From 15b92915ed93661a56f40430204d18bf7b7cf1fc Mon Sep 17 00:00:00 2001
From: Alexander Barkov <bar@mariadb.com>
Date: Tue, 19 Jun 2018 13:02:02 +0400
Subject: [PATCH] MDEV-15834 The code in
 TABLE_SHARE::init_from_binary_frm_image() is not safe

---
 mysql-test/std_data/frm/t1.frm           | Bin 0 -> 8584 bytes
 mysql-test/suite/vcol/r/vcol_misc.result |  10 ++++++++++
 mysql-test/suite/vcol/t/vcol_misc.test   |  16 ++++++++++++++++
 sql/table.cc                             |   6 +++++-
 4 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 mysql-test/std_data/frm/t1.frm

diff --git a/mysql-test/std_data/frm/t1.frm b/mysql-test/std_data/frm/t1.frm
new file mode 100644
index 0000000000000000000000000000000000000000..a998f54ec67d650e93535a513951727f378b10de
GIT binary patch
literal 8584
zcmeI&p$@_@5XSMZS0FSq2!g?22?DS<B!Yy5C)nNsH_40fNLa=d*svrRNd9N8y)M`8
zC%4{0N>LgGY2`^tUD!}Vsh{VbpE2@OU-E;mST3bmJ0T;000IagfB*srAb<b@2q1vK
z&kC5D?riUo2HKx?$L+pbV}Jkx2q1s}0tg_000IagfB*vjDR2(&fBFCU2H%}J$h6VK
zn<W3>(Z<0m=97W1MYHjI_F<?eEB(%dRq9z$<R;VF8^wH+A{Ts*N8##)rfjN4A*x)g
E@2oTy9smFU

literal 0
HcmV?d00001

diff --git a/mysql-test/suite/vcol/r/vcol_misc.result b/mysql-test/suite/vcol/r/vcol_misc.result
index 0a8d87dc2f7..92be94cbb81 100644
--- a/mysql-test/suite/vcol/r/vcol_misc.result
+++ b/mysql-test/suite/vcol/r/vcol_misc.result
@@ -354,5 +354,15 @@ a	b	c
 DROP TABLE t1;
 SET sql_mode=DEFAULT;
 #
+# MDEV-15834 The code in TABLE_SHARE::init_from_binary_frm_image() is not safe
+#
+SHOW TABLES;
+Tables_in_test
+t1
+SHOW CREATE TABLE t1;
+ERROR HY000: Incorrect information in file: './test/t1.frm'
+ALTER TABLE t1;
+ERROR HY000: Incorrect information in file: './test/t1.frm'
+#
 # End of 5.5 tests
 #
diff --git a/mysql-test/suite/vcol/t/vcol_misc.test b/mysql-test/suite/vcol/t/vcol_misc.test
index 1ac0b4f80b7..a123d21d574 100644
--- a/mysql-test/suite/vcol/t/vcol_misc.test
+++ b/mysql-test/suite/vcol/t/vcol_misc.test
@@ -1,5 +1,7 @@
 --source include/have_ucs2.inc
 
+let $MYSQLD_DATADIR= `select @@datadir`;
+
 --disable_warnings
 drop table if exists t1,t2;
 --enable_warnings
@@ -318,6 +320,20 @@ SELECT * FROM t1;
 DROP TABLE t1;
 SET sql_mode=DEFAULT;
 
+
+--echo #
+--echo # MDEV-15834 The code in TABLE_SHARE::init_from_binary_frm_image() is not safe
+--echo #
+
+--copy_file std_data/frm/t1.frm $MYSQLD_DATADIR/test/t1.frm
+SHOW TABLES;
+--error ER_NOT_FORM_FILE
+SHOW CREATE TABLE t1;
+--error ER_NOT_FORM_FILE
+ALTER TABLE t1;
+--remove_file $MYSQLD_DATADIR/test/t1.frm
+
+
 --echo #
 --echo # End of 5.5 tests
 --echo #
diff --git a/sql/table.cc b/sql/table.cc
index 552f514283d..87a249defa0 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -1462,7 +1462,11 @@ static int open_binary_frm(THD *thd, TABLE_SHARE *share, uchar *head,
 
       if ((uchar)field_type == (uchar)MYSQL_TYPE_VIRTUAL)
       {
-        DBUG_ASSERT(interval_nr); // Expect non-null expression
+        if (!interval_nr) // Expect non-null expression
+        {
+          error= 4;
+          goto err;
+        }
         /* 
           The interval_id byte in the .frm file stores the length of the
           expression statement for a virtual column.