Browse Source
MDEV-36220 Correct length in memcpy saving and restoring found NULL record in loose index scan of min
Use reclength because rec_buff_length is the actual reclength with
padding, whose use could cause ASAN unknown-crash, presumably caused
by memory violation.
pull/3892/head
Yuchen Pei
8 months ago
No known key found for this signature in database
GPG Key ID: 3DD1B35105743563
3 changed files with
24 additions and
2 deletions
mysql-test/main/group_min_max.result
mysql-test/main/group_min_max.test
sql/opt_range.cc
@ -4359,5 +4359,17 @@ MAX(b)
3
drop table t1;
#
# MDEV-36220 ASAN unknown-crash in loose index scan of MIN with IS NULL
#
CREATE TABLE t1 (a int, b int, KEY (a, b));
insert into t1 values (4, NULL), (1, 14), (4, 3);
SELECT MIN(b) FROM t1 WHERE b = 3 OR b IS NULL GROUP BY a;
MIN(b)
3
SELECT MIN(b) FROM t1 WHERE b IS NULL GROUP BY a;
MIN(b)
NULL
drop table t1;
#
# End of 10.11 tests
#
@ -2030,6 +2030,16 @@ if ($have_debug) {
drop table t1;
--echo #
--echo # MDEV-36220 ASAN unknown-crash in loose index scan of MIN with IS NULL
--echo #
CREATE TABLE t1 (a int, b int, KEY (a, b));
insert into t1 values (4, NULL), (1, 14), (4, 3);
SELECT MIN(b) FROM t1 WHERE b = 3 OR b IS NULL GROUP BY a;
SELECT MIN(b) FROM t1 WHERE b IS NULL GROUP BY a;
drop table t1;
--echo #
--echo # End of 10.11 tests
--echo #
@ -16017,7 +16017,7 @@ int QUICK_GROUP_MIN_MAX_SELECT::next_min_in_range()
Remember this key , and continue looking for a non - NULL key that
satisfies some other condition .
*/
memcpy ( tmp_record , record , head - > s - > rec_buff_ length ) ;
memcpy ( tmp_record , record , head - > s - > reclength ) ;
found_null = TRUE ;
continue ;
}
@ -16057,7 +16057,7 @@ int QUICK_GROUP_MIN_MAX_SELECT::next_min_in_range()
*/
if ( found_null & & result )
{
memcpy ( record , tmp_record , head - > s - > rec_buff_ length ) ;
memcpