BUG#21617 - crash when selecting from merge table with inconsistent indexes

Crash may happen when selecting from a merge table that has underlying
tables with less indexes than in a merge table itself.

If number of keys in merge table is not bigger than requested key number,
return error.


myisammrg/myrg_open.c:
  Store min(number of keys) in m_info instead of number of keys in last
  underlying table.
myisammrg/myrg_queue.c:
  Return error if inx passed to _myrg_init_queue function is not less
  than number of keys.
mysql-test/r/merge.result:
  A test case for bug#21617.
mysql-test/t/merge.test:
  A test case for bug#21617.
mysys/queues.c:
  Replaced annoying ifndef DBUG_OFF with DBUG_ASSERT, fixed coding style.
  The problem was that having queue overrun in debug build was hidden
  with this ifdef.

2 files changed, 7 insertions, 2 deletions

diff --git a/myisammrg/myrg_open.c b/myisammrg/myrg_open.c
index f9cdc2bb205..6527ac648f7 100644
--- a/myisammrg/myrg_open.c
+++ b/myisammrg/myrg_open.c
@@ -33,7 +33,7 @@
 MYRG_INFO *myrg_open(const char *name, int mode, int handle_locking)
 {
   int save_errno,errpos=0;
-  uint files=0,i,dir_length,length,key_parts;
+  uint files= 0, i, dir_length, length, key_parts, min_keys= 0;
   ulonglong file_offset=0;
   char name_buff[FN_REFLEN*2],buff[FN_REFLEN],*end;
   MYRG_INFO *m_info=0;
@@ -106,6 +106,7 @@ MYRG_INFO *myrg_open(const char *name, int mode, int handle_locking)
         files= 0;
       }
       m_info->reclength=isam->s->base.reclength;
+      min_keys= isam->s->base.keys;
       errpos=3;
     }
     m_info->open_tables[files].table= isam;
@@ -121,6 +122,8 @@ MYRG_INFO *myrg_open(const char *name, int mode, int handle_locking)
     m_info->records+= isam->state->records;
     m_info->del+= isam->state->del;
     m_info->data_file_length+= isam->state->data_file_length;
+    if (min_keys > isam->s->base.keys)
+      min_keys= isam->s->base.keys;
     for (i=0; i < key_parts; i++)
       m_info->rec_per_key_part[i]+= (isam->s->state.rec_per_key_part[i] /
                                      m_info->tables);
@@ -138,7 +141,7 @@ MYRG_INFO *myrg_open(const char *name, int mode, int handle_locking)
     my_errno=HA_ERR_RECORD_FILE_FULL;
     goto err;
   }
-  m_info->keys= files ? isam->s->base.keys : 0;
+  m_info->keys= min_keys;
   bzero((char*) &m_info->by_key,sizeof(m_info->by_key));
 
   /* this works ok if the table list is empty */
diff --git a/myisammrg/myrg_queue.c b/myisammrg/myrg_queue.c
index 7172b9f0e2a..bf99e8434a6 100644
--- a/myisammrg/myrg_queue.c
+++ b/myisammrg/myrg_queue.c
@@ -51,6 +51,8 @@ int _myrg_init_queue(MYRG_INFO *info,int inx,enum ha_rkey_function search_flag)
 	error=my_errno;
     }
   }
+  else
+    my_errno= error= HA_ERR_WRONG_INDEX;
   return error;
 }