MDEV-40636 CSV crashes on DELETE

chain_size is the number of tina_set elements, not number of bytes

Assisted-By: Claude:claude-5-opus

mysql-test/suite/csv/delete.result

@@ -0,0 +1,11 @@
+#
+# MDEV-40636 CSV crashes on DELETE
+#
+create table t1 (id int not null, pad char(10) not null) engine=csv;
+insert t1 select seq,'AAAAAAAAAA' from seq_1_to_2048;
+delete from t1 where id % 2 = 0;
+select count(*), sum(id) from t1;
+count(*)	sum(id)
+1024	1048576
+drop table t1;
+# End of 10.6 tests

mysql-test/suite/csv/delete.test

@@ -0,0 +1,13 @@
+--source include/have_csv.inc
+--source include/have_sequence.inc
+
+--echo #
+--echo # MDEV-40636 CSV crashes on DELETE
+--echo #
+create table t1 (id int not null, pad char(10) not null) engine=csv;
+insert t1 select seq,'AAAAAAAAAA' from seq_1_to_2048;
+delete from t1 where id % 2 = 0;
+select count(*), sum(id) from t1;
+drop table t1;
+
+--echo # End of 10.6 tests

storage/csv/ha_tina.cc

@@ -1,4 +1,5 @@
 /* Copyright (c) 2004, 2011, Oracle and/or its affiliates.
+   Copyright (c) 2026, MariaDB plc
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -646,7 +647,8 @@ int ha_tina::chain_append()
       if (chain_alloced)
       {
         if ((chain= (tina_set *) my_realloc(csv_key_memory_tina_set,
-                                            (uchar*)chain, chain_size,
+                                            (uchar*)chain,
+                                            chain_size * sizeof(tina_set),
                                             MYF(MY_WME))) == NULL)
           return -1;
       }