diff options
| author | Marko Mäkelä <marko.makela@mariadb.com> | 2022-01-12 12:34:07 +0200 |
|---|---|---|
| committer | Marko Mäkelä <marko.makela@mariadb.com> | 2022-01-12 12:34:07 +0200 |
| commit | ba5ef63ae1da74a90dcdd798bf12c4ca7c9c720f (patch) | |
| tree | 77264a5401fd2d73940f11dd356f8bb555d99d0b | |
| parent | 0261eac57f137c5daae90f5bb1eaa4bf48ee431b (diff) | |
| download | mariadb-git-ba5ef63ae1da74a90dcdd798bf12c4ca7c9c720f.tar.gz | |
MDEV-27476 heap-use-after-free in buf_pool_t::is_block_field()
This follows up commit 017d1b867b12ff36b3b871c3d57719907a905659.
In commit aaef2e1d8c843d1e40b1ce0c5199c3abb3c5da28 (MDEV-27058)
some more problematic debug assertions were added.
btr_search_update_block_hash_info(), trx_purge_truncate_history():
Use simpler assertions to check that an uncompressed page is present.
| -rw-r--r-- | storage/innobase/btr/btr0sea.cc | 4 | ||||
| -rw-r--r-- | storage/innobase/trx/trx0purge.cc | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/storage/innobase/btr/btr0sea.cc b/storage/innobase/btr/btr0sea.cc index bc26397d106..96bbd8af3c1 100644 --- a/storage/innobase/btr/btr0sea.cc +++ b/storage/innobase/btr/btr0sea.cc @@ -2,7 +2,7 @@ Copyright (c) 1996, 2016, Oracle and/or its affiliates. All Rights Reserved. Copyright (c) 2008, Google Inc. -Copyright (c) 2017, 2021, MariaDB Corporation. +Copyright (c) 2017, 2022, MariaDB Corporation. Portions of this file contain modifications contributed and copyrighted by Google, Inc. Those modifications are gratefully acknowledged and are described @@ -412,7 +412,7 @@ btr_search_update_block_hash_info(btr_search_t* info, buf_block_t* block) ut_ad(block->page.lock.have_x() || block->page.lock.have_s()); info->last_hash_succ = FALSE; - ut_ad(buf_pool.is_uncompressed(block)); + ut_ad(block->page.frame); ut_ad(info->magic_n == BTR_SEARCH_MAGIC_N); if ((block->n_hash_helps > 0) diff --git a/storage/innobase/trx/trx0purge.cc b/storage/innobase/trx/trx0purge.cc index 657a1e3a2d4..2564049a2e1 100644 --- a/storage/innobase/trx/trx0purge.cc +++ b/storage/innobase/trx/trx0purge.cc @@ -703,8 +703,8 @@ not_free: if (bpage->id().space() == space.id && bpage->oldest_modification() != 1) { + ut_ad(bpage->frame); auto block= reinterpret_cast<buf_block_t*>(bpage); - ut_ad(buf_pool.is_uncompressed(block)); if (!bpage->lock.x_lock_try()) { /* Let buf_pool_t::release_freed_page() proceed. */ |