Bug #45796: invalid memory reads and writes when altering merge

            and base tables 

myrg_attach_children() could reuse a buffer that was allocated 
previously based on a definition of a child table. The problem 
was that the child's definition might have been changed, so 
reusing the buffer could lead to crashes or valgrind errors 
under some circumstances. 
 
Fixed by changing myrg_attach_children() so that the 
rec_per_key_part buffer is reused only when the child table
have not changed, and reallocated otherwise (the old buffer is 
deallocated if necessary).


include/myisammrg.h:
  Added a pointer to need_compat_check as an argument to
  myrg_attach_children().
mysql-test/r/merge.result:
  Added a test case for bug #45796.
mysql-test/t/merge.test:
  Added a test case for bug #45796.
storage/myisammrg/ha_myisammrg.cc:
  Pass a pointer to need_compat_check to myrg_attach_children().
storage/myisammrg/myrg_open.c:
  Changed myrg_attach_children() so that the 
  rec_per_key_part buffer is reused only when the child table
  have not changed, and reallocated otherwise (the old buffer 
  is deallocated if necessary).

1 files changed, 20 insertions, 0 deletions

diff --git a/mysql-test/t/merge.test b/mysql-test/t/merge.test
index 5315c91daa6..8760876b7ee 100644
--- a/mysql-test/t/merge.test
+++ b/mysql-test/t/merge.test
@@ -1535,4 +1535,24 @@ SELECT * FROM m1;
 
 DROP VIEW v1;
 DROP TABLE m1, t1;
+
+--echo #
+--echo # Bug #45796: invalid memory reads and writes when altering merge and 
+--echo #             base tables
+--echo #
+
+CREATE TABLE t1(c1 INT) ENGINE=MyISAM;
+CREATE TABLE m1(c1 INT) ENGINE=MERGE UNION=(t1);
+ALTER TABLE m1 ADD INDEX idx_c1(c1);
+# Open the MERGE table and allocate buffers based on children's definition.
+--error ER_WRONG_MRG_TABLE
+SELECT * FROM m1;
+# Change the child table definition.
+ALTER TABLE t1 ADD INDEX idx_c1(c1);
+# Check that old buffers are not reused
+SELECT * FROM m1;
+
+DROP TABLE m1;
+DROP TABLE t1;
+
 --echo End of 5.1 tests