MDEV-5543 MyISAM repair unsafe usage of TMD files

4 files changed, 44 insertions, 2 deletions

diff --git a/mysql-test/r/repair_symlink-5543.result b/mysql-test/r/repair_symlink-5543.result
new file mode 100644
index 00000000000..051c9ca3472
--- /dev/null
+++ b/mysql-test/r/repair_symlink-5543.result
@@ -0,0 +1,14 @@
+create table t1 (a int) engine=myisam data directory='MYSQL_TMP_DIR';
+insert t1 values (1);
+repair table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	repair	error	Can't create new tempfile: 'MYSQL_TMP_DIR/t1.TMD'
+test.t1	repair	status	Operation failed
+drop table t1;
+create table t2 (a int) engine=aria data directory='MYSQL_TMP_DIR';
+insert t2 values (1);
+repair table t2;
+Table	Op	Msg_type	Msg_text
+test.t2	repair	error	Can't create new tempfile: 'MYSQL_TMP_DIR/t2.TMD'
+test.t2	repair	status	Operation failed
+drop table t2;
diff --git a/mysql-test/t/repair_symlink-5543.test b/mysql-test/t/repair_symlink-5543.test
new file mode 100644
index 00000000000..bad65a4175a
--- /dev/null
+++ b/mysql-test/t/repair_symlink-5543.test
@@ -0,0 +1,26 @@
+#
+# MDEV-5543 MyISAM repair unsafe usage of TMD files 
+#
+--source include/have_symlink.inc
+--source include/not_windows.inc
+--source include/have_maria.inc
+
+--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
+eval create table t1 (a int) engine=myisam data directory='$MYSQL_TMP_DIR';
+insert t1 values (1);
+--system ln -s $MYSQL_TMP_DIR/foobar5543 $MYSQL_TMP_DIR/t1.TMD
+--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
+repair table t1;
+drop table t1;
+
+--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
+eval create table t2 (a int) engine=aria data directory='$MYSQL_TMP_DIR';
+insert t2 values (1);
+--system ln -s $MYSQL_TMP_DIR/foobar5543 $MYSQL_TMP_DIR/t2.TMD
+--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
+repair table t2;
+drop table t2;
+
+--list_files $MYSQL_TMP_DIR foobar5543
+--system rm $MYSQL_TMP_DIR/t1.TMD $MYSQL_TMP_DIR/t2.TMD
+
diff --git a/storage/maria/ha_maria.cc b/storage/maria/ha_maria.cc
index ce308887516..f1cb53a43cf 100644
--- a/storage/maria/ha_maria.cc
+++ b/storage/maria/ha_maria.cc
@@ -1,5 +1,6 @@
 /* Copyright (C) 2004-2008 MySQL AB & MySQL Finland AB & TCX DataKonsult AB
    Copyright (C) 2008-2009 Sun Microsystems, Inc.
+   Copyright (c) 2009, 2014, SkySQL Ab.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -1467,7 +1468,7 @@ int ha_maria::repair(THD *thd, HA_CHECK *param, bool do_optimize)
 
   param->db_name= table->s->db.str;
   param->table_name= table->alias;
-  param->tmpfile_createflag= O_RDWR | O_TRUNC;
+  param->tmpfile_createflag= O_RDWR | O_TRUNC | O_EXCL;
   param->using_global_keycache= 1;
   param->thd= thd;
   param->tmpdir= &mysql_tmpdir_list;
diff --git a/storage/myisam/ha_myisam.cc b/storage/myisam/ha_myisam.cc
index 2be71dadf4b..aa56077469b 100644
--- a/storage/myisam/ha_myisam.cc
+++ b/storage/myisam/ha_myisam.cc
@@ -1,5 +1,6 @@
 /*
    Copyright (c) 2000, 2011, Oracle and/or its affiliates
+   Copyright (c) 2009, 2014, SkySQL Ab.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -1138,7 +1139,7 @@ int ha_myisam::repair(THD *thd, HA_CHECK &param, bool do_optimize)
 
   param.db_name=    table->s->db.str;
   param.table_name= table->alias;
-  param.tmpfile_createflag = O_RDWR | O_TRUNC;
+  param.tmpfile_createflag= O_RDWR | O_TRUNC | O_EXCL;
   param.using_global_keycache = 1;
   param.thd= thd;
   param.tmpdir= &mysql_tmpdir_list;