_CITY = '-1006376' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_
CITY = '-1007067' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1007299' AND ID_PRO
VIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1007511' AND ID_PROVIDER=2 AND NAME LIKE '%Brit
annia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1007821' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELE
CT * FROM HOTELS WHERE ID_CITY = '-1008239' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CI
TY = '-1008370' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-100853' AND ID_PROVID
ER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1009158' AND ID_PROVIDER=2 AND NAME LIKE '%Britann
ia Excelsior%' UNION SELECT * FROM HOTELS WHERE ID_CITY = '-1009225' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT

  • FROM HOTELS WHERE ID_CITY = '-100939' AND ID_PROVIDER=2 AND NAME LIKE '%Britannia Excelsior%' UNION SELECT * FROM HOTELS WHERE ....`

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHubhttps://github.com//issues/145, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AKT-vZR80r_2yXue6O671lz5HVp0fVxOks5qW19MgaJpZM4JOnKk.

@RickPizzi
Copy link
Contributor Author

RickPizzi commented Jul 18, 2016 •
edited
Loading

This was easy than expected as the bug bites even with an empty table. Please find attached the original query and a create table statement that you can use to run the query against the table. We are using latest version of your plugin (1.0.9) and our MySQL version is 5.6.29-76.2-log Percona Server on x86.

issue145.tar.gz

@aharonrobbins
Copy link

Much thanks. We will start investigating.

Aharon (Arnold) Robbins
Senior Software Engineer
Sensor - Database Security
McAfee. Part of Intel Security.
[cid:[email protected]]

From: Rick Pizzi [mailto:[email protected]]
Sent: Monday, July 18, 2016 14:49
To: mcafee/mysql-audit [email protected]
Cc: Robbins, Aharon [email protected]; Comment [email protected]
Subject: Re: [mcafee/mysql-audit] plugin crash with very long query (#145)

This was easy than expected as the bug bites even with an empty table. Please find attached the original query and a create table statement that you can use to run the query against the schema. We are using latest version of your plugin (1.0.9) and our MySQL version is 5.6.29-76.2-log Percona Server on x86.

issue145.tar.gzhttps://github.com/mcafee/mysql-audit/files/368934/issue145.tar.gz

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHubhttps://github.com//issues/145#issuecomment-233307703, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AKT-vbuSB74HOZxurrjuRUaqkSoFOpi6ks5qW2gQgaJpZM4JOnKk.

@aharonrobbins
Copy link

I have reproduced this on generic MySQL 5.6.29. We’re working on it.

Thanks!

Aharon (Arnold) Robbins
Senior Software Engineer
Sensor - Database Security
McAfee. Part of Intel Security.
[cid:[email protected]]

From: Rick Pizzi [mailto:[email protected]]
Sent: Monday, July 18, 2016 14:49
To: mcafee/mysql-audit [email protected]
Cc: Robbins, Aharon [email protected]; Comment [email protected]
Subject: Re: [mcafee/mysql-audit] plugin crash with very long query (#145)

This was easy than expected as the bug bites even with an empty table. Please find attached the original query and a create table statement that you can use to run the query against the schema. We are using latest version of your plugin (1.0.9) and our MySQL version is 5.6.29-76.2-log Percona Server on x86.

issue145.tar.gzhttps://github.com/mcafee/mysql-audit/files/368934/issue145.tar.gz

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHubhttps://github.com//issues/145#issuecomment-233307703, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AKT-vbuSB74HOZxurrjuRUaqkSoFOpi6ks5qW2gQgaJpZM4JOnKk.

@RickPizzi
Copy link
Contributor Author

Any news? This problem keeps biting us....

@aharonrobbins
Copy link

Hi.

We have reproduced the problem. It’s quite a nasty one, unfortunately. We are working on it.

Is there any way you can reduce the size of that query? Just wondering.

Thanks,

Aharon

Aharon (Arnold) Robbins
Senior Software Engineer
Sensor - Database Security
McAfee. Part of Intel Security.
[cid:[email protected]]

From: Rick Pizzi [mailto:[email protected]]
Sent: Wednesday, August 17, 2016 11:18
To: mcafee/mysql-audit [email protected]
Cc: Robbins, Aharon [email protected]; Comment [email protected]
Subject: Re: [mcafee/mysql-audit] plugin crash with very long query (#145)

Any news? This problem keeps biting us....

