database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-09 22:24:09 +03:00
Code Activity

MDEV-18707 Server crash in my_hash_sort_bin, ASAN heap-use-after-free in Field::is_null, server hang, corrupted double-linked list

Browse Source 
adjust share->stored_rec_length for LONG_UNIQUE_HASH_FIELD,
just like it's done for normal virtual fields
This commit is contained in:
Sergei Golubchik
2019-02-27 02:38:46 +01:00
parent 0477e80522
commit 5adf11250a
4 changed files with 36 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
mysql-test/main/long_unique.result
View File

@@ -43,7 +43,7 @@ MyISAM file: DATADIR/test/t1
Record format: Packed
Character set: latin1_swedish_ci (8)
Data records: 10 Deleted blocks: 0
Recordlength: 20
Recordlength: 12
table description:
Key Start Len Index Type
@@ -131,7 +131,7 @@ MyISAM file: DATADIR/test/t1
Record format: Packed
Character set: latin1_swedish_ci (8)
Data records: 7 Deleted blocks: 0
Recordlength: 20
Recordlength: 12
table description:
Key Start Len Index Type
@@ -366,7 +366,7 @@ MyISAM file: DATADIR/test/t1
Record format: Packed
Character set: latin1_swedish_ci (8)
Data records: 8 Deleted blocks: 0
Recordlength: 3072
Recordlength: 3040
table description:
Key Start Len Index Type
@@ -723,7 +723,7 @@ MyISAM file: DATADIR/test/t1
Record format: Packed
Character set: latin1_swedish_ci (8)
Data records: 9 Deleted blocks: 0
Recordlength: 5092
Recordlength: 5059
table description:
Key Start Len Index Type

12
mysql-test/main/long_unique_bugs.result Normal file
View File

@@ -0,0 +1,12 @@
create table t1 (a int, b int, c int, d int, e int);
insert into t1 () values
(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),
(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),
(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),
(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),
(),(),(),();
select * into outfile 'load.data' from t1;
create temporary table tmp (a varchar(1024), b int, c int, d int, e linestring, unique (e));
load data infile 'load.data' into table tmp;
delete from tmp;
drop table t1;

17
mysql-test/main/long_unique_bugs.test Normal file
View File

@@ -0,0 +1,17 @@
#
# MDEV-18707 Server crash in my_hash_sort_bin, ASAN heap-use-after-free in Field::is_null, server hang, corrupted double-linked list
#
create table t1 (a int, b int, c int, d int, e int);
insert into t1 () values
(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),
(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),
(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),
(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(),
(),(),(),();
select * into outfile 'load.data' from t1;
create temporary table tmp (a varchar(1024), b int, c int, d int, e linestring, unique (e));
load data infile 'load.data' into table tmp;
delete from tmp;
drop table t1;
--let $datadir= `SELECT @@datadir`
--remove_file $datadir/test/load.data

3
sql/table.cc
View File

@@ -2449,6 +2449,9 @@ int TABLE_SHARE::init_from_binary_frm_image(THD *thd, bool write,
hash_field->flags|= LONG_UNIQUE_HASH_FIELD;//Used in parse_vcol_defs
keyinfo->flags|= HA_NOSAME;
share->virtual_fields++;
share->stored_fields--;
if (record + share->stored_rec_length >= hash_field->ptr)
share->stored_rec_length= (ulong)(hash_field->ptr - record - 1);
hash_field_used_no++;
offset+= HA_HASH_FIELD_LENGTH;
}