bug#7798 - ndb - range scan with invalid table version could cause node failure

mysql-test/r/ndb_index_ordered.result:
  Test scan with invalid table version
mysql-test/t/ndb_index_ordered.test:
  Test scan with invalid table version
ndb/src/kernel/blocks/dbtc/DbtcMain.cpp:
  Set apiConnectstate= CS_ABORTING when receving a scan req with invalid
    table version

1 files changed, 23 insertions, 5 deletions

diff --git a/ndb/src/kernel/blocks/dbtc/DbtcMain.cpp b/ndb/src/kernel/blocks/dbtc/DbtcMain.cpp
index dd1252b76b9..815d6c9d838 100644
--- a/ndb/src/kernel/blocks/dbtc/DbtcMain.cpp
+++ b/ndb/src/kernel/blocks/dbtc/DbtcMain.cpp
@@ -1879,7 +1879,6 @@ void Dbtc::packKeyData000Lab(Signal* signal,
 			     Uint32 totalLen) 
 {
   CacheRecord * const regCachePtr = cachePtr.p;
-  UintR Tmp;
 
   jam();
   Uint32 len = 0;
@@ -8503,14 +8502,16 @@ void Dbtc::execSCAN_TABREQ(Signal* signal)
   apiConnectptr.i = scanTabReq->apiConnectPtr;
   tabptr.i = scanTabReq->tableId;
 
-  if (apiConnectptr.i >= capiConnectFilesize ||
-      tabptr.i >= ctabrecFilesize) {
+  if (apiConnectptr.i >= capiConnectFilesize)
+  {
     jam();
     warningHandlerLab(signal);
     return;
   }//if
+
   ptrAss(apiConnectptr, apiConnectRecord);
   ApiConnectRecord * transP = apiConnectptr.p;
+
   if (transP->apiConnectstate != CS_CONNECTED) {
     jam();
     // could be left over from TCKEYREQ rollback
@@ -8524,9 +8525,16 @@ void Dbtc::execSCAN_TABREQ(Signal* signal)
     } else {
       jam();
       errCode = ZSTATE_ERROR;
-      goto SCAN_TAB_error;
+      goto SCAN_TAB_error_no_state_change;
     }
   }
+
+  if(tabptr.i >= ctabrecFilesize)
+  {
+    errCode = ZUNKNOWN_TABLE_ERROR;
+    goto SCAN_TAB_error;
+  }
+
   ptrAss(tabptr, tableRecord);
   if ((aiLength == 0) ||
       (!tabptr.p->checkTable(schemaVersion)) ||
@@ -8621,8 +8629,18 @@ void Dbtc::execSCAN_TABREQ(Signal* signal)
   errCode = ZNO_SCANREC_ERROR;
   goto SCAN_TAB_error;
  
- SCAN_TAB_error:
+SCAN_TAB_error:
   jam();
+  /**
+   * Prepare for up coming ATTRINFO/KEYINFO
+   */
+  transP->apiConnectstate = CS_ABORTING;
+  transP->abortState = AS_IDLE;
+  transP->transid[0] = transid1;
+  transP->transid[1] = transid2;
+ 
+SCAN_TAB_error_no_state_change:
+  
   ScanTabRef * ref = (ScanTabRef*)&signal->theData[0];
   ref->apiConnectPtr = transP->ndbapiConnect;
   ref->transId1 = transid1;