database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-08 11:22:35 +03:00
Code Activity

MDEV-24620 ASAN heap-buffer-overflow in btr_pcur_restore_position()

Browse Source 
Between btr_pcur_store_position() and btr_pcur_restore_position()
it is possible that purge empties a table and enlarges
index->n_core_fields and index->n_core_null_bytes.
Therefore, we must cache index->n_core_fields in
btr_pcur_t::old_n_core_fields so that btr_pcur_t::old_rec can be
parsed correctly.

Unfortunately, this is a huge change, because we will replace
"bool leaf" parameters with "ulint n_core"
(passing index->n_core_fields, or 0 for non-leaf pages).
For special cases where we know that index->is_instant() cannot hold,
we may also pass index->n_fields.
This commit is contained in:
Marko Mäkelä
2021-04-13 10:28:13 +03:00
parent 6e6318b29b
commit b8c8692fd9
42 changed files with 614 additions and 421 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
mysql-test/suite/innodb/t/instant_alter_debug.test
View File

@@ -364,6 +364,44 @@ DROP TABLE t1;
SET GLOBAL innodb_limit_optimistic_insert_debug = @saved_limit;
--echo #
--echo # MDEV-24620 ASAN heap-buffer-overflow in btr_pcur_restore_position()
--echo #
CREATE TABLE t1 (a VARCHAR(1) PRIMARY KEY) ENGINE=InnoDB;
INSERT INTO t1 VALUES (1);
connect (stop_purge,localhost,root,,);
START TRANSACTION WITH CONSISTENT SNAPSHOT;
connection default;
ALTER TABLE t1 ADD c INT;
BEGIN;
DELETE FROM t1;
connect (dml,localhost,root,,test);
SET DEBUG_SYNC='row_mysql_handle_errors SIGNAL s1 WAIT_FOR s2';
send UPDATE t1 SET c=1;
connection default;
SET DEBUG_SYNC='now WAIT_FOR s1';
COMMIT;
connection stop_purge;
COMMIT;
disconnect stop_purge;
connection default;
--source include/wait_all_purged.inc
SET DEBUG_SYNC='now SIGNAL s2';
connection dml;
reap;
disconnect dml;
connection default;
SET DEBUG_SYNC=RESET;
DROP TABLE t1;
--echo # End of 10.3 tests
SET GLOBAL innodb_purge_rseg_truncate_frequency = @save_frequency;