From 344f33bb89d60f83e7ec7fdc2275f88dc9468523 Mon Sep 17 00:00:00 2001
From: "istruewing@chilla.local" <>
Date: Mon, 19 Mar 2007 15:56:53 +0100
Subject: [PATCH 1/3] Bug#26996 - Update of a Field in a Memory Table ends with
 wrong result

Using a MEMORY table BTREE index for scanning for updatable rows
could lead to an infinite loop.

Everytime a key was inserted into a btree index, the position
in the index scan was cleared. The search started from the
beginning and found the same key again.

Now we do not clear the position on key insert an more.
---
 heap/hp_write.c                |  1 -
 mysql-test/r/heap_btree.result | 15 +++++++++++++++
 mysql-test/t/heap_btree.test   | 14 ++++++++++++++
 3 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/heap/hp_write.c b/heap/hp_write.c
index 841dda6264e..59dfca31fd9 100644
--- a/heap/hp_write.c
+++ b/heap/hp_write.c
@@ -106,7 +106,6 @@ int hp_rb_write_key(HP_INFO *info, HP_KEYDEF *keyinfo, const byte *record,
   heap_rb_param custom_arg;
   uint old_allocated;
 
-  info->last_pos= NULL; /* For heap_rnext/heap_rprev */
   custom_arg.keyseg= keyinfo->seg;
   custom_arg.key_length= hp_rb_make_key(keyinfo, info->recbuf, record, recpos);
   if (keyinfo->flag & HA_NOSAME)
diff --git a/mysql-test/r/heap_btree.result b/mysql-test/r/heap_btree.result
index e6492e90b80..1a0666514be 100644
--- a/mysql-test/r/heap_btree.result
+++ b/mysql-test/r/heap_btree.result
@@ -280,4 +280,19 @@ a
 1
 1
 drop table t1;
+CREATE TABLE t1 (
+c1 CHAR(3),
+c2 INTEGER,
+KEY USING BTREE(c1),
+KEY USING BTREE(c2)
+) ENGINE= MEMORY;
+INSERT INTO t1 VALUES ('ABC',0), ('A',0), ('B',0), ('C',0);
+UPDATE t1 SET c2= c2 + 1 WHERE c1 = 'A';
+SELECT * FROM t1;
+c1	c2
+ABC	0
+A	1
+B	0
+C	0
+DROP TABLE t1;
 End of 4.1 tests
diff --git a/mysql-test/t/heap_btree.test b/mysql-test/t/heap_btree.test
index 9aa820becd9..63baa968981 100644
--- a/mysql-test/t/heap_btree.test
+++ b/mysql-test/t/heap_btree.test
@@ -182,4 +182,18 @@ delete from t1 where a >= 2;
 select a from t1 order by a;
 drop table t1;
 
+#
+# Bug#26996 - Update of a Field in a Memory Table ends with wrong result
+#
+CREATE TABLE t1 (
+  c1 CHAR(3),
+  c2 INTEGER,
+  KEY USING BTREE(c1),
+  KEY USING BTREE(c2)
+) ENGINE= MEMORY;
+INSERT INTO t1 VALUES ('ABC',0), ('A',0), ('B',0), ('C',0);
+UPDATE t1 SET c2= c2 + 1 WHERE c1 = 'A';
+SELECT * FROM t1;
+DROP TABLE t1;
+
 --echo End of 4.1 tests

From b88e7e0f975e07303d1d246eb9641e49db9b69af Mon Sep 17 00:00:00 2001
From: "svoj@mysql.com/june.mysql.com" <>
Date: Wed, 21 Mar 2007 17:12:30 +0400
Subject: [PATCH 2/3] BUG#25908 - corrupted myisam table crashes server even
 after repair

Opening certain tables that have different definitions in .MYI and
.frm may result in a server crash.

Compare .MYI and .frm definition when myisam table is opened. In case
definitions are diffirent refuse to open such table.

No test case, since it requires broken table.
---
 storage/myisam/ha_myisam.cc | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/storage/myisam/ha_myisam.cc b/storage/myisam/ha_myisam.cc
index a67d62f7447..587e5220e1c 100644
--- a/storage/myisam/ha_myisam.cc
+++ b/storage/myisam/ha_myisam.cc
@@ -632,6 +632,9 @@ bool ha_myisam::check_if_locking_is_allowed(uint sql_command,
 
 int ha_myisam::open(const char *name, int mode, uint test_if_locked)
 {
+  MI_KEYDEF *keyinfo;
+  MI_COLUMNDEF *recinfo= 0;
+  uint recs;
   uint i;
 
   /*
@@ -654,6 +657,26 @@ int ha_myisam::open(const char *name, int mode, uint test_if_locked)
 
   if (!(file=mi_open(name, mode, test_if_locked | HA_OPEN_FROM_SQL_LAYER)))
     return (my_errno ? my_errno : -1);
+  if (!table->s->tmp_table) /* No need to perform a check for tmp table */
+  {
+    if ((my_errno= table2myisam(table, &keyinfo, &recinfo, &recs)))
+    {
+      /* purecov: begin inspected */
+      DBUG_PRINT("error", ("Failed to convert TABLE object to MyISAM "
+                           "key and column definition"));
+      goto err;
+      /* purecov: end */
+    }
+    if (check_definition(keyinfo, recinfo, table->s->keys, recs,
+                         file->s->keyinfo, file->s->rec,
+                         file->s->base.keys, file->s->base.fields, true))
+    {
+      /* purecov: begin inspected */
+      my_errno= HA_ERR_CRASHED;
+      goto err;
+      /* purecov: end */
+    }
+  }
   
   if (test_if_locked & (HA_OPEN_IGNORE_IF_LOCKED | HA_OPEN_TMP_TABLE))
     VOID(mi_extra(file, HA_EXTRA_NO_WAIT_LOCK, 0));
@@ -675,6 +698,15 @@ int ha_myisam::open(const char *name, int mode, uint test_if_locked)
     table->key_info[i].block_size= file->s->keyinfo[i].block_length;
   }
   return (0);
+err:
+  this->close();
+  /*
+    Both recinfo and keydef are allocated by my_multi_malloc(), thus only
+    recinfo must be freed.
+  */
+  if (recinfo)
+    my_free((gptr) recinfo, MYF(0));
+  return my_errno;
 }
 
 int ha_myisam::close(void)

From 52debcb82097b49d2316303c8196ed9459009411 Mon Sep 17 00:00:00 2001
From: "istruewing@chilla.local" <>
Date: Thu, 22 Mar 2007 21:28:28 +0100
Subject: [PATCH 3/3] After merge fix

---
 storage/myisam/ha_myisam.cc | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/storage/myisam/ha_myisam.cc b/storage/myisam/ha_myisam.cc
index 6f4d12ec5f7..505febf8828 100644
--- a/storage/myisam/ha_myisam.cc
+++ b/storage/myisam/ha_myisam.cc
@@ -697,9 +697,11 @@ int ha_myisam::open(const char *name, int mode, uint test_if_locked)
         (struct st_mysql_ftparser *)parser->plugin->info;
     table->key_info[i].block_size= file->s->keyinfo[i].block_length;
   }
-  return (0);
-err:
+  my_errno= 0;
+  goto end;
+ err:
   this->close();
+ end:
   /*
     Both recinfo and keydef are allocated by my_multi_malloc(), thus only
     recinfo must be freed.