database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-30 16:24:05 +03:00
Code Activity

MDEV-22113 SIGSEGV, ASAN use-after-poison, Assertion `next_insert_id == 0' in handler::ha_external_lock

Browse Source 
if the lookup_handler is allocated on the THD's memroot, it may
not live long enough to be deleted in handler::ha_external_lock()
This commit is contained in:
Sergei Golubchik
2020-04-02 14:03:19 +02:00
parent a5686e14d9
commit 3bb5c6b0c2
3 changed files with 29 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
sql/handler.cc
View File

@ -6481,14 +6481,6 @@ int handler::ha_external_lock(THD *thd, int lock_type)
mysql_audit_external_lock(thd, table_share, lock_type);
}
if (lock_type == F_UNLCK && lookup_handler != this)
{
lookup_handler->ha_external_lock(table->in_use, F_UNLCK);
lookup_handler->close();
delete lookup_handler;
lookup_handler= this;
}
if (MYSQL_HANDLER_RDLOCK_DONE_ENABLED() ||
MYSQL_HANDLER_WRLOCK_DONE_ENABLED() ||
MYSQL_HANDLER_UNLOCK_DONE_ENABLED())
@ -6540,6 +6532,13 @@ int handler::ha_reset()
/* Reset information about pushed index conditions */
cancel_pushed_rowid_filter();
clear_top_table_fields();
if (lookup_handler != this)
{
lookup_handler->ha_external_lock(table->in_use, F_UNLCK);
lookup_handler->close();
delete lookup_handler;
lookup_handler= this;
}
DBUG_RETURN(reset());
}