diff options
| author | Jan Lindström <jan.lindstrom@mariadb.com> | 2015-03-06 11:19:23 +0200 |
|---|---|---|
| committer | Nirbhay Choubey <nirbhay@mariadb.com> | 2015-03-07 22:56:33 -0500 |
| commit | 6c19f51a5fe6bd0dbecf3cb8fd4f88e4f8da477e (patch) | |
| tree | 57c61bf4927504f5be3d1f7f779f5d3524e17297 /storage | |
| parent | e52a58a5cc338a82a9de446785f81c8f45064fa5 (diff) | |
| download | mariadb-git-6c19f51a5fe6bd0dbecf3cb8fd4f88e4f8da477e.tar.gz | |
MDEV-7672: Crash creating an InnoDB table with foreign keysmariadb-galera-5.5.42
Analysis: after a red-black-tree lookup we use node withouth
checking did lookup succeed or not. This lead to situation
where NULL-pointer was used.
Fix: Add additional check that found node from red-back-tree
is valid.
Diffstat (limited to 'storage')
| -rw-r--r-- | storage/innobase/dict/dict0dict.c | 18 | ||||
| -rw-r--r-- | storage/xtradb/dict/dict0dict.c | 18 |
2 files changed, 24 insertions, 12 deletions
diff --git a/storage/innobase/dict/dict0dict.c b/storage/innobase/dict/dict0dict.c index 15426b18c6d..cf0d4c12274 100644 --- a/storage/innobase/dict/dict0dict.c +++ b/storage/innobase/dict/dict0dict.c @@ -2533,10 +2533,13 @@ dict_foreign_remove_from_cache( if (rbt != NULL && foreign->id != NULL) { const ib_rbt_node_t* node = rbt_lookup(rbt, foreign->id); - dict_foreign_t* val = *(dict_foreign_t**) node->value; - if (val == foreign) { - rbt_delete(rbt, foreign->id); + if (node) { + dict_foreign_t* val = *(dict_foreign_t**) node->value; + + if (val == foreign) { + rbt_delete(rbt, foreign->id); + } } } } @@ -2552,10 +2555,13 @@ dict_foreign_remove_from_cache( if (rbt != NULL && foreign->id != NULL) { const ib_rbt_node_t* node = rbt_lookup(rbt, foreign->id); - dict_foreign_t* val = *(dict_foreign_t**) node->value; + if (node) { - if (val == foreign) { - rbt_delete(rbt, foreign->id); + dict_foreign_t* val = *(dict_foreign_t**) node->value; + + if (val == foreign) { + rbt_delete(rbt, foreign->id); + } } } } diff --git a/storage/xtradb/dict/dict0dict.c b/storage/xtradb/dict/dict0dict.c index 0addc419715..a67ca850c3a 100644 --- a/storage/xtradb/dict/dict0dict.c +++ b/storage/xtradb/dict/dict0dict.c @@ -2666,10 +2666,13 @@ dict_foreign_remove_from_cache( if (rbt != NULL && foreign->id != NULL) { const ib_rbt_node_t* node = rbt_lookup(rbt, foreign->id); - dict_foreign_t* val = *(dict_foreign_t**) node->value; - if (val == foreign) { - rbt_delete(rbt, foreign->id); + if (node) { + dict_foreign_t* val = *(dict_foreign_t**) node->value; + + if (val == foreign) { + rbt_delete(rbt, foreign->id); + } } } } @@ -2685,10 +2688,13 @@ dict_foreign_remove_from_cache( if (rbt != NULL && foreign->id != NULL) { const ib_rbt_node_t* node = rbt_lookup(rbt, foreign->id); - dict_foreign_t* val = *(dict_foreign_t**) node->value; - if (val == foreign) { - rbt_delete(rbt, foreign->id); + if (node) { + dict_foreign_t* val = *(dict_foreign_t**) node->value; + + if (val == foreign) { + rbt_delete(rbt, foreign->id); + } } } } |