diff options
| author | Praveenkumar Hulakund <praveenkumar.hulakund@oracle.com> | 2013-10-09 13:32:31 +0530 |
|---|---|---|
| committer | Praveenkumar Hulakund <praveenkumar.hulakund@oracle.com> | 2013-10-09 13:32:31 +0530 |
| commit | 5411549732cf543025fd458bbf9dd2e96bf20060 (patch) | |
| tree | 63588373ef155a408b482df06ebb37b01e342560 /sql/net_serv.cc | |
| parent | faca34da04fde2ec0a1836d9c26a787c3af5badd (diff) | |
| download | mariadb-git-5411549732cf543025fd458bbf9dd2e96bf20060.tar.gz | |
Bug#17474166 - EXECUTING STATEMENT LIKE 'SHOW ENGINE INNODB'
AND 'KILL SESSION' LEAD TO CRASH
Analysis:
--------
This situation occurs when the connection executes query
"show engine innodb status" and this connection is killed by
executing statement "kill <con>" by another connection.
In function "innodb_show_status", function "stat_print"
is called to print the status but return value of function
is not checked. After killing connection, if write to
connection fails then error is returned and same is set
in Diagnostic area. Since FALSE is returned from
"innodb_show_status" now, assert to check no error
is set in function "set_eof_status" (called from
my_eof) is failing.
Fix:
----
Changed code to check return value of function "stat_print"
in "innodb_show_status".
Diffstat (limited to 'sql/net_serv.cc')
| -rw-r--r-- | sql/net_serv.cc | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/sql/net_serv.cc b/sql/net_serv.cc index 1a79679ed7c..8b44c7d443f 100644 --- a/sql/net_serv.cc +++ b/sql/net_serv.cc @@ -1,4 +1,4 @@ -/* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved. +/* Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -370,6 +370,12 @@ my_net_write(NET *net,const uchar *packet,size_t len) MYSQL_NET_WRITE_START(len); + DBUG_EXECUTE_IF("simulate_net_write_failure", { + my_error(ER_NET_ERROR_ON_WRITE, MYF(0)); + return 1; + }; + ); + /* Big packets are handled by splitting them in packets of MAX_PACKET_LENGTH length. The last packet is always a packet that is < MAX_PACKET_LENGTH. |