Merge with 4.0

BitKeeper/etc/ignore:
  auto-union
BitKeeper/etc/logging_ok:
  auto-union
BitKeeper/deleted/.del-compile-netware-standard:
  Delete: netware/BUILD/compile-netware-standard
BitKeeper/deleted/.del-mwenv:
  Delete: netware/BUILD/mwenv
BitKeeper/deleted/.del-nwbootstrap:
  Delete: netware/BUILD/nwbootstrap
BitKeeper/deleted/.del-compile-AUTOTOOLS:
  Delete: netware/BUILD/compile-AUTOTOOLS
BitKeeper/deleted/.del-compile-linux-tools:
  Delete: netware/BUILD/compile-linux-tools
BitKeeper/deleted/.del-compile-netware-END:
  Delete: netware/BUILD/compile-netware-END
BitKeeper/deleted/.del-compile-netware-START:
  Delete: netware/BUILD/compile-netware-START
BitKeeper/deleted/.del-compile-netware-all:
  Delete: netware/BUILD/compile-netware-all
BitKeeper/deleted/.del-compile-netware-debug:
  Delete: netware/BUILD/compile-netware-debug
BitKeeper/deleted/.del-mwasmnlm~bc5746809d67feb5:
  Auto merged
BitKeeper/deleted/.del-mwenv~35c8b56062f4b6aa:
  Auto merged
BitKeeper/deleted/.del-mwccnlm~be63afd25a14c3f:
  Auto merged
BitKeeper/deleted/.del-mwldnlm~efb26c57cba3c980:
  Auto merged
BitKeeper/deleted/.del-netware.patch~f70a3a965f54d9ee:
  Auto merged
Docs/internals.texi:
  Auto merged
VC++Files/bdb/bdb.dsp:
  Auto merged
VC++Files/bdb/build_win32/Berkeley_DB.dsw:
  Auto merged
VC++Files/bdb/build_win32/db_archive.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_buildall.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_checkpoint.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_deadlock.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_dll.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_dump.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_java.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_load.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_printlog.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_recover.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_stat.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_static.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_static1.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_tcl.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_test.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_upgrade.dsp:
  Auto merged
VC++Files/bdb/build_win32/db_verify.dsp:
  Auto merged
VC++Files/bdb/build_win32/ex_access.dsp:
  Auto merged
VC++Files/bdb/build_win32/ex_btrec.dsp:
  Auto merged
VC++Files/bdb/build_win32/ex_env.dsp:
  Auto merged
VC++Files/bdb/build_win32/ex_lock.dsp:
  Auto merged
VC++Files/bdb/build_win32/ex_mpool.dsp:
  Auto merged
VC++Files/bdb/build_win32/ex_tpcb.dsp:
  Auto merged
VC++Files/bdb/build_win32/excxx_access.dsp:
  Auto merged
VC++Files/bdb/build_win32/excxx_btrec.dsp:
  Auto merged
VC++Files/bdb/build_win32/excxx_env.dsp:
  Auto merged
VC++Files/bdb/build_win32/excxx_lock.dsp:
  Auto merged
VC++Files/bdb/build_win32/excxx_mpool.dsp:
  Auto merged
VC++Files/bdb/build_win32/excxx_tpcb.dsp:
  Auto merged
VC++Files/client/mysql.dsp:
  Auto merged
VC++Files/client/mysqladmin.dsp:
  Auto merged
VC++Files/client/mysqlcheck.dsp:
  Auto merged
VC++Files/client/mysqlclient.dsp:
  Auto merged
VC++Files/client/mysqlclient.dsw:
  Auto merged
VC++Files/client/mysqldump.dsp:
  Auto merged
VC++Files/client/mysqlimport.dsp:
  Auto merged
VC++Files/client/mysqlshow.dsp:
  Auto merged
VC++Files/comp_err/comp_err.dsp:
  Auto merged
VC++Files/contrib/asm386/zlibvc.dsp:
  Auto merged
VC++Files/contrib/asm386/zlibvc.dsw:
  Auto merged
VC++Files/contrib/minizip/zlibvc.dsp:
  Auto merged
VC++Files/contrib/minizip/zlibvc.dsw:
  Auto merged
VC++Files/dbug/dbug.dsp:
  Auto merged
VC++Files/dbug/dbug.dsw:
  Auto merged
VC++Files/heap/heap.dsp:
  Auto merged
VC++Files/innobase/innobase.dsp:
  Auto merged
VC++Files/isam/isam.dsp:
  Auto merged
VC++Files/isam/isam.dsw:
  Auto merged
VC++Files/isamchk/isamchk.dsp:
  Auto merged
VC++Files/libmysql/libmysql.dsp:
  Auto merged
VC++Files/libmysql/libmysql.dsw:
  Auto merged
VC++Files/libmysqld/examples/test_libmysqld.dsp:
  Auto merged
VC++Files/libmysqld/libmysqld.dsp:
  Auto merged
VC++Files/libmysqltest/myTest.dsp:
  Auto merged
VC++Files/libmysqltest/mytest.dsw:
  Auto merged
VC++Files/merge/merge.dsp:
  Auto merged
VC++Files/merge/merge.dsw:
  Auto merged
