diff --git a/storage/innobase/handler/handler0alter.cc b/storage/innobase/handler/handler0alter.cc index 29485f22079..d3f8dbbfd29 100644 --- a/storage/innobase/handler/handler0alter.cc +++ b/storage/innobase/handler/handler0alter.cc @@ -4165,7 +4165,8 @@ innobase_build_col_map( == dict_table_get_n_cols(new_table)); DBUG_ASSERT(table->s->stored_fields > 0); - const size_t old_n_v_cols = table->s->fields - table->s->stored_fields; + const uint old_n_v_cols = uint(table->s->fields + - table->s->stored_fields); DBUG_ASSERT(old_n_v_cols == old_table->n_v_cols || table->s->frm_version < FRM_VER_EXPRESSSIONS); DBUG_ASSERT(!old_n_v_cols || table->s->virtual_fields); diff --git a/storage/innobase/include/pars0sym.h b/storage/innobase/include/pars0sym.h index c9a5bb5fac2..5108db79322 100644 --- a/storage/innobase/include/pars0sym.h +++ b/storage/innobase/include/pars0sym.h @@ -1,7 +1,7 @@ /***************************************************************************** Copyright (c) 1997, 2016, Oracle and/or its affiliates. All Rights Reserved. -Copyright (c) 2017, 2018, MariaDB Corporation. +Copyright (c) 2017, 2019, MariaDB Corporation. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software @@ -224,7 +224,7 @@ struct sym_tab_t{ /*!< SQL string to parse */ size_t string_len; /*!< SQL string length */ - int next_char_pos; + size_t next_char_pos; /*!< position of the next character in sql_string to give to the lexical analyzer */ diff --git a/storage/innobase/log/log0recv.cc b/storage/innobase/log/log0recv.cc index 70a705cd026..4840bf3088a 100644 --- a/storage/innobase/log/log0recv.cc +++ b/storage/innobase/log/log0recv.cc @@ -445,14 +445,29 @@ fil_name_parse( and end in .ibd. */ bool corrupt = is_predefined_tablespace(space_id) || len < sizeof "/a.ibd\0" - || (!first_page_no != !memcmp(ptr + len - 5, DOT_IBD, 5)) - || memchr(ptr, OS_PATH_SEPARATOR, len) == NULL; + || (!first_page_no != !memcmp(ptr + len - 5, DOT_IBD, 5)); + + if (!corrupt && !memchr(ptr, OS_PATH_SEPARATOR, len)) { + if (byte* c = static_cast + (memchr(ptr, OS_PATH_SEPARATOR_ALT, len))) { + ut_ad(c >= ptr); + ut_ad(c < ptr + len); + do { + *c = OS_PATH_SEPARATOR; + } while ((c = static_cast + (memchr(ptr, OS_PATH_SEPARATOR_ALT, + len - ulint(c - ptr)))) != NULL); + } else { + corrupt = true; + } + } byte* end_ptr = ptr + len; switch (type) { default: ut_ad(0); // the caller checked this + /* fall through */ case MLOG_FILE_NAME: if (corrupt) { ib::error() << "MLOG_FILE_NAME incorrect:" << ptr; @@ -513,8 +528,25 @@ fil_name_parse( corrupt = corrupt || new_len < sizeof "/a.ibd\0" - || memcmp(new_name + new_len - 5, DOT_IBD, 5) != 0 - || !memchr(new_name, OS_PATH_SEPARATOR, new_len); + || memcmp(new_name + new_len - 5, DOT_IBD, 5) != 0; + + if (!corrupt && !memchr(new_name, OS_PATH_SEPARATOR, new_len)) { + if (byte* c = static_cast + (memchr(new_name, OS_PATH_SEPARATOR_ALT, + new_len))) { + ut_ad(c >= new_name); + ut_ad(c < new_name + new_len); + do { + *c = OS_PATH_SEPARATOR; + } while ((c = static_cast + (memchr(ptr, OS_PATH_SEPARATOR_ALT, + new_len + - ulint(c - new_name)))) + != NULL); + } else { + corrupt = true; + } + } if (corrupt) { ib::error() << "MLOG_FILE_RENAME2 new_name incorrect:" << ptr @@ -1545,8 +1577,7 @@ parse_log: break; case MLOG_ZIP_PAGE_COMPRESS: /* Allow anything in page_type when creating a page. */ - ptr = page_zip_parse_compress(ptr, end_ptr, - page, page_zip); + ptr = page_zip_parse_compress(ptr, end_ptr, page, page_zip); break; case MLOG_ZIP_PAGE_COMPRESS_NO_DATA: if (NULL != (ptr = mlog_parse_index( diff --git a/storage/innobase/pars/pars0pars.cc b/storage/innobase/pars/pars0pars.cc index 4c3343a60ae..363ca69a09b 100644 --- a/storage/innobase/pars/pars0pars.cc +++ b/storage/innobase/pars/pars0pars.cc @@ -2069,9 +2069,8 @@ pars_get_lex_chars( size_t max_size) /*!< in: maximum number of characters which fit in the buffer */ { - size_t len = size_t( - pars_sym_tab_global->string_len - - pars_sym_tab_global->next_char_pos); + size_t len = pars_sym_tab_global->string_len + - pars_sym_tab_global->next_char_pos; if (len == 0) { return(0); } @@ -2081,7 +2080,7 @@ pars_get_lex_chars( } memcpy(buf, pars_sym_tab_global->sql_string - + pars_sym_tab_global->next_char_pos, ulint(len)); + + pars_sym_tab_global->next_char_pos, len); pars_sym_tab_global->next_char_pos += len;