1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MDEV-15834 The code in TABLE_SHARE::init_from_binary_frm_image() is not safe

Browse Source
This commit is contained in:
Alexander Barkov 2018-06-19 13:02:02 +04:00
parent e425216045
commit 15b92915ed
4 changed files with 31 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
mysql-test/std_data/frm/t1.frm Normal file
View File

Binary file not shown.

10
mysql-test/suite/vcol/r/vcol_misc.result
View File

@ -354,5 +354,15 @@ a b c
DROP TABLE t1; DROP TABLE t1;
SET sql_mode=DEFAULT; SET sql_mode=DEFAULT;
# #
# MDEV-15834 The code in TABLE_SHARE::init_from_binary_frm_image() is not safe
#
SHOW TABLES;
Tables_in_test
t1
SHOW CREATE TABLE t1;
ERROR HY000: Incorrect information in file: './test/t1.frm'
ALTER TABLE t1;
ERROR HY000: Incorrect information in file: './test/t1.frm'
#
# End of 5.5 tests # End of 5.5 tests
# #

16
mysql-test/suite/vcol/t/vcol_misc.test
View File

@ -1,5 +1,7 @@
--source include/have_ucs2.inc --source include/have_ucs2.inc
let $MYSQLD_DATADIR= `select @@datadir`;
--disable_warnings --disable_warnings
drop table if exists t1,t2; drop table if exists t1,t2;
--enable_warnings --enable_warnings
@ -318,6 +320,20 @@ SELECT * FROM t1;
DROP TABLE t1; DROP TABLE t1;
SET sql_mode=DEFAULT; SET sql_mode=DEFAULT;
--echo #
--echo # MDEV-15834 The code in TABLE_SHARE::init_from_binary_frm_image() is not safe
--echo #
--copy_file std_data/frm/t1.frm $MYSQLD_DATADIR/test/t1.frm
SHOW TABLES;
--error ER_NOT_FORM_FILE
SHOW CREATE TABLE t1;
--error ER_NOT_FORM_FILE
ALTER TABLE t1;
--remove_file $MYSQLD_DATADIR/test/t1.frm
--echo # --echo #
--echo # End of 5.5 tests --echo # End of 5.5 tests
--echo # --echo #

6
sql/table.cc
View File

@ -1462,7 +1462,11 @@ static int open_binary_frm(THD *thd, TABLE_SHARE *share, uchar *head,
if ((uchar)field_type == (uchar)MYSQL_TYPE_VIRTUAL) if ((uchar)field_type == (uchar)MYSQL_TYPE_VIRTUAL)
{ {
DBUG_ASSERT(interval_nr); // Expect non-null expression if (!interval_nr) // Expect non-null expression
{
error= 4;
goto err;
}
/* /*
The interval_id byte in the .frm file stores the length of the The interval_id byte in the .frm file stores the length of the
expression statement for a virtual column. expression statement for a virtual column.