VC++Files/my_print_defaults/my_print_defaults.dsp:
  Auto merged
VC++Files/myisam/myisam.dsp:
  Auto merged
VC++Files/myisamchk/myisamchk.dsp:
  Auto merged
VC++Files/myisamlog/myisamlog.dsp:
  Auto merged
VC++Files/myisammrg/myisammrg.dsp:
  Auto merged
VC++Files/mysql.dsp:
  Auto merged
VC++Files/mysql.dsw:
  Auto merged
VC++Files/myisampack/myisampack.dsp:
  Auto merged
VC++Files/mysqlbinlog/mysqlbinlog.dsp:
  Auto merged
VC++Files/mysqlcheck/mysqlcheck.dsp:
  Auto merged
VC++Files/mysqldemb/mysqldemb.dsp:
  Auto merged
VC++Files/mysqlmanager/MySqlManager.dsp:
  Auto merged
VC++Files/mysqlmanager/mysqlmanager.dsw:
  Auto merged
VC++Files/mysqlserver/mysqlserver.dsp:
  Auto merged
VC++Files/mysqlshutdown/myshutdown.dsp:
  Auto merged
VC++Files/mysqlshutdown/mysqlshutdown.dsp:
  Auto merged
VC++Files/mysqlwatch/mysqlwatch.dsp:
  Auto merged
VC++Files/mysys/mysys.dsp:
  Auto merged
VC++Files/mysys/mysys.dsw:
  Auto merged
VC++Files/pack_isam/pack_isam.dsp:
  Auto merged
VC++Files/perror/perror.dsp:
  Auto merged
VC++Files/regex/regex.dsp:
  Auto merged
VC++Files/regex/regex.dsw:
  Auto merged
VC++Files/replace/replace.dsp:
  Auto merged
VC++Files/sql/mysqld.dsw:
  Auto merged
VC++Files/sql/mysqldmax.dsp:
  Auto merged
VC++Files/sql/old/mysqld.dsw:
  Auto merged
VC++Files/strings/MASM6x/strings.dsp:
  Auto merged
VC++Files/strings/MASM6x/strings.dsw:
  Auto merged
VC++Files/strings/backup/strings.dsp:
  Auto merged
VC++Files/strings/backup/strings.dsw:
  Auto merged
VC++Files/strings/noMASM/strings.dsp:
  Auto merged
VC++Files/strings/noMASM/strings.dsw:
  Auto merged
VC++Files/strings/strings.dsw:
  Auto merged
VC++Files/test1/test1.dsp:
  Auto merged
VC++Files/thr_insert_test/thr_insert_test.dsp:
  Auto merged
VC++Files/thr_test/thr_test.dsp:
  Auto merged
VC++Files/vio/vio.dsp:
  Auto merged
VC++Files/zlib/zlib.dsp:
  Auto merged
client/mysqlbinlog.cc:
  Auto merged
client/mysqlshow.c:
  Auto merged
include/my_global.h:
  Auto merged
include/my_sys.h:
  Auto merged
include/myisam.h:
  Auto merged
include/thr_lock.h:
  Auto merged
include/violite.h:
  Auto merged
innobase/buf/buf0buf.c:
  Auto merged
innobase/os/os0file.c:
  Auto merged
innobase/row/row0sel.c:
  Auto merged
innobase/srv/srv0start.c:
  Auto merged
innobase/trx/trx0sys.c:
  Auto merged
libmysqld/lib_vio.c:
  Auto merged
myisam/mi_create.c:
  Auto merged
mysql-test/Makefile.am:
  Auto merged
mysql-test/r/create.result:
  Auto merged
mysql-test/r/group_by.result:
  Auto merged
mysql-test/r/innodb.result:
  Auto merged
mysql-test/r/join.result:
  Auto merged
mysql-test/r/rpl000001.result:
  Auto merged
mysql-test/r/select.result:
  Auto merged
mysql-test/t/auto_increment.test:
  Auto merged
mysql-test/t/create.test:
  Auto merged
mysql-test/t/func_like.test:
  Auto merged
mysql-test/t/group_by.test:
  Auto merged
mysql-test/t/innodb.test:
  Auto merged
mysql-test/t/join.test:
  Auto merged
mysql-test/t/type_datetime.test:
  Auto merged
mysql-test/t/type_timestamp.test:
  Auto merged
mysys/default.c:
  Auto merged
mysys/thr_lock.c:
  Auto merged
scripts/make_binary_distribution.sh:
  Auto merged
scripts/mysqld_safe.sh:
  Auto merged
sql/filesort.cc:
  Auto merged
sql/ha_innodb.h:
  Auto merged
sql/ha_myisam.cc:
  Auto merged
sql/handler.cc:
  Auto merged
sql/handler.h:
  Auto merged
sql/item.cc:
  Auto merged
sql/item_cmpfunc.cc:
  Auto merged
sql/item_func.cc:
  Auto merged
sql/lock.cc:
  Auto merged
sql/log.cc:
  Auto merged
sql/log_event.h:
  Auto merged
sql/mf_iocache.cc:
  Auto merged
sql/mysql_priv.h:
  Auto merged
sql/net_serv.cc:
  Auto merged
sql/opt_range.cc:
  Auto merged
sql/repl_failsafe.cc:
  Auto merged
sql/repl_failsafe.h:
  Auto merged
sql/slave.cc:
  Auto merged
sql/slave.h:
  Auto merged
sql/sql_analyse.cc:
  Auto merged
sql/sql_base.cc:
  Auto merged
sql-bench/crash-me.sh:
  Auto merged
sql/share/polish/errmsg.txt:
  Auto merged
sql/sql_class.h:
  Auto merged
sql/sql_rename.cc:
  Auto merged
sql/sql_repl.cc:
  Auto merged
sql/sql_repl.h:
  Auto merged
sql/sql_update.cc:
  Auto merged
sql/stacktrace.c:
  Auto merged
sql/table.cc:
  Auto merged
sql/unireg.h:
  Auto merged
strings/ctype-tis620.c:
  Auto merged
strings/t_ctype.h:
  Auto merged
support-files/mysql.spec.sh:
  Auto merged
tests/grant.res:
  Auto merged
vio/viosocket.c:
  Auto merged

