MDEV-7538: Wrong constraint (TINYINT or MEDIUMINT and INT)

causes server crash

Analysis: If wrong data types used on foreign constraint there
was possibility that foreign->id is NULL when incorrect
foreign constraint was removed from the dictionary cache.

Fix: Add guard foreign->id != NULL before trying to lookup
or remove the foreign constraint from dictionary cache.

Tested using user database where problem was repeatable.

1 files changed, 16 insertions, 4 deletions

diff --git a/storage/xtradb/dict/dict0dict.c b/storage/xtradb/dict/dict0dict.c
index cf246bcdd5f..efb180d6e90 100644
--- a/storage/xtradb/dict/dict0dict.c
+++ b/storage/xtradb/dict/dict0dict.c
@@ -2650,8 +2650,14 @@ dict_foreign_remove_from_cache(
 			       foreign);
 
 		rbt = foreign->referenced_table->referenced_rbt;
-		if (rbt != NULL) {
-			rbt_delete(rbt, foreign->id);
+		if (rbt != NULL && foreign->id != NULL) {
+			const ib_rbt_node_t*	node
+				= rbt_lookup(rbt, foreign->id);
+			dict_foreign_t*	val = *(dict_foreign_t**) node->value;
+
+			if (val == foreign) {
+				rbt_delete(rbt, foreign->id);
+			}
 		}
 	}
 
@@ -2663,8 +2669,14 @@ dict_foreign_remove_from_cache(
 			       foreign);
 		rbt = foreign->foreign_table->foreign_rbt;
 
-		if (rbt != NULL) {
-			rbt_delete(rbt, foreign->id);
+		if (rbt != NULL && foreign->id != NULL) {
+			const ib_rbt_node_t*	node
+				= rbt_lookup(rbt, foreign->id);
+			dict_foreign_t*	val = *(dict_foreign_t**) node->value;
+
+			if (val == foreign) {
+				rbt_delete(rbt, foreign->id);
+			}
 		}
 	}