diff options
| author | unknown <ingo@mysql.com> | 2006-06-28 16:07:39 +0200 |
|---|---|---|
| committer | unknown <ingo@mysql.com> | 2006-06-28 16:07:39 +0200 |
| commit | 9ad8a373f186b6f8f1edcb15f5f4f2dd6e60df7a (patch) | |
| tree | 002228224a472449de43d63541d3547b41ddc061 /myisam | |
| parent | f4a07612efd66a559fe06810deee5e38cd96d03c (diff) | |
| download | mariadb-git-9ad8a373f186b6f8f1edcb15f5f4f2dd6e60df7a.tar.gz | |
Bug#19835 - Binary copy of corrupted tables crash the server when issuing a query
A corrupt table with dynamic record format can crash the
server when trying to select from it.
I fixed the crash that resulted from the particular type
of corruption that has been reported for this bug.
No test case. To test it, one needs a table with a very special
corruption. The bug report contains a file with such a table.
myisam/mi_dynrec.c:
Bug#19835 - Binary copy of corrupted tables crash the server when issuing a query
Added a protection against corrupted records. A dynamic
record header with invalid 'next' pointer could trigger
the assert in _mi_get_block_info(). Now I avoid this by
reporting a corruption error.
Diffstat (limited to 'myisam')
| -rw-r--r-- | myisam/mi_dynrec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/myisam/mi_dynrec.c b/myisam/mi_dynrec.c index 43783ca2d36..1b691c955f1 100644 --- a/myisam/mi_dynrec.c +++ b/myisam/mi_dynrec.c @@ -1116,6 +1116,9 @@ int _mi_read_dynamic_record(MI_INFO *info, my_off_t filepos, byte *buf) info->rec_cache.pos_in_file <= block_info.next_filepos && flush_io_cache(&info->rec_cache)) goto err; + /* A corrupted table can have wrong pointers. (Bug# 19835) */ + if (block_info.next_filepos == HA_OFFSET_ERROR) + goto panic; info->rec_cache.seek_not_done=1; if ((b_type=_mi_get_block_info(&block_info,file, block_info.next_filepos)) |