Bug #31305 myisam tables crash when they are near capacity.

When we insert a record into MYISAM table which is almost 'full',
we first write record data in the free space inside a file, and then
check if we have enough space after the end of the file.
So if we don't have the space, table will left corrupted.
Similar error also happens when we updata MYISAM tables.

Fixed by modifying write_dynamic_record and update_dynamic_record functions
to check for free space before writing parts of a record


BitKeeper/etc/ignore:
  Added libmysql_r/client_settings.h libmysqld/ha_blackhole.cc to the ignore list
myisam/mi_dynrec.c:
  Bug #31305 myisam tables crash when they are near capacity.
  
  now we check space left in table in write_dynamic_record
  and update_dynamic_record functions.
  If we don't have enough room for the new (updated) record, return with the
  error.
mysql-test/r/almost_full.result:
  New BitKeeper file ``mysql-test/r/almost_full.result''
mysql-test/t/almost_full.test:
  New BitKeeper file ``mysql-test/t/almost_full.test''

4 files changed, 140 insertions, 0 deletions

diff --git a/.bzrignore b/.bzrignore
index 0c666cc3ae0..27ad9519e18 100644
--- a/.bzrignore
+++ b/.bzrignore
@@ -1068,3 +1068,5 @@ include/check_abi
 include/mysql_h.ic
 mysql-test/r/blackhole.log
 mysql-test/lib/init_db.sql
+libmysql_r/client_settings.h
+libmysqld/ha_blackhole.cc
diff --git a/myisam/mi_dynrec.c b/myisam/mi_dynrec.c
index 260f461685e..ad76296a66e 100644
--- a/myisam/mi_dynrec.c
+++ b/myisam/mi_dynrec.c
@@ -145,6 +145,29 @@ static int write_dynamic_record(MI_INFO *info, const byte *record,
   DBUG_ENTER("write_dynamic_record");
 
   flag=0;
+
+  /*
+    Check if we have enough room for the new record.
+    First we do simplified check to make usual case faster.
+    Then we do more precise check for the space left.
+    Though it still is not absolutely precise, as
+    we always use MI_MAX_DYN_BLOCK_HEADER while it can be
+    less in the most of the cases.
+  */
+
+  if (unlikely(info->s->base.max_data_file_length -
+               info->state->data_file_length <
+               reclength + MI_MAX_DYN_BLOCK_HEADER))
+  {
+    if (info->s->base.max_data_file_length - info->state->data_file_length +
+        info->state->empty - info->state->del * MI_MAX_DYN_BLOCK_HEADER <
+        reclength + MI_MAX_DYN_BLOCK_HEADER)
+    {
+      my_errno=HA_ERR_RECORD_FILE_FULL;
+      DBUG_RETURN(1);
+    }
+  }
+
   do
   {
     if (_mi_find_writepos(info,reclength,&filepos,&length))
@@ -577,6 +600,51 @@ static int update_dynamic_record(MI_INFO *info, my_off_t filepos, byte *record,
   DBUG_ENTER("update_dynamic_record");
 
