diff options
| author | Eugene Kosov <eugene.kosov@mariadb.com> | 2019-07-18 22:28:11 +0300 |
|---|---|---|
| committer | Eugene Kosov <eugene.kosov@mariadb.com> | 2019-07-18 22:28:11 +0300 |
| commit | 5b205458d9bc9b838ab7725d9f8e2f45b743e385 (patch) | |
| tree | c90ea6a5c931044c6af9afb14a09e42485be4e7d | |
| parent | f616e2b97fec3a8105c70cd72e80d6ef57f460c7 (diff) | |
| download | mariadb-git-5b205458d9bc9b838ab7725d9f8e2f45b743e385.tar.gz | |
MDEV-20097 potential use-after-free
row_merge_read_clustered_index(): make buf always equals to merge_buf[i]
| -rw-r--r-- | storage/innobase/row/row0merge.cc | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/storage/innobase/row/row0merge.cc b/storage/innobase/row/row0merge.cc index 463be8d229d..ac7eddfedbb 100644 --- a/storage/innobase/row/row0merge.cc +++ b/storage/innobase/row/row0merge.cc @@ -1916,6 +1916,7 @@ write_buffers: UNIV_MEM_INVALID(&block[0], srv_sort_buf_size); merge_buf[i] = row_merge_buf_empty(buf); + buf = merge_buf[i]; if (UNIV_LIKELY(row != NULL)) { /* Try writing the record again, now |