1 files changed, 11 insertions, 8 deletions

diff --git a/ndb/src/kernel/blocks/dbtup/DbtupMeta.cpp b/ndb/src/kernel/blocks/dbtup/DbtupMeta.cpp
index fc27cca9cda..13593602abc 100644
--- a/ndb/src/kernel/blocks/dbtup/DbtupMeta.cpp
+++ b/ndb/src/kernel/blocks/dbtup/DbtupMeta.cpp
@@ -311,6 +311,7 @@ void Dbtup::execTUP_ADD_ATTRREQ(Signal* signal)
     setTabDescrWord(firstTabDesIndex, attrDescriptor);
     Uint32 attrLen = AttributeDescriptor::getSize(attrDescriptor);
     Uint32 nullBitPos = fragOperPtr.p->currNullBit;
+    Uint32 bitCount = 0;
 
     if (AttributeDescriptor::getNullable(attrDescriptor)) {
       if (!AttributeDescriptor::getDynamic(attrDescriptor)) {
@@ -342,27 +343,29 @@ void Dbtup::execTUP_ADD_ATTRREQ(Signal* signal)
 	else
 	{
 	  ljam();
-	  Uint32 bitCount = AttributeDescriptor::getArraySize(attrDescriptor);
+	  bitCount = AttributeDescriptor::getArraySize(attrDescriptor);
 	  fragOperPtr.p->currNullBit += bitCount;
+	  break;
 	}
       }
       default:
         ndbrequire(false);
         break;
       }//switch
+      if(nullBitPos + bitCount + 1 >= MAX_NULL_BITS)
+      {
+	terrorCode = TupAddAttrRef::TooManyBitsUsed;
+        addattrrefuseLab(signal, regFragPtr, fragOperPtr, regTabPtr.p, fragId);
+	return;
+      }
       AttributeOffset::setOffset(attrDes2, attributePos);
       AttributeOffset::setNullFlagPos(attrDes2, nullBitPos);
     } else {
       ndbrequire(false);
     }//if
     if (csNumber != 0) { 
-      CHARSET_INFO* cs = get_charset(csNumber, MYF(0));
-      if (cs == NULL) {
-        ljam();
-        terrorCode = TupAddAttrRef::InvalidCharset;
-        addattrrefuseLab(signal, regFragPtr, fragOperPtr, regTabPtr.p, fragId);
-        return;
-      }
+      CHARSET_INFO* cs = all_charsets[csNumber];
+      ndbrequire(cs != NULL);
       Uint32 i = 0;
       while (i < fragOperPtr.p->charsetIndex) {
         ljam();