MariaDB 5.2 -> MariaDB 5.3 merge

3 files changed, 21 insertions, 1 deletions

diff --git a/storage/xtradb/row/row0ins.c b/storage/xtradb/row/row0ins.c
index fe51fce82c4..4b104ced649 100644
--- a/storage/xtradb/row/row0ins.c
+++ b/storage/xtradb/row/row0ins.c
@@ -1340,6 +1340,12 @@ run_again:
 		const rec_t*		rec = btr_pcur_get_rec(&pcur);
 		const buf_block_t*	block = btr_pcur_get_block(&pcur);
 
+		if (srv_pass_corrupt_table && !block) {
+			err = DB_CORRUPTION;
+			break;
+		}
+		ut_a(block);
+
 		if (page_rec_is_infimum(rec)) {
 
 			goto next_rec;
diff --git a/storage/xtradb/row/row0merge.c b/storage/xtradb/row/row0merge.c
index 25f041c0885..93b2095dc26 100644
--- a/storage/xtradb/row/row0merge.c
+++ b/storage/xtradb/row/row0merge.c
@@ -92,7 +92,7 @@ This buffer is used for writing or reading a record that spans two
 row_merge_block_t.  Thus, it must be able to hold one merge record,
 whose maximum size is the same as the minimum size of
 row_merge_block_t. */
-typedef byte	mrec_buf_t[UNIV_PAGE_SIZE];
+typedef byte	mrec_buf_t[UNIV_PAGE_SIZE_MAX];
 
 /** @brief Merge record in row_merge_block_t.
 
@@ -1216,6 +1216,13 @@ row_merge_read_clustered_index(
 
 		if (UNIV_LIKELY(has_next)) {
 			rec = btr_pcur_get_rec(&pcur);
+
+			if (srv_pass_corrupt_table && !rec) {
+				err = DB_CORRUPTION;
+				goto err_exit;
+			}
+			ut_a(rec);
+
 			offsets = rec_get_offsets(rec, clust_index, NULL,
 						  ULINT_UNDEFINED, &row_heap);
 
diff --git a/storage/xtradb/row/row0sel.c b/storage/xtradb/row/row0sel.c
index 4a6a3ed878d..61b4f84d6b2 100644
--- a/storage/xtradb/row/row0sel.c
+++ b/storage/xtradb/row/row0sel.c
@@ -3809,6 +3809,13 @@ rec_loop:
 	/* PHASE 4: Look for matching records in a loop */
 
 	rec = btr_pcur_get_rec(pcur);
+
+	if (srv_pass_corrupt_table && !rec) {
+		err = DB_CORRUPTION;
+		goto lock_wait_or_error;
+	}
+	ut_a(rec);
+
 	ut_ad(!!page_rec_is_comp(rec) == comp);
 #ifdef UNIV_SEARCH_DEBUG
 	/*