diff options
| author | Sergey Glukhov <Sergey.Glukhov@sun.com> | 2009-05-27 15:34:21 +0500 |
|---|---|---|
| committer | Sergey Glukhov <Sergey.Glukhov@sun.com> | 2009-05-27 15:34:21 +0500 |
| commit | f54beb2dccb921296a4c0bec1aa45e5dd6e53a69 (patch) | |
| tree | 6e9f81a0f0284469dd98521f14915cac7de9d740 /sql/sql_derived.cc | |
| parent | 8e589d1d06d48471bcef7164e458f6d9cefec2ec (diff) | |
| download | mariadb-git-f54beb2dccb921296a4c0bec1aa45e5dd6e53a69.tar.gz | |
Bug#41212 crash after race condition between merge table and table_cache evictions
On 64-bit Windows: querying MERGE table with keys may cause
server crash.The problem is generic and may affect any statement
accessing MERGE table cardinality values.
When MERGE engine was copying cardinality statistics, it was
using incorrect size of element in cardinality statistics array
(sizeof(ptr)==8 instead of sizeof(ulong)==4), causing access
of memory beyond of the allocated bounds.
sql/ha_myisam.cc:
When copying rec_per_key array (an array of ulong) use proper
size of element, that is sizeof(ulong).
sql/ha_myisammrg.cc:
When copying rec_per_key array (an array of ulong) use proper
size of element, that is sizeof(ulong).
sql/table.cc:
When allocating rec_per_key array (an array of ulong) use proper
size of element, that is sizeof(ulong).
Diffstat (limited to 'sql/sql_derived.cc')
0 files changed, 0 insertions, 0 deletions