mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-29 02:05:57 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

BUG#23760086 INNODB: ASSERTION FAILURE: MACH0DATA.IC:56:(N | 0XFFFFUL) <= 0XFFFFUL

Browse source 
Analysis: In row_log_table_delete(), extern size could be greater
than 2 bytes int if there are enough index on blob columns.

Solution: Use 4 bytes int other than 2 bytes for extern size.

Reviewed-by: Marko Mäkelä <marko.makela@oracle.com>
RB: 13573
This commit is contained in:
Shaohua Wang 2016-08-05 09:05:18 +02:00 • committed by Marko Mäkelä
parent d3a2f60e1a
commit a930c0aa86
1 changed files with 11 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
storage/innobase/row/row0log.cc
View file

@ -649,7 +649,7 @@ row_log_table_delete(
&old_pk_extra_size);
ut_ad(old_pk_extra_size < 0x100);
mrec_size = 4 + old_pk_size;
mrec_size = 6 + old_pk_size;
/* Log enough prefix of the BLOB unless both the
old and new table are in COMPACT or REDUNDANT format,
@ -686,8 +686,8 @@ row_log_table_delete(
*b++ = static_cast<byte>(old_pk_extra_size);
/* Log the size of external prefix we saved */
mach_write_to_2(b, ext_size);
b += 2;
mach_write_to_4(b, ext_size);
b += 4;
rec_convert_dtuple_to_temp(
b + old_pk_extra_size, new_index,
@ -2441,14 +2441,14 @@ row_log_table_apply_op(
break;
case ROW_T_DELETE:
/* 1 (extra_size) + 2 (ext_size) + at least 1 (payload) */
if (mrec + 4 >= mrec_end) {
/* 1 (extra_size) + 4 (ext_size) + at least 1 (payload) */
if (mrec + 6 >= mrec_end) {
return(NULL);
}
extra_size = *mrec++;
ext_size = mach_read_from_2(mrec);
mrec += 2;
ext_size = mach_read_from_4(mrec);
mrec += 4;
ut_ad(mrec < mrec_end);
/* We assume extra_size < 0x100 for the PRIMARY KEY prefix.
@ -2459,6 +2459,10 @@ row_log_table_apply_op(
rec_init_offsets_temp(mrec, new_index, offsets);
next_mrec = mrec + rec_offs_data_size(offsets) + ext_size;
if (log->table->n_v_cols) {
if (next_mrec + 2 >= mrec_end) {
return(NULL);
}
next_mrec += mach_read_from_2(next_mrec);
}