database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

MDEV-24620 ASAN heap-buffer-overflow in btr_pcur_restore_position()

Browse Source 
Between btr_pcur_store_position() and btr_pcur_restore_position()
it is possible that purge empties a table and enlarges
index->n_core_fields and index->n_core_null_bytes.
Therefore, we must cache index->n_core_fields in
btr_pcur_t::old_n_core_fields so that btr_pcur_t::old_rec can be
parsed correctly.

Unfortunately, this is a huge change, because we will replace
"bool leaf" parameters with "ulint n_core"
(passing index->n_core_fields, or 0 for non-leaf pages).
For special cases where we know that index->is_instant() cannot hold,
we may also pass index->n_fields.
This commit is contained in:
Marko Mäkelä
2021-04-13 10:28:13 +03:00
parent 6e6318b29b
commit b8c8692fd9
42 changed files with 614 additions and 421 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
mysql-test/suite/innodb/r/instant_alter_debug.result
View File

@ -317,5 +317,33 @@ SELECT * FROM t1 WHERE c<>1 ORDER BY c DESC;
c d
DROP TABLE t1;
SET GLOBAL innodb_limit_optimistic_insert_debug = @saved_limit;
#
# MDEV-24620 ASAN heap-buffer-overflow in btr_pcur_restore_position()
#
CREATE TABLE t1 (a VARCHAR(1) PRIMARY KEY) ENGINE=InnoDB;
INSERT INTO t1 VALUES (1);
connect stop_purge,localhost,root,,;
START TRANSACTION WITH CONSISTENT SNAPSHOT;
connection default;
ALTER TABLE t1 ADD c INT;
BEGIN;
DELETE FROM t1;
connect dml,localhost,root,,test;
SET DEBUG_SYNC='row_mysql_handle_errors SIGNAL s1 WAIT_FOR s2';
UPDATE t1 SET c=1;
connection default;
SET DEBUG_SYNC='now WAIT_FOR s1';
COMMIT;
connection stop_purge;
COMMIT;
disconnect stop_purge;
connection default;
InnoDB 0 transactions not purged
SET DEBUG_SYNC='now SIGNAL s2';
connection dml;
disconnect dml;
connection default;
SET DEBUG_SYNC=RESET;
DROP TABLE t1;
# End of 10.3 tests
SET GLOBAL innodb_purge_rseg_truncate_frequency = @save_frequency;