database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

MDEV-29520 heap-use-after-poison in row_merge_spatial_rows()

Browse Source 
row_merge_read_clustered_index(): Do not call mem_heap_empty(row_heap)
before row_merge_spatial_rows() has been able to read the data.
This commit is contained in:
Marko Mäkelä
2022-09-13 08:58:34 +03:00
parent f1544424de
commit fc794fd8ff
3 changed files with 28 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
mysql-test/suite/innodb_gis/r/alter_spatial_index.result
View File

@ -785,3 +785,13 @@ CREATE OR REPLACE TABLE t1 (a INT) ENGINE=InnoDB;
ALTER TABLE t1 ADD COLUMN b POINT DEFAULT '0';
ERROR 22003: Cannot get geometry object from data you send to the GEOMETRY field
DROP TABLE t1;
#
# MDEV-29520 heap-use-after-poison in row_merge_spatial_rows()
#
CREATE TABLE t
(a VARCHAR(8192), b POINT NOT NULL, PRIMARY KEY(a(8)), SPATIAL(b))
ENGINE=InnoDB;
INSERT INTO t VALUES (REPEAT('MariaDB Corporation Ab ',351),POINT(0,0));
ALTER TABLE t FORCE;
DROP TABLE t;
# End of 10.3 tests

14
mysql-test/suite/innodb_gis/t/alter_spatial_index.test
View File

@ -780,3 +780,17 @@ CREATE OR REPLACE TABLE t1 (a INT) ENGINE=InnoDB;
ALTER TABLE t1 ADD COLUMN b POINT DEFAULT '0';
DROP TABLE t1;
--echo #
--echo # MDEV-29520 heap-use-after-poison in row_merge_spatial_rows()
--echo #
CREATE TABLE t
(a VARCHAR(8192), b POINT NOT NULL, PRIMARY KEY(a(8)), SPATIAL(b))
ENGINE=InnoDB;
INSERT INTO t VALUES (REPEAT('MariaDB Corporation Ab ',351),POINT(0,0));
ALTER TABLE t FORCE;
# Cleanup
DROP TABLE t;
--echo # End of 10.3 tests

6
storage/innobase/row/row0merge.cc
View File

@ -1924,8 +1924,6 @@ row_merge_read_clustered_index(
row_ext_t* ext;
page_cur_t* cur = btr_pcur_get_page_cur(&pcur);
mem_heap_empty(row_heap);
page_cur_move_to_next(cur);
stage->n_pk_recs_inc();
@ -1957,6 +1955,8 @@ row_merge_read_clustered_index(
goto func_exit;
}
mem_heap_empty(row_heap);
if (!mtr.is_active()) {
goto scan_next;
}
@ -2031,6 +2031,8 @@ end_of_index:
ut_ad(!page_cur_is_after_last(cur));
}
} else {
mem_heap_empty(row_heap);
}
rec = page_cur_get_rec(cur);