From 988ce580526ab3886f25cae381858855348b2d70 Mon Sep 17 00:00:00 2001
From: "iggy@recycle.(none)" <>
Date: Tue, 20 Mar 2007 10:34:25 -0400
Subject: [PATCH] Bug#23736 Pointer free error in mysqlbinlog - Mis-matched
 SAFEMALLOC defines caused misleading error message.

---
 client/mysqlbinlog.cc | 27 +++++++++++++--------------
 include/my_sys.h      | 19 ++++++++++---------
 mysys/array.c         |  4 ----
 mysys/mf_tempdir.c    | 13 ++++++-------
 4 files changed, 29 insertions(+), 34 deletions(-)

diff --git a/client/mysqlbinlog.cc b/client/mysqlbinlog.cc
index 91fb5f2b99d..2a070d14f0d 100644
--- a/client/mysqlbinlog.cc
+++ b/client/mysqlbinlog.cc
@@ -155,11 +155,7 @@ class Load_log_processor
 
 public:
   Load_log_processor() {}
-  ~Load_log_processor()
-  {
-    destroy();
-    delete_dynamic(&file_names);
-  }
+  ~Load_log_processor() {}
 
   int init()
   {
@@ -179,20 +175,22 @@ public:
       target_dir_name_len= strlen(target_dir_name);
     }
   void destroy()
+  {
+    File_name_record *ptr= (File_name_record *)file_names.buffer;
+    File_name_record *end= ptr + file_names.elements;
+    for (; ptr < end; ptr++)
     {
-      File_name_record *ptr= (File_name_record *)file_names.buffer;
-      File_name_record *end= ptr + file_names.elements;
-      for (; ptr<end; ptr++)
+      if (ptr->fname)
       {
-	if (ptr->fname)
-	{
-          my_free(ptr->fname, MYF(MY_WME));
-          delete ptr->event;
-          bzero((char *)ptr, sizeof(File_name_record));
-	}
+        my_free(ptr->fname, MYF(MY_WME));
+        delete ptr->event;
+        bzero((char *)ptr, sizeof(File_name_record));
       }
     }
 
+    delete_dynamic(&file_names);
+  }
+
   /*
     Obtain Create_file event for LOAD DATA statement by its file_id.
 
@@ -1517,6 +1515,7 @@ int main(int argc, char** argv)
   cleanup();
   free_defaults(defaults_argv);
   my_free_open_file_info();
+  load_processor.destroy();
   /* We cannot free DBUG, it is used in global destructors after exit(). */
   my_end(MY_DONT_FREE_DBUG);
   exit(exit_value);
diff --git a/include/my_sys.h b/include/my_sys.h
index 533d50cb25f..63a1faf3995 100644
--- a/include/my_sys.h
+++ b/include/my_sys.h
@@ -322,15 +322,6 @@ struct st_my_file_info
 
 extern struct st_my_file_info *my_file_info;
 
-typedef struct st_my_tmpdir
-{
-  char **list;
-  uint cur, max;
-#ifdef THREAD
-  pthread_mutex_t mutex;
-#endif
-} MY_TMPDIR;
-
 typedef struct st_dynamic_array
 {
   char *buffer;
@@ -339,6 +330,16 @@ typedef struct st_dynamic_array
   uint size_of_element;
 } DYNAMIC_ARRAY;
 
+typedef struct st_my_tmpdir
+{
+  DYNAMIC_ARRAY full_list;
+  char **list;
+  uint cur, max;
+#ifdef THREAD
+  pthread_mutex_t mutex;
+#endif
+} MY_TMPDIR;
+
 typedef struct st_dynamic_string
 {
   char *str;
diff --git a/mysys/array.c b/mysys/array.c
index e3ebe8ddb42..4ea1946d837 100644
--- a/mysys/array.c
+++ b/mysys/array.c
@@ -15,10 +15,6 @@
 
 /* Handling of arrays that can grow dynamicly. */
 
-#if defined(WIN32) || defined(__WIN__)
-#undef SAFEMALLOC				/* Problems with threads */
-#endif
-
 #include "mysys_priv.h"
 #include "m_string.h"
 
diff --git a/mysys/mf_tempdir.c b/mysys/mf_tempdir.c
index c24e2a0101b..bcd003920f1 100644
--- a/mysys/mf_tempdir.c
+++ b/mysys/mf_tempdir.c
@@ -26,9 +26,8 @@ my_bool init_tmpdir(MY_TMPDIR *tmpdir, const char *pathlist)
 {
   char *end, *copy;
   char buff[FN_REFLEN];
-  DYNAMIC_ARRAY t_arr;
   pthread_mutex_init(&tmpdir->mutex, MY_MUTEX_INIT_FAST);
-  if (my_init_dynamic_array(&t_arr, sizeof(char*), 1, 5))
+  if (my_init_dynamic_array(&tmpdir->full_list, sizeof(char*), 1, 5))
     return TRUE;
   if (!pathlist || !pathlist[0])
   {
@@ -49,14 +48,14 @@ my_bool init_tmpdir(MY_TMPDIR *tmpdir, const char *pathlist)
     convert_dirname(buff, pathlist, end);
     if (!(copy=my_strdup(buff, MYF(MY_WME))))
       return TRUE;
-    if (insert_dynamic(&t_arr, (gptr)&copy))
+    if (insert_dynamic(&tmpdir->full_list, (gptr)&copy))
       return TRUE;
     pathlist=end+1;
   }
   while (*end);
-  freeze_size(&t_arr);
-  tmpdir->list=(char **)t_arr.buffer;
-  tmpdir->max=t_arr.elements-1;
+  freeze_size(&tmpdir->full_list);
+  tmpdir->list=(char **)tmpdir->full_list.buffer;
+  tmpdir->max=tmpdir->full_list.elements-1;
   tmpdir->cur=0;
   return FALSE;
 }
@@ -76,7 +75,7 @@ void free_tmpdir(MY_TMPDIR *tmpdir)
   uint i;
   for (i=0; i<=tmpdir->max; i++)
     my_free(tmpdir->list[i], MYF(0));
-  my_free((gptr)tmpdir->list, MYF(0));
+  delete_dynamic(&tmpdir->full_list);
   pthread_mutex_destroy(&tmpdir->mutex);
 }