Commit 1bd5b75c authored by Marko Mäkelä's avatar Marko Mäkelä

MDEV-22818 Server crash on corrupted ROW_FORMAT=COMPRESSED page

page_zip_fields_decode(): Do not dereference index=NULL.
Instead, return NULL early. The only caller does not care
about the values of output parameters in that case.

This bug was introduced in MySQL 5.7.6 by
mysql/mysql-server@9eae0edb7a8e4004328e61157f5f3b39cebe1b2b
and in MariaDB 10.2.2 by
commit 2e814d47.

Thanks to my son for pointing this out after investigating
the output of a static analysis tool.
parent 7a695d8a
...@@ -1756,8 +1756,9 @@ page_zip_fields_decode( ...@@ -1756,8 +1756,9 @@ page_zip_fields_decode(
if (!val) { if (!val) {
val = ULINT_UNDEFINED; val = ULINT_UNDEFINED;
} else if (UNIV_UNLIKELY(val >= n)) { } else if (UNIV_UNLIKELY(val >= n)) {
fail:
page_zip_fields_free(index); page_zip_fields_free(index);
index = NULL; return NULL;
} else { } else {
index->type = DICT_CLUSTERED; index->type = DICT_CLUSTERED;
} }
...@@ -1766,8 +1767,7 @@ page_zip_fields_decode( ...@@ -1766,8 +1767,7 @@ page_zip_fields_decode(
} else { } else {
/* Decode the number of nullable fields. */ /* Decode the number of nullable fields. */
if (UNIV_UNLIKELY(index->n_nullable > val)) { if (UNIV_UNLIKELY(index->n_nullable > val)) {
page_zip_fields_free(index); goto fail;
index = NULL;
} else { } else {
index->n_nullable = unsigned(val); index->n_nullable = unsigned(val);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment