MDEV-9137 MariaDB Crash on Query Using Aria Engine

update the code to match semantics of `key` -
it's not a (char*) pointer to the buffer as in MyISAM.

1 files changed, 10 insertions, 5 deletions

diff --git a/storage/maria/ma_write.c b/storage/maria/ma_write.c
index a9022417986..842f3a0aa8d 100644
--- a/storage/maria/ma_write.c
+++ b/storage/maria/ma_write.c
@@ -665,13 +665,18 @@ static int w_search(register MARIA_HA *info, uint32 comp_flag, MARIA_KEY *key,
       else
       {
         /* popular word. two-level tree. going down */
-        my_off_t root=dup_key_pos;
-        keyinfo= &share->ft2_keyinfo;
-        get_key_full_length_rdonly(off, key);
-        key+=off;
+        my_off_t root= dup_key_pos;
+        MARIA_KEY subkey;
+        get_key_full_length_rdonly(off, key->data);
+        subkey.keyinfo= keyinfo= &share->ft2_keyinfo;
+        subkey.data= key->data + off;
+        subkey.data_length= key->data_length - off;
+        subkey.ref_length= key->ref_length;
+        subkey.flag= key->flag;
+
         /* we'll modify key entry 'in vivo' */
         keypos-= keyinfo->keylength + page.node;
-        error= _ma_ck_real_write_btree(info, key, &root, comp_flag);
+        error= _ma_ck_real_write_btree(info, &subkey, &root, comp_flag);
         _ma_dpointer(share, keypos+HA_FT_WLEN, root);
         subkeys--; /* should there be underflow protection ? */
         DBUG_ASSERT(subkeys < 0);