mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-05-14 19:07:15 +02:00
Code Issues Projects Releases Packages Wiki Activity

MDEV-37033 UBSAN: row_log_table_apply_ops runtime error: applying non-zero offset 1048576 to null pointer

Browse source 
In a UBSAN debug build, the comparisons with next_mrec_end are made
with index->online_log's head/tail members' block ptr with a sort buffer
size offset (1048576).

The logic that flows though to this point means that even srv_sort_buf_size
above a null pointer wouldn't contain the value of next_mrec_end.

As such this is a UBSAN type fix where we first check if the
head.block / tail.block is null before doing the asserts around
this debug condition. This would be required for the assertions
conditions not to segfault anyway.
This commit is contained in:
Daniel Black 2025-06-19 14:27:15 +10:00
commit 107d1ef2c0
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
storage/innobase/row/row0log.cc
View file

@ -2691,7 +2691,8 @@ all_done:
ut_ad((mrec == NULL) == (index->online_log->head.bytes == 0));
#ifdef UNIV_DEBUG
if (next_mrec_end == index->online_log->head.block
if (index->online_log->head.block &&
next_mrec_end == index->online_log->head.block
+ srv_sort_buf_size) {
/* If tail.bytes == 0, next_mrec_end can also be at
the end of tail.block. */
@ -2706,7 +2707,8 @@ all_done:
ut_ad(index->online_log->tail.blocks
> index->online_log->head.blocks);
}
} else if (next_mrec_end == index->online_log->tail.block
} else if (index->online_log->tail.block &&
next_mrec_end == index->online_log->tail.block
+ index->online_log->tail.bytes) {
ut_ad(next_mrec == index->online_log->tail.block
+ index->online_log->head.bytes);