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHubhttps://github.com//issues/145#issuecomment-240344883, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AKT-vXN1BdagVHpxuk3EWRmYwz1AEzfxks5qgsPVgaJpZM4JOnKk.

@RickPizzi
Copy link
Contributor Author

The app team said they fixed that query, but some other unrelated issues are delaying the deployment of the version with the fix in production.
Anyways thank you for a nice piece of software and please keep me posted on the development of the fix.

Rick
—
Riccardo Pizzi
[email protected]
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster

On 17 Aug 2016, at 12:25, aharonrobbins [email protected] wrote:

Hi.

We have reproduced the problem. It’s quite a nasty one, unfortunately. We are working on it.

Is there any way you can reduce the size of that query? Just wondering.

Thanks,

Aharon

Aharon (Arnold) Robbins
Senior Software Engineer
Sensor - Database Security
McAfee. Part of Intel Security.
[cid:[email protected]]

From: Rick Pizzi [mailto:[email protected]]
Sent: Wednesday, August 17, 2016 11:18
To: mcafee/mysql-audit [email protected]
Cc: Robbins, Aharon [email protected]; Comment [email protected]
Subject: Re: [mcafee/mysql-audit] plugin crash with very long query (#145)

Any news? This problem keeps biting us....

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHubhttps://github.com//issues/145#issuecomment-240344883, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AKT-vXN1BdagVHpxuk3EWRmYwz1AEzfxks5qgsPVgaJpZM4JOnKk.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.

@aharonrobbins
Copy link

HI.

I managed to track down the problem!

I will start working on a fix tomorrow.

Thanks

Aharon

Aharon (Arnold) Robbins
Senior Software Engineer
Sensor - Database Security
McAfee. Part of Intel Security.
[cid:[email protected]]

From: Rick Pizzi [mailto:[email protected]]
Sent: Wednesday, August 17, 2016 13:27
To: mcafee/mysql-audit [email protected]
Cc: Robbins, Aharon [email protected]; Comment [email protected]
Subject: Re: [mcafee/mysql-audit] plugin crash with very long query (#145)

The app team said they fixed that query, but some other unrelated issues are delaying the deployment of the version with the fix in production.
Anyways thank you for a nice piece of software and please keep me posted on the development of the fix.

Rick
—
Riccardo Pizzi
[email protected]:[email protected]
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster

On 17 Aug 2016, at 12:25, aharonrobbins <[email protected]mailto:[email protected]> wrote:

Hi.

We have reproduced the problem. It’s quite a nasty one, unfortunately. We are working on it.

Is there any way you can reduce the size of that query? Just wondering.

Thanks,

Aharon

Aharon (Arnold) Robbins
Senior Software Engineer
Sensor - Database Security
McAfee. Part of Intel Security.
[cid:[email protected]]

From: Rick Pizzi [mailto:[email protected]]
Sent: Wednesday, August 17, 2016 11:18
To: mcafee/mysql-audit <[email protected]mailto:[email protected]>
Cc: Robbins, Aharon <[email protected]mailto:[email protected]>; Comment <[email protected]mailto:[email protected]>
Subject: Re: [mcafee/mysql-audit] plugin crash with very long query (#145)

Any news? This problem keeps biting us....

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHubhttps://github.com//issues/145#issuecomment-240344883, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AKT-vXN1BdagVHpxuk3EWRmYwz1AEzfxks5qgsPVgaJpZM4JOnKk.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHubhttps://github.com//issues/145#issuecomment-240373746, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AKT-vUEG_jJrhjLKBWH7R--r2Gqe3hNpks5qguIQgaJpZM4JOnKk.

@RickPizzi
Copy link
Contributor Author

RickPizzi commented Aug 17, 2016 •
edited
Loading

Great!!
Looking forward for the fix :-)

Rick

On 17 Aug 2016, at 17:37, aharonrobbins [email protected] wrote:

HI.

I managed to track down the problem!

I will start working on a fix tomorrow.

Thanks

Aharon

Aharon (Arnold) Robbins
Senior Software Engineer
Sensor - Database Security
McAfee. Part of Intel Security.
[cid:[email protected]]

From: Rick Pizzi [mailto:[email protected]]
Sent: Wednesday, August 17, 2016 13:27
To: mcafee/mysql-audit [email protected]
Cc: Robbins, Aharon [email protected]; Comment [email protected]
Subject: Re: [mcafee/mysql-audit] plugin crash with very long query (#145)

The app team said they fixed that query, but some other unrelated issues are delaying the deployment of the version with the fix in production.
Anyways thank you for a nice piece of software and please keep me posted on the development of the fix.

