- 02 Nov, 2020 5 commits
-
-
Nikita Malyavin authored
The bug was fixed by MDEV-22599 bugfix, which changed `Field::cmp` call to `Field::cmp_prefix` in `TABLE::check_period_overlaps`. The trick is that `Field_bit::cmp` apparently calls `Field_bit::cmp_key`, which condiders an argument an actual pointer to data, which isn't correct for `Field_bit`, since it stores data by `bit_ptr`. which is in the beginning of the record, and using `ptr` is incorrect (we use it through `ptr_in_record` call)
-
Nikita Malyavin authored
After Sergei's cleanup this assertion is not actual anymore -- we can't predict if the handler was used for lookup, especially in multi-update scenario. `position(old_data)` is made earlier in `ha_check_overlaps`, therefore it is guaranteed that we compare right refs.
-
Nikita Malyavin authored
The problem here was that ha_check_overlaps internally uses ha_index_read, which in case of fail overwrites table->status. Even though the handlers are different, they share a common table, so the value is anyway spoiled. This is bad, and table->status is badly designed and overweighted by functionality, but nothing can be done with it, since the code related to this logic is ancient and it's impossible to extract it with normal effort. So let's just save and restore the value in ha_update_row before and after the checks. Other operations like INSERT and simple UPDATE are not in risk, since they don't use this table->status approach. DELETE does not do any unique checks, so it's also safe.
-
Nikita Malyavin authored
1. Subtracting table->record[0] from record is UB (non-contiguous buffers) 2. It is very popular to use move_field_offset, which changes Field::ptr, but leaves table->record[0] unchanged. This makes a ptr_in_record result incorrect, since it relies on table->record[0] value. The check ensures the result is within the queried record boundaries.
-
Elena Stepanova authored
-
- 01 Nov, 2020 1 commit
-
-
Oleksandr Byelkin authored
-
- 31 Oct, 2020 1 commit
-
-
Oleksandr Byelkin authored
-
- 30 Oct, 2020 16 commits
-
-
Marko Mäkelä authored
buf_flush_try_neighbors(): Before invoking buf_page_t::ready_for_flush(), check that the freshly looked up buf_pool.page_hash entry actually is a buffer page and not a buf_pool.watch[] sentinel for purge buffering. This race condition was introduced in MDEV-15053 (commit b1ab211d). It is rather hard to hit this bug, because buf_flush_check_neighbors() already checked the condition. The problem exists if buf_pool.watch_set() was invoked for a page in the range after the check in buf_flush_check_neighbor() had been finished.
-
Oleksandr Byelkin authored
-
Marko Mäkelä authored
-
Marko Mäkelä authored
-
Marko Mäkelä authored
Thanks to Varun Gupta for suggesting this. This seems to make main.innodb_ext_key,off more stable.
-
Marko Mäkelä authored
Invoking memcpy() on a NULL pointer is undefined behaviour (even if the length is 0) and gives the compiler permission to assume that the pointer is nonnull. Recent versions of GCC (starting with version 8) are more aggressively optimizing away checks for NULL pointers. This undefined behaviour would cause a SIGSEGV in the test main.func_encrypt on an optimized debug build on GCC 10.2.0.
-
Marko Mäkelä authored
This regression was introduced in commit afc9d00c. This is a partial backport of commit 199863d7 from 10.4.
-
Sergei Golubchik authored
-
Marko Mäkelä authored
-
Varun Gupta authored
MDEV-24033: SIGSEGV in __memcmp_avx2_movbe from queue_insert | SIGSEGV in __memcmp_avx2_movbe from native_compare The issue here was the system variable max_sort_length was being applied to decimals and it was truncating the value for decimals to the number of bytes set by max_sort_length. This was leading to a buffer overflow as the values were written to the buffer without truncation and then we moved the offset to the number of bytes(set by max_sort_length), that are needed for comparison. The fix is to not apply max_sort_length for fixed size types like INT, DECIMALS and only apply max_sort_length for CHAR, VARCHARS, TEXT and BLOBS.
-
Marko Mäkelä authored
-
Marko Mäkelä authored
Also, revert the work-around for the test that was attempted in commit 85613a32. This issue was caught by MemorySanitizer as well as on the Microsoft Windows debug builds, thanks to /MD being used starting with 10.4. The code fix will also be applied to 10.2 because the regression was introduced in commit afc9d00c.
-
Jan Lindström authored
Test itself is not deterministic.
-
Jan Lindström authored
Disable galera_var_replicate_myisam until fixed on 10.4
-
Jan Lindström authored
-
Daniel Black authored
Corrects: 7803601d
-
- 29 Oct, 2020 17 commits
-
-
Oleksandr Byelkin authored
-
Oleksandr Byelkin authored
Use 9 byte (min length packet)
-
Monty authored
This bug was already fixed in a previous commit. Added test case from the MDEV to prove it's fixed.
-
Monty authored
The crash happens because a double free in the case CREATE TABLE fails because there is a conflicting tables on disk. Fixed by ensuring that the double free can't happen.
-
Monty authored
On my system, OpenSuse, I got a compilation error that some arguments to getgrouplist() where not initialized
-
Marko Mäkelä authored
For some reason, in the test main,innodb_ext_key,off we frequently get unexpected EXPLAIN output, in particular on Microsoft Windows debug builders. Let us comment out that EXPLAIN statement for now.
-
Monty authored
The problem was that opt_sum_query() was, as part of MIN/MAX optimization, doing read operations on constant tables that where already closed Fixed by ensuring we don't try to read from tables that are closed.
-
Oleksandr Byelkin authored
-
Marko Mäkelä authored
Starting with commit ef3f71fa MemorySanitizer would complain that we are writing uninitialized data via the doublewrite buffer. buf_dblwr_t::add_to_batch(): Zero out any unused part of the doublewrite buffer, for PAGE_COMPRESSED and ROW_FORMAT=COMPRESSED tables. Reviewed by: Eugene Kosov
-
Vicențiu Ciorbaru authored
-
Vicențiu Ciorbaru authored
This prevents the clash between NOT_FIXED_DEC differing between server and plugins if MYSQL_SERVER is not defined during plugin compilation.
-
Vicențiu Ciorbaru authored
-
Vicențiu Ciorbaru authored
It's a virtual method and it can't be inlined anyway. This allows type plugins (mysql_json in particular) to use Type_handler_blob and / or subclass it, without needing to explicitly expose the vers_type_timestamp object.
-
Vicențiu Ciorbaru authored
Cleanup other linker errors
-
Vicențiu Ciorbaru authored
-
Marko Mäkelä authored
-
Aleksey Midenkov authored
Additional case for PS protocol: UPDATE is converted to multi-update in mysql_multi_update_prepare().
-