   flag=block_info.second_read=0;
+  /*
+     Check if we have enough room for the record.
+     First we do simplified check to make usual case faster.
+     Then we do more precise check for the space left.
+     Though it still is not absolutely precise, as
+     we always use MI_MAX_DYN_BLOCK_HEADER while it can be
+     less in the most of the cases.
+  */
+
+  /*
+    compare with just the reclength as we're going
+    to get some space from the old replaced record
+  */
+  if (unlikely(info->s->base.max_data_file_length -
+        info->state->data_file_length < reclength))
+  {
+    /*
+       let's read the old record's block to find out the length of the
+       old record
+    */
+    if ((error=_mi_get_block_info(&block_info,info->dfile,filepos))
+        & (BLOCK_DELETED | BLOCK_ERROR | BLOCK_SYNC_ERROR | BLOCK_FATAL_ERROR))
+    {
+      DBUG_PRINT("error",("Got wrong block info"));
+      if (!(error & BLOCK_FATAL_ERROR))
+        my_errno=HA_ERR_WRONG_IN_RECORD;
+      goto err;
+    }
+
+    /*
+      if new record isn't longer, we can go on safely
+    */
+    if (block_info.rec_len < reclength)
+    {
+      if (info->s->base.max_data_file_length - info->state->data_file_length +
+          info->state->empty - info->state->del * MI_MAX_DYN_BLOCK_HEADER <
+          reclength - block_info.rec_len + MI_MAX_DYN_BLOCK_HEADER)
+      {
+        my_errno=HA_ERR_RECORD_FILE_FULL;
+        goto err;
+      }
+    }
+    block_info.second_read=0;
+  }
+
   while (reclength > 0)
   {
     if (filepos != info->s->state.dellink)
diff --git a/mysql-test/r/almost_full.result b/mysql-test/r/almost_full.result
new file mode 100644
index 00000000000..eb28f12fa51
--- /dev/null
+++ b/mysql-test/r/almost_full.result
@@ -0,0 +1,29 @@
+drop table if exists t1;
+set global myisam_data_pointer_size=2;
+CREATE TABLE t1 (a int auto_increment primary key not null, b longtext) ENGINE=MyISAM;
+DELETE FROM t1 WHERE a=1 or a=5;
+INSERT INTO t1 SET b=repeat('a',600);
+ERROR HY000: The table 't1' is full
+CHECK TABLE t1 EXTENDED;
+Table	Op	Msg_type	Msg_text
+test.t1	check	warning	Datafile is almost full, 65448 of 65534 used
+test.t1	check	status	OK
+UPDATE t1 SET b=repeat('a', 800) where a=10;
+ERROR HY000: The table 't1' is full
+CHECK TABLE t1 EXTENDED;
+Table	Op	Msg_type	Msg_text
+test.t1	check	warning	Datafile is almost full, 65448 of 65534 used
+test.t1	check	status	OK
+INSERT INTO t1 SET b=repeat('a',400);
+CHECK TABLE t1 EXTENDED;
+Table	Op	Msg_type	Msg_text
+test.t1	check	warning	Datafile is almost full, 65448 of 65534 used
+test.t1	check	status	OK
+DELETE FROM t1 WHERE a=2 or a=6;
+UPDATE t1 SET b=repeat('a', 600) where a=11;
+CHECK TABLE t1 EXTENDED;
+Table	Op	Msg_type	Msg_text
+test.t1	check	warning	Datafile is almost full, 65448 of 65534 used
+test.t1	check	status	OK
+drop table t1;
+set global myisam_data_pointer_size=default;
diff --git a/mysql-test/t/almost_full.test b/mysql-test/t/almost_full.test
new file mode 100644
index 00000000000..5c67ab3c088
--- /dev/null
+++ b/mysql-test/t/almost_full.test
@@ -0,0 +1,41 @@
+#
+# Some special cases with empty tables
+#
+
+--disable_warnings
+drop table if exists t1;
+--enable_warnings
+
+set global myisam_data_pointer_size=2;
+CREATE TABLE t1 (a int auto_increment primary key not null, b longtext) ENGINE=MyISAM;
+
+--disable_query_log
+let $1= 303;
+while ($1)
+{
+  INSERT INTO t1 SET b=repeat('a',200);
+  dec $1;
+}
+--enable_query_log
+
+DELETE FROM t1 WHERE a=1 or a=5;
+
+--error 1114
+INSERT INTO t1 SET b=repeat('a',600);
+CHECK TABLE t1 EXTENDED;
+
+--error 1114
+UPDATE t1 SET b=repeat('a', 800) where a=10;
+CHECK TABLE t1 EXTENDED;
+
+INSERT INTO t1 SET b=repeat('a',400);
+CHECK TABLE t1 EXTENDED;
+
+DELETE FROM t1 WHERE a=2 or a=6;
+UPDATE t1 SET b=repeat('a', 600) where a=11;
+CHECK TABLE t1 EXTENDED;
+drop table t1;
+
+set global myisam_data_pointer_size=default;
+
+# End of 4.1 tests