diff options
| author | Sergey Vojtovich <svoj@sun.com> | 2010-04-01 16:58:02 +0400 |
|---|---|---|
| committer | Sergey Vojtovich <svoj@sun.com> | 2010-04-01 16:58:02 +0400 |
| commit | f2415eb426d4fa824291bae7031fb5018bab067c (patch) | |
| tree | e49f285d9b87113805194c253284f375fadd9a60 /storage | |
| parent | 538d3f2a75e54b7ff4d0f1868bcd0e1c75187cc4 (diff) | |
| download | mariadb-git-f2415eb426d4fa824291bae7031fb5018bab067c.tar.gz | |
Applying InnoDB snapshot
Detailed revision comments:
r6868 | mmakela | 2010-03-25 13:03:08 +0200 (Thu, 25 Mar 2010) | 1 line
branches/zip: page_validate(): Check the buf[] bounds.
Diffstat (limited to 'storage')
| -rw-r--r-- | storage/innodb_plugin/page/page0page.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/storage/innodb_plugin/page/page0page.c b/storage/innodb_plugin/page/page0page.c index 1068a413e0c..10008f9ac25 100644 --- a/storage/innodb_plugin/page/page0page.c +++ b/storage/innodb_plugin/page/page0page.c @@ -2414,8 +2414,13 @@ page_validate( } offs = page_offset(rec_get_start(rec, offsets)); + i = rec_offs_size(offsets); + if (UNIV_UNLIKELY(offs + i >= UNIV_PAGE_SIZE)) { + fputs("InnoDB: record offset out of bounds\n", stderr); + goto func_exit; + } - for (i = rec_offs_size(offsets); i--; ) { + while (i--) { if (UNIV_UNLIKELY(buf[offs + i])) { /* No other record may overlap this */ @@ -2523,8 +2528,13 @@ n_owned_zero: count++; offs = page_offset(rec_get_start(rec, offsets)); + i = rec_offs_size(offsets); + if (UNIV_UNLIKELY(offs + i >= UNIV_PAGE_SIZE)) { + fputs("InnoDB: record offset out of bounds\n", stderr); + goto func_exit; + } - for (i = rec_offs_size(offsets); i--; ) { + while (i--) { if (UNIV_UNLIKELY(buf[offs + i])) { fputs("InnoDB: Record overlaps another" |