1 files changed, 16 insertions, 2 deletions

diff --git a/myisam/mi_open.c b/myisam/mi_open.c
index 1ed3ee78ffb..26c8e503c28 100644
--- a/myisam/mi_open.c
+++ b/myisam/mi_open.c
@@ -37,6 +37,14 @@ static void setup_key_functions(MI_KEYDEF *keyinfo);
 					pos+=size;}
 
 
+#define disk_pos_assert(pos, end_pos) \
+if (pos > end_pos)             \
+{                              \
+  my_errno=HA_ERR_CRASHED;     \
+  goto err;                    \
+}
+
+
 /******************************************************************************
 ** Return the shared struct if the table is already open.
 ** In MySQL the server will handle version issues.
@@ -72,7 +80,7 @@ MI_INFO *mi_open(const char *name, int mode, uint open_flags)
     key_parts,unique_key_parts,fulltext_keys,uniques;
   char name_buff[FN_REFLEN], org_name [FN_REFLEN], index_name[FN_REFLEN],
        data_name[FN_REFLEN];
-  char *disk_cache,*disk_pos;
+  char *disk_cache, *disk_pos, *end_pos;
   MI_INFO info,*m_info,*old_info;
   MYISAM_SHARE share_buff,*share;
   ulong rec_per_key_part[MI_MAX_POSSIBLE_KEY*MI_MAX_KEY_SEG];
@@ -139,11 +147,12 @@ MI_INFO *mi_open(const char *name, int mode, uint open_flags)
 
     info_length=mi_uint2korr(share->state.header.header_length);
     base_pos=mi_uint2korr(share->state.header.base_pos);
-    if (!(disk_cache=(char*) my_alloca(info_length)))
+    if (!(disk_cache=(char*) my_alloca(info_length+128)))
     {
       my_errno=ENOMEM;
       goto err;
     }
+    end_pos=disk_cache+info_length;
     errpos=2;
 
     VOID(my_seek(kfile,0L,MY_SEEK_SET,MYF(0)));
@@ -288,6 +297,8 @@ MI_INFO *mi_open(const char *name, int mode, uint open_flags)
       for (i=0 ; i < keys ; i++)
       {
 	disk_pos=mi_keydef_read(disk_pos, &share->keyinfo[i]);
+        disk_pos_assert(disk_pos + share->keyinfo[i].keysegs * MI_KEYSEG_SIZE,
+ 			end_pos);
         if (share->keyinfo[i].key_alg == HA_KEY_ALG_RTREE)
           have_rtree=1;
 	set_if_smaller(share->blocksize,share->keyinfo[i].block_length);
@@ -361,6 +372,8 @@ MI_INFO *mi_open(const char *name, int mode, uint open_flags)
       for (i=0 ; i < uniques ; i++)
       {
 	disk_pos=mi_uniquedef_read(disk_pos, &share->uniqueinfo[i]);
+        disk_pos_assert(disk_pos + share->uniqueinfo[i].keysegs *
+			MI_KEYSEG_SIZE, end_pos);
 	share->uniqueinfo[i].seg=pos;
 	for (j=0 ; j < share->uniqueinfo[i].keysegs; j++,pos++)
 	{
@@ -384,6 +397,7 @@ MI_INFO *mi_open(const char *name, int mode, uint open_flags)
       }
     }
 
+    disk_pos_assert(disk_pos + share->base.fields *MI_COLUMNDEF_SIZE, end_pos);
     for (i=j=offset=0 ; i < share->base.fields ; i++)
     {
       disk_pos=mi_recinfo_read(disk_pos,&share->rec[i]);