mirror of
https://github.com/MariaDB/server.git
synced 2026-10-23 18:49:29 +03:00
1d12434a4f
Problem: ======= An UPDATE on an InnoDB table with several indexed virtual columns could corrupt the heap in calc_row_difference() because the write pointer went past the end of the update buffer. ha_innobase::update_row() sized the buffer from the row length, the maximum key length and fixed padding. That did not allow for the extra packed values calc_row_difference() stores for indexed virtual columns for both the new value and the old value. Solution: ======== When allocating the update buffer in ha_innobase::update_row(), add pack_length() of every virtual column. The row length already counts each virtual column once, so the buffer can now hold both the new and old packed values. All virtual columns are counted, not only the indexed ones, because the buffer is reused and a column may become indexed after it is allocated. Based on mysql/mysql-server@1265514061