database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

MDEV-10694 - SIGFPE and/or huge memory allocation in maria_create ...

Browse Source 
The issue was that JOIN::rollup_write_data() used
JOIN::tmp_table_param::[start_]recinfo, which had uninitialized data.

These fields have uninitialized data, because JOIN::tmp_table_param
currently only stores some grouping-related data fields.  The data about
the work (temporary) tables themselves is stored in
join->join_tab[...].tmp_table_param.

The fix is to make JOIN::rollup_write_data follow this convention
and look at the right TMP_TABLE_PARAM object
This commit is contained in:
Sergei Petrunia
2017-02-14 07:18:55 -08:00
parent 24911cee4e
commit e688d81444
4 changed files with 25 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
sql/sql_select.cc
View File

@ -20037,8 +20037,11 @@ end_write_group(JOIN *join, JOIN_TAB *join_tab __attribute__((unused)),
}
if (join->rollup.state != ROLLUP::STATE_NONE)
{
if (join->rollup_write_data((uint) (idx+1), table))
if (join->rollup_write_data((uint) (idx+1),
join_tab->tmp_table_param, table))
{
DBUG_RETURN(NESTED_LOOP_ERROR);
}
}
if (end_of_records)
goto end;
@ -23844,7 +23847,7 @@ int JOIN::rollup_send_data(uint idx)
1 if write_data_failed()
*/
int JOIN::rollup_write_data(uint idx, TABLE *table_arg)
int JOIN::rollup_write_data(uint idx, TMP_TABLE_PARAM *tmp_table_param_arg, TABLE *table_arg)
{
uint i;
for (i= send_group_parts ; i-- > idx ; )
@ -23865,8 +23868,8 @@ int JOIN::rollup_write_data(uint idx, TABLE *table_arg)
if ((write_error= table_arg->file->ha_write_tmp_row(table_arg->record[0])))
{
if (create_internal_tmp_table_from_heap(thd, table_arg,
tmp_table_param.start_recinfo,
&tmp_table_param.recinfo,
tmp_table_param_arg->start_recinfo,
&tmp_table_param_arg->recinfo,
write_error, 0, NULL))
return 1;
}