Rick
—
Riccardo Pizzi
[email protected]:[email protected]
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster

On 17 Aug 2016, at 12:25, aharonrobbins <[email protected]mailto:[email protected]> wrote:

Hi.

We have reproduced the problem. It’s quite a nasty one, unfortunately. We are working on it.

Is there any way you can reduce the size of that query? Just wondering.

Thanks,

Aharon

Aharon (Arnold) Robbins
Senior Software Engineer
Sensor - Database Security
McAfee. Part of Intel Security.
[cid:[email protected]]

From: Rick Pizzi [mailto:[email protected]]
Sent: Wednesday, August 17, 2016 11:18
To: mcafee/mysql-audit <[email protected]mailto:[email protected]>
Cc: Robbins, Aharon <[email protected]mailto:[email protected]>; Comment <[email protected]mailto:[email protected]>
Subject: Re: [mcafee/mysql-audit] plugin crash with very long query (#145)

Any news? This problem keeps biting us....

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHubhttps://github.com//issues/145#issuecomment-240344883, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AKT-vXN1BdagVHpxuk3EWRmYwz1AEzfxks5qgsPVgaJpZM4JOnKk.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHubhttps://github.com//issues/145#issuecomment-240373746, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AKT-vUEG_jJrhjLKBWH7R--r2Gqe3hNpks5qguIQgaJpZM4JOnKk.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.

aharonrobbins pushed a commit that referenced this issue Aug 25, 2016
@arnoldrobbins
Fix issue #145 - 3.8M query crashes MySQL. Fix was to use correct
bb5a76f 
prototype for check_table_access() function.
@aharonrobbins
Copy link

I have just pushed the fix to the source code, and uploaded dev-snapshot binaries to bintray.com. Let us know how it goes. Thanks for finding and reporting this issue.

@RickPizzi
Copy link
Contributor Author

Arnold, thanks for fixing this.
Is the snapshot version safe for production use?

Thanks
Rick
—
Riccardo Pizzi
[email protected]
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster

On 25 Aug 2016, at 12:40, aharonrobbins [email protected] wrote:

I have just pushed the fix to the source code, and uploaded dev-snapshot binaries to bintray.com. Let us know how it goes. Thanks for finding and reporting this issue.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.

@aharonrobbins
Copy link

It should be safe. Maybe try in a test environment to be sure, but there haven’t been major upheavals in the code.

Thanks,

Aharon

Aharon (Arnold) Robbins
Senior Software Engineer
Sensor - Database Security
McAfee. Part of Intel Security.
[cid:[email protected]]

From: Rick Pizzi [mailto:[email protected]]
Sent: Thursday, August 25, 2016 13:52
To: mcafee/mysql-audit [email protected]
Cc: Robbins, Aharon [email protected]; State change [email protected]
Subject: Re: [mcafee/mysql-audit] plugin crash with very long query (#145)

Arnold, thanks for fixing this.
Is the snapshot version safe for production use?

Thanks
Rick
—
Riccardo Pizzi
[email protected]:[email protected]
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster

On 25 Aug 2016, at 12:40, aharonrobbins <[email protected]mailto:[email protected]> wrote:

I have just pushed the fix to the source code, and uploaded dev-snapshot binaries to bintray.com. Let us know how it goes. Thanks for finding and reporting this issue.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.

—
You are receiving this because you modified the open/close state.
Reply to this email directly, view it on GitHubhttps://github.com//issues/145#issuecomment-242347960, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AKT-vXE2vlY2odCfpDAdttDaeKwncw9Aks5qjXPIgaJpZM4JOnKk.

@RickPizzi
Copy link
Contributor Author

I’m asking because we have 1.0.9 (release) all over. Of course we can replace with snapshot only where the bug bites. Any idea when 1.1.0 will be GA?

Thanks again for your hard work.

Rick
—
Riccardo Pizzi
[email protected]
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster

On 25 Aug 2016, at 12:55, aharonrobbins [email protected] wrote:

It should be safe. Maybe try in a test environment to be sure, but there haven’t been major upheavals in the code.

Thanks,

Aharon

Aharon (Arnold) Robbins
Senior Software Engineer
Sensor - Database Security
McAfee. Part of Intel Security.
[cid:[email protected]]

From: Rick Pizzi [mailto:[email protected]]
Sent: Thursday, August 25, 2016 13:52
To: mcafee/mysql-audit [email protected]
Cc: Robbins, Aharon [email protected]; State change [email protected]
Subject: Re: [mcafee/mysql-audit] plugin crash with very long query (#145)

Arnold, thanks for fixing this.
Is the snapshot version safe for production use?

Thanks
Rick
—
Riccardo Pizzi
[email protected]:[email protected]
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster

On 25 Aug 2016, at 12:40, aharonrobbins <[email protected]mailto:[email protected]> wrote:

I have just pushed the fix to the source code, and uploaded dev-snapshot binaries to bintray.com. Let us know how it goes. Thanks for finding and reporting this issue.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.

—
You are receiving this because you modified the open/close state.
Reply to this email directly, view it on GitHubhttps://github.com//issues/145#issuecomment-242347960, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AKT-vXE2vlY2odCfpDAdttDaeKwncw9Aks5qjXPIgaJpZM4JOnKk.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.

@aharonrobbins
Copy link

I would suggest replacing 1.0.9 just where the bug bites. That minimizes your risk.

No schedule at the moment for 1.1.0. But again, there’s not a lot of difference. The main changes were to update the pcre and yajl libraries to the most current version, adding offsets for more releases, and bug fixes for major issues, all as noted in the ChangeLog on the wiki.

Hope this helps,

Aharon

Aharon (Arnold) Robbins
Senior Software Engineer
Sensor - Database Security
McAfee. Part of Intel Security.
[cid:[email protected]]

From: Rick Pizzi [mailto:[email protected]]
Sent: Thursday, August 25, 2016 13:58
To: mcafee/mysql-audit [email protected]
Cc: Robbins, Aharon [email protected]; State change [email protected]
Subject: Re: [mcafee/mysql-audit] plugin crash with very long query (#145)

I’m asking because we have 1.0.9 (release) all over. Of course we can replace with snapshot only where the bug bites. Any idea when 1.1.0 will be GA?

Thanks again for your hard work.

Rick
—
Riccardo Pizzi
[email protected]:[email protected]
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster

On 25 Aug 2016, at 12:55, aharonrobbins <[email protected]mailto:[email protected]> wrote:

It should be safe. Maybe try in a test environment to be sure, but there haven’t been major upheavals in the code.

Thanks,

Aharon

Aharon (Arnold) Robbins
Senior Software Engineer
Sensor - Database Security
McAfee. Part of Intel Security.
[cid:[email protected]]

From: Rick Pizzi [mailto:[email protected]]
Sent: Thursday, August 25, 2016 13:52
To: mcafee/mysql-audit <[email protected]mailto:[email protected]>
Cc: Robbins, Aharon <[email protected]mailto:[email protected]>; State change <[email protected]mailto:[email protected]>
Subject: Re: [mcafee/mysql-audit] plugin crash with very long query (#145)

Arnold, thanks for fixing this.
Is the snapshot version safe for production use?

Thanks
Rick
—
Riccardo Pizzi
[email protected]:[email protected]mailto:[email protected]%3cmailto:[email protected]
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster

On 25 Aug 2016, at 12:40, aharonrobbins <[email protected]<mailto:[email protected]mailto:[email protected]%3cmailto:[email protected]>> wrote:

I have just pushed the fix to the source code, and uploaded dev-snapshot binaries to bintray.com. Let us know how it goes. Thanks for finding and reporting this issue.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.

—
You are receiving this because you modified the open/close state.
Reply to this email directly, view it on GitHubhttps://github.com//issues/145#issuecomment-242347960, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AKT-vXE2vlY2odCfpDAdttDaeKwncw9Aks5qjXPIgaJpZM4JOnKk.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.

—
You are receiving this because you modified the open/close state.
Reply to this email directly, view it on GitHubhttps://github.com//issues/145#issuecomment-242349104, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AKT-vck6Cty25nxK_2EE4nyMydqSDnA-ks5qjXUqgaJpZM4JOnKk.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@RickPizzi @aharonrobbins