Browse Source

MDEV-36220 Correct length in memcpy saving and restoring found NULL record in loose index scan of min

Use reclength because rec_buff_length is the actual reclength with
padding, whose use could cause ASAN unknown-crash, presumably caused
by memory violation.
pull/3892/head
Yuchen Pei 8 months ago
parent
commit
b50df7bbd4
No known key found for this signature in database GPG Key ID: 3DD1B35105743563
  1. 12
      mysql-test/main/group_min_max.result
  2. 10
      mysql-test/main/group_min_max.test
  3. 4
      sql/opt_range.cc

12
mysql-test/main/group_min_max.result

@ -4359,5 +4359,17 @@ MAX(b)
3
drop table t1;
#
# MDEV-36220 ASAN unknown-crash in loose index scan of MIN with IS NULL
#
CREATE TABLE t1 (a int, b int, KEY (a, b));
insert into t1 values (4, NULL), (1, 14), (4, 3);
SELECT MIN(b) FROM t1 WHERE b = 3 OR b IS NULL GROUP BY a;
MIN(b)
3
SELECT MIN(b) FROM t1 WHERE b IS NULL GROUP BY a;
MIN(b)
NULL
drop table t1;
#
# End of 10.11 tests
#

10
mysql-test/main/group_min_max.test

@ -2030,6 +2030,16 @@ if ($have_debug) {
drop table t1;
--echo #
--echo # MDEV-36220 ASAN unknown-crash in loose index scan of MIN with IS NULL
--echo #
CREATE TABLE t1 (a int, b int, KEY (a, b));
insert into t1 values (4, NULL), (1, 14), (4, 3);
SELECT MIN(b) FROM t1 WHERE b = 3 OR b IS NULL GROUP BY a;
SELECT MIN(b) FROM t1 WHERE b IS NULL GROUP BY a;
drop table t1;
--echo #
--echo # End of 10.11 tests
--echo #

4
sql/opt_range.cc

@ -16017,7 +16017,7 @@ int QUICK_GROUP_MIN_MAX_SELECT::next_min_in_range()
Remember this key, and continue looking for a non-NULL key that
satisfies some other condition.
*/
memcpy(tmp_record, record, head->s->rec_buff_length);
memcpy(tmp_record, record, head->s->reclength);
found_null= TRUE;
continue;
}
@ -16057,7 +16057,7 @@ int QUICK_GROUP_MIN_MAX_SELECT::next_min_in_range()
*/
if (found_null && result)
{
memcpy(record, tmp_record, head->s->rec_buff_length);
memcpy(record, tmp_record, head->s->reclength);
result= 0;
}
return result;

Loading…
Cancel
Save