diff options
| author | svoj@mysql.com/april.(none) <> | 2006-10-18 17:57:29 +0500 |
|---|---|---|
| committer | svoj@mysql.com/april.(none) <> | 2006-10-18 17:57:29 +0500 |
| commit | a2e0059f3c1cf647b1feaf80780a917476ae4bba (patch) | |
| tree | 53984d04f062e309c8ffd5e75aa6f749396a3814 /myisam | |
| parent | 3ee35a76187b479c71dc4c417819c6183397521b (diff) | |
| download | mariadb-git-a2e0059f3c1cf647b1feaf80780a917476ae4bba.tar.gz | |
BUG#23175 - MYISAM crash/repair failed during repair
Repair table could crash a server if there is not sufficient
memory (myisam_sort_buffer_size) to operate. Affects not only
repair, but also all statements that use create index by sort:
repair by sort, parallel repair, bulk insert.
Return an error if there is not sufficient memory to store at
least one key per BUFFPEK.
Also fixed memory leak if thr_find_all_keys returns an error.
Diffstat (limited to 'myisam')
| -rw-r--r-- | myisam/sort.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/myisam/sort.c b/myisam/sort.c index 727840709da..154d50d4d39 100644 --- a/myisam/sort.c +++ b/myisam/sort.c @@ -148,7 +148,8 @@ int _create_index_by_sort(MI_SORT_PARAM *info,my_bool no_messages, skr=maxbuffer; if (memavl < sizeof(BUFFPEK)*(uint) maxbuffer || (keys=(memavl-sizeof(BUFFPEK)*(uint) maxbuffer)/ - (sort_length+sizeof(char*))) <= 1) + (sort_length+sizeof(char*))) <= 1 || + keys < (uint) maxbuffer) { mi_check_print_error(info->sort_info->param, "sort_buffer_size is to small"); @@ -363,7 +364,8 @@ pthread_handler_decl(thr_find_all_keys,arg) skr=maxbuffer; if (memavl < sizeof(BUFFPEK)*maxbuffer || (keys=(memavl-sizeof(BUFFPEK)*maxbuffer)/ - (sort_length+sizeof(char*))) <= 1) + (sort_length+sizeof(char*))) <= 1 || + keys < (uint) maxbuffer) { mi_check_print_error(sort_param->sort_info->param, "sort_buffer_size is to small"); @@ -497,6 +499,8 @@ int thr_write_keys(MI_SORT_PARAM *sort_param) if (!sinfo->sort_keys) { got_error=1; + my_free(mi_get_rec_buff_ptr(info, sinfo->rec_buff), + MYF(MY_ALLOW_ZERO_PTR)); continue; } if (!got_error) |