1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MDEV-26420 Buffer overflow on instant ADD/DROP of generated column

Browse Source 
prepare_inplace_add_virtual(): Over-estimate the size of the arrays
by not subtracting table->s->virtual_fields (which may refer to
stored, not virtual generated columns). InnoDB only distinguishes
virtual columns.
This commit is contained in:
Marko Mäkelä 2022-07-26 16:45:10 +03:00
parent 8911823f65
commit 9a897335eb
3 changed files with 22 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
mysql-test/suite/innodb/r/instant_alter_bugs.result
View File

@ -458,3 +458,10 @@ f4 INT NOT NULL, f5 INT NOT NULL),
CHANGE COLUMN f1 f1 CHAR(10) DEFAULT NULL;
DROP TABLE t1;
SET GLOBAL innodb_purge_rseg_truncate_frequency=@save_frequency;
#
# MDEV-26420 Buffer overflow on instant ADD/DROP of generated column
#
CREATE TABLE t1 (i int AS (0) STORED, j INT) ENGINE=InnoDB;
ALTER TABLE t1 ADD COLUMN i INT GENERATED ALWAYS AS (1), DROP COLUMN i;
DROP TABLE t1;
# End of 10.4 tests

9
mysql-test/suite/innodb/t/instant_alter_bugs.test
View File

@ -476,3 +476,12 @@ ALTER TABLE t1 ADD COLUMN(f2 INT NOT NULL, f3 INT NOT NULL,
CHANGE COLUMN f1 f1 CHAR(10) DEFAULT NULL;
DROP TABLE t1;
SET GLOBAL innodb_purge_rseg_truncate_frequency=@save_frequency;
--echo #
--echo # MDEV-26420 Buffer overflow on instant ADD/DROP of generated column
--echo #
CREATE TABLE t1 (i int AS (0) STORED, j INT) ENGINE=InnoDB;
ALTER TABLE t1 ADD COLUMN i INT GENERATED ALWAYS AS (1), DROP COLUMN i;
DROP TABLE t1;
--echo # End of 10.4 tests

13
storage/innobase/handler/handler0alter.cc
View File

@ -5016,20 +5016,18 @@ prepare_inplace_add_virtual(
{
ha_innobase_inplace_ctx* ctx;
ulint i = 0;
ulint j = 0;
ctx = static_cast<ha_innobase_inplace_ctx*>
(ha_alter_info->handler_ctx);
ctx->num_to_add_vcol = altered_table->s->virtual_fields
+ ctx->num_to_drop_vcol - table->s->virtual_fields;
ulint j = altered_table->s->virtual_fields + ctx->num_to_drop_vcol;
ctx->add_vcol = static_cast<dict_v_col_t*>(
mem_heap_zalloc(ctx->heap, ctx->num_to_add_vcol
* sizeof *ctx->add_vcol));
mem_heap_zalloc(ctx->heap, j * sizeof *ctx->add_vcol));
ctx->add_vcol_name = static_cast<const char**>(
mem_heap_alloc(ctx->heap, ctx->num_to_add_vcol
* sizeof *ctx->add_vcol_name));
mem_heap_alloc(ctx->heap, j * sizeof *ctx->add_vcol_name));
j = 0;
for (const Create_field& new_field :
ha_alter_info->alter_info->create_list) {
@ -5110,6 +5108,7 @@ prepare_inplace_add_virtual(
j++;
}
ctx->num_to_add_vcol = j;
return(false);
}