MDEV-40648: Replication Undefined Behavior on Malformed Rotate Log Event

[bnestere]

A slave stops with a relay log read failure when its master sends an
event whose header declares a length other than the number of bytes the
event arrived in. The file and position the slave reports for that
failure are not where the problem is. A master that logs no checksum
does not stop the slave at all. Such a master can make the slave run one
statement twice, leaving the slave's data holding a row the master's
binary log never carried. A "malicious" master can already send whatever
events it likes, so what this defeats is comparing a slave's applied
stream against the master's binary log.

The slave IO thread reads each event from the master as one network
packet, and writes that packet into the relay log unchanged, using the
packet's own length. Every later reader of that relay log frames the
events by a different length: the one each event's header declares at
EVENT_LEN_OFFSET. A master writing an event sets the two to the same
value. Log_event::read_log_event(), which parses the events that
queue_event() does not construct itself, checks only that the packet
reaches EVENT_LEN_OFFSET, and never compares the declared length with
the length of the packet.

queue_event() never compared the two lengths either. An event declaring
fewer bytes than the packet held reached the relay log with the extra
bytes behind the event. The SQL thread framed its next read from inside
the previous event. Where the master had placed a complete event in
those extra bytes, and no checksum covered the packet, the SQL thread
applied that second event.

This patch adds validation to ensure the lengths are equal. An event
whose lengths disagree will stop the IO thread with
ER_SLAVE_FATAL_ERROR, and the relay log will never receive the event.

This PR is organized in two commits. The first is the regression test and
debug injections; the second is the fix and .result file.

[knielsen]

Brandon Nesterenko ***@***.***> writes:

A slave stops with a relay log read failure when its master sends an event whose header declares a length other than the number of bytes the event arrived in. The file and position the slave reports for that

Looks good to me, thanks Brandon! This patch rejects a network packet that is longer than the event length. This will prevent us from later sending additional data after the actual event in the same network packet (for whatever future reason), and have an old slave version ignore such data. Whereas the alternative, to reject only too short network packet, would allow such backwards-compatible extension. I think it is fine as done in this patch, probably fine to be restrictive, the slave capability mechanism could be used instead if ever needed. So this is just a remark, not a request to change anything. Reviewed-by: Kristian Nielsen ***@***.***>