1. 30 Oct, 2021 2 commits
  2. 29 Oct, 2021 1 commit
    • Alexander Barkov's avatar
      MDEV-24901 SIGSEGV in fts_get_table_name, SIGSEGV in ib_vector_size, SIGSEGV... · 059797ed
      Alexander Barkov authored
      MDEV-24901 SIGSEGV in fts_get_table_name, SIGSEGV in ib_vector_size, SIGSEGV in row_merge_fts_doc_tokenize, stack smashing
      
      strmake() puts one extra 0x00 byte at the end of the string.
      The code in my_strnxfrm_tis620[_nopad] did not take this into
      account, so in the reported scenario the 0x00 byte was put outside
      of a stack variable, which made ASAN crash.
      
      This problem is already fixed in in MySQL:
      
        commit 19bd66fe43c41f0bde5f36bc6b455a46693069fb
        Author: bin.x.su@oracle.com <>
        Date:   Fri Apr 4 11:35:27 2014 +0800
      
      But the fix does not seem to be correct, as it breaks when finds a zero byte
      in the source string.
      
      Using memcpy() instead of strmake().
      
      - Unlike strmake(), memcpy() it does not write beyond the destination
        size passed.
      - Unlike the MySQL fix, memcpy() does not break on the first 0x00 byte found
        in the source string.
      059797ed
  3. 28 Oct, 2021 5 commits
  4. 27 Oct, 2021 3 commits
    • Sergei Petrunia's avatar
      Fix compile warning: · 3a9967d7
      Sergei Petrunia authored
      ha_rocksdb.h:459:15: warning: 'table_type' overrides a member
      function but is not marked 'override' [-Winconsistent-missing-override]
      3a9967d7
    • Alexander Barkov's avatar
      MDEV-25402 Assertion `!str || str != Ptr' failed in String::copy · 2ed148c8
      Alexander Barkov authored
      The assert inside String::copy() prevents copying from from "str"
      if its own String::Ptr also points to the same memory.
      
      The idea of the assert is that copy() performs memory reallocation,
      and this reallocation can free (and thus invalidate) the memory pointed by Ptr,
      which can lead to further copying from a freed memory.
      
      The assert was incomplete: copy() can free the memory pointed by its Ptr
      only if String::alloced is true!
      
      If the String is not alloced, it is still safe to copy even from
      the location pointed by Ptr.
      
      This scenario demonstrates a safe copy():
        const char *tmp= "123";
        String str1(tmp, 3);
        String str2(tmp, 3);
        // This statement is safe:
        str2.copy(str1->ptr(), str1->length(), str1->charset(), cs_to, &errors);
      
      Inside the copy() the parameter "str" is equal to String::Ptr in this example.
      But it's still ok to reallocate the memory for str2, because str2
      was a constant before the copy() call. Thus reallocation does not
      make the memory pointed by str1->ptr() invalid.
      
      Adjusting the assert condition to allow copying for constant strings.
      2ed148c8
    • Marko Mäkelä's avatar
      Fix tests for PLUGIN_PARTITION=NO · 4b8340d8
      Marko Mäkelä authored
      4b8340d8
  5. 26 Oct, 2021 6 commits
  6. 25 Oct, 2021 4 commits
  7. 22 Oct, 2021 1 commit
  8. 21 Oct, 2021 10 commits
  9. 20 Oct, 2021 6 commits
    • Marko Mäkelä's avatar
    • Marko Mäkelä's avatar
      Update libmariadb · 69b3de83
      Marko Mäkelä authored
      69b3de83
    • Marko Mäkelä's avatar
      MDEV-22627 Failing assertion: dict_tf2_is_valid(flags, flags2) · b06e8167
      Marko Mäkelä authored
      create_table_info_t::innobase_table_flags(): Refuse to create
      a PAGE_COMPRESSED table with PAGE_COMPRESSION_LEVEL=0 if also
      innodb_compression_level=0.
      
      The parameter value innodb_compression_level=0 was only somewhat
      meaningful for testing or debugging ROW_FORMAT=COMPRESSED tables.
      For the page_compressed format, it never made any sense, and the
      check in dict_tf_is_valid_not_redundant() that was added in
      72378a25 (MDEV-12873) would cause
      the server to crash.
      b06e8167
    • Nikita Malyavin's avatar
      MDEV-22445 Crash on HANDLER READ NEXT after XA PREPARE · caebe151
      Nikita Malyavin authored
      The assertion is absolutely correct since no data access is possible after
      XA PREPARE.
      
      The check is added in mysql_ha_read.
      caebe151
    • Nikita Malyavin's avatar
      MDEV-26262 frm is corrupted after ER_EXPRESSION_REFERS_TO_UNINIT_FIELD · 1811fd51
      Nikita Malyavin authored
      This is a duplicate of MDEV-18278 89936f11, but I will add an
      additional assertion
      
      Description:
      
      The frm corruption should not be reported during CREATE TABLE. Normally
      it doesn't, and the data to fill TABLE is taken by open_table_from_share
      call. However, the vcol data is stored as SQL string in
      table->s->vcol_defs.str and is anyway parsed on each table open.
      It is impossible [or hard] to avoid, because it's hard to clone the
      expression tree in general (it's easier to parse).
      
      Normally parse_vcol_defs should only fail on semantic errors. If so,
      error_reported is set to true. Any other failure is not expected during
      table creation. There is either unhandled/unacknowledged error, or
      something went really wrong, like memory reject. This all should be
      asserted anyway.
      
      Solution:
      * Set *error_reported=true for the forward references check;
      * Assert for every unacknowledged error during table creation.
      1811fd51
    • Nikita Malyavin's avatar
  10. 19 Oct, 2021 2 commits