{184399398}: fix lua stackoverflow on temp table#5982
Open
emelialei88 wants to merge 1 commit into
Open
Conversation
roborivers
approved these changes
May 28, 2026
roborivers
left a comment
There was a problem hiding this comment.
Cbuild submission: Success ✓.
Regression testing: Success ✓.
The first 10 failing tests are:
sc_resume_logicalsc_generated **quarantined**
noresetgen
consumer_non_atomic_default_consumer_generated **quarantined**
reco-ddlk-sql [timeout] **quarantined**
Signed-off-by: Emelia Lei <wlei29@bloomberg.net>
roborivers
approved these changes
May 30, 2026
roborivers
left a comment
There was a problem hiding this comment.
Cbuild submission: Success ✓.
Regression testing: Success ✓.
The first 10 failing tests are:
sc_timepart **quarantined**
consumer_non_atomic_default_consumer_generated **quarantined**
remotecreate_twopc_generated
remotecreate
reco-ddlk-sql [timeout] **quarantined**
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
create_temp_tableinlua/sp.cusedallocato allocate the DDL string on the stack, sized by the user-supplied column type string. A malicious or buggy SP passing a huge type (e.g.string.rep('TEXT ', 2000000)) intodb:table()would blow the stack and crash the DB.Changes
lua/sp.c: validate column name/type from the Lua table — rejectNULLor oversized values (name >MAXTABLELEN, type > 64). Replacealloca(len)withmalloc(len)so large DDLs go to the heap, with matchingfree()on all exit paths.tests/sp.test/t21.req/t21.req.out: new regression test (ddlbomb) that constructs a 10MB type string and confirms the SP fails cleanly withbad column name or type in 'table'instead of crashing.Notes
The comment about
lua_prepare_sql_with_temp_ddlpotentiallylongjmp-ing and leakingddlis preserved — the leak is bounded and exceptional, same trade-off as before.