1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MDEV-35680 Table number > MAX_TABLES causes overflow of table_map at main.join test

Browse Source 
Fix a regression introduced by commit d98ac851 (MDEV-29935, MDEV-26247) causing
MAX_TABLES overflow in `setup_table_map()`. The check for MAX_TABLES was moved
outside of the loop that increments table numbers, allowing overflows during
loop iterations. Since setup_table_map() operates on a 64-bit bitmap, table
numbers exceeding 64 triggered the UBSAN check.
This commit returns the overflow check within the loop and adds a debug
assertion to `setup_table_map()` to ensure no bitmap overrun occurs.
This commit is contained in:
Oleg Smirnov 2024-12-20 14:58:33 +07:00
parent d878d80bc4
commit 24e5d56400
2 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sql/sql_base.cc
View File

@ -7862,11 +7862,15 @@ bool setup_tables(THD *thd, Name_resolution_context *context,
DBUG_RETURN(1);
}
tablenr++;
}
if (tablenr > MAX_TABLES)
{
my_error(ER_TOO_MANY_TABLES,MYF(0), static_cast<int>(MAX_TABLES));
DBUG_RETURN(1);
/*
Test MAX_TABLES overflow here inside the loop as setup_table_map()
called in each iteration is sensitive for this
*/
if (tablenr > MAX_TABLES)
{
my_error(ER_TOO_MANY_TABLES, MYF(0), static_cast<int>(MAX_TABLES));
DBUG_RETURN(1);
}
}
if (select_insert && !is_insert_tables_num_set)
{

1
sql/sql_base.h
View File

@ -353,6 +353,7 @@ inline void setup_table_map(TABLE *table, TABLE_LIST *table_list, uint tablenr)
table->maybe_null= embedding->outer_join;
embedding= embedding->embedding;
}
DBUG_ASSERT(tablenr <= MAX_TABLES);
table->tablenr= tablenr;
table->map= (table_map) 1 << tablenr;
table->force_index= table_list->force_index;