mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-30 18:41:56 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-21485 ASAN use-after-poison in dfield_get_len or Assertion `pos < index->n_def' failed

Browse source 
The server would crash when instantly reordering the columns of a
table whose all columns belong to the PRIMARY KEY.
This commit is contained in:
Marko Mäkelä 2020-01-15 18:28:52 +02:00
parent 2d4b6571ec
commit 6a8a4c19e2
4 changed files with 28 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
mysql-test/suite/innodb/r/instant_alter,4k.rdiff
View file

@ -1,5 +1,5 @@
--- suite/innodb/r/instant_alter.result 2019-12-05 10:54:59.611505580 +0100
+++ suite/innodb/r/instant_alter,4k.reject 2019-12-05 11:47:54.013615820 +0100
--- instant_alter.result
+++ instant_alter,4k.result
@@ -242,7 +242,7 @@
SELECT clust_index_size FROM INFORMATION_SCHEMA.INNODB_SYS_TABLESTATS
WHERE name = 'test/t2';
@ -318,8 +318,8 @@
FROM information_schema.global_status
WHERE variable_name = 'innodb_instant_alter_column';
instants
-196
+198
-199
+201
SET GLOBAL innodb_purge_rseg_truncate_frequency= @saved_frequency;
#
# MDEV-18266: Changing an index comment unnecessarily rebuilds index

11
mysql-test/suite/innodb/r/instant_alter.result
View file

@ -932,6 +932,9 @@ SELECT * FROM t1;
a b vb
fubar 42 42
DROP TABLE t1;
CREATE TABLE t1 (a INT, b INT, PRIMARY KEY(a,b)) ENGINE=InnoDB ROW_FORMAT=REDUNDANT;
ALTER TABLE t1 MODIFY b INT FIRST;
DROP TABLE t1;
CREATE TABLE t1
(id INT PRIMARY KEY, c2 INT UNIQUE,
c3 POINT NOT NULL DEFAULT ST_GeomFromText('POINT(3 4)'),
@ -1809,6 +1812,9 @@ SELECT * FROM t1;
a b vb
fubar 42 42
DROP TABLE t1;
CREATE TABLE t1 (a INT, b INT, PRIMARY KEY(a,b)) ENGINE=InnoDB ROW_FORMAT=COMPACT;
ALTER TABLE t1 MODIFY b INT FIRST;
DROP TABLE t1;
CREATE TABLE t1
(id INT PRIMARY KEY, c2 INT UNIQUE,
c3 POINT NOT NULL DEFAULT ST_GeomFromText('POINT(3 4)'),
@ -2686,12 +2692,15 @@ SELECT * FROM t1;
a b vb
fubar 42 42
DROP TABLE t1;
CREATE TABLE t1 (a INT, b INT, PRIMARY KEY(a,b)) ENGINE=InnoDB ROW_FORMAT=DYNAMIC;
ALTER TABLE t1 MODIFY b INT FIRST;
DROP TABLE t1;
disconnect analyze;
SELECT variable_value-@old_instant instants
FROM information_schema.global_status
WHERE variable_name = 'innodb_instant_alter_column';
instants
196
199
SET GLOBAL innodb_purge_rseg_truncate_frequency= @saved_frequency;
#
# MDEV-18266: Changing an index comment unnecessarily rebuilds index

4
mysql-test/suite/innodb/t/instant_alter.test
View file

@ -826,6 +826,10 @@ ALTER TABLE t1 ADD vb INT AS (b);
SELECT * FROM t1;
DROP TABLE t1;
eval CREATE TABLE t1 (a INT, b INT, PRIMARY KEY(a,b)) $engine;
ALTER TABLE t1 MODIFY b INT FIRST;
DROP TABLE t1;
dec $format;
let $redundant_4k= 0;
}

13
storage/innobase/rem/rem0rec.cc
View file

@ -1,7 +1,7 @@
/*****************************************************************************
Copyright (c) 1994, 2016, Oracle and/or its affiliates. All Rights Reserved.
Copyright (c) 2017, 2019, MariaDB Corporation.
Copyright (c) 2017, 2020, MariaDB Corporation.
This program is free software; you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by the Free Software
@ -1155,7 +1155,10 @@ rec_get_converted_size_comp_prefix_low(
for (ulint i = 0; dfield < end; i++, dfield++) {
if (mblob && i == index->first_user_field()) {
data_size += FIELD_REF_SIZE;
++dfield;
if (++dfield == end) {
ut_ad(i == index->n_fields);
break;
}
}
ulint len = dfield_get_len(dfield);
@ -1597,7 +1600,11 @@ start:
ut_ad(dfield_is_ext(field));
memcpy(end, dfield_get_data(field), len);
end += len;
len = dfield_get_len(++field);
if (++field == fend) {
ut_ad(i == index->n_fields);
break;
}
len = dfield_get_len(field);
}
} else if (UNIV_UNLIKELY(i == n_node_ptr_field)) {
ut_ad(field->type.prtype & DATA_NOT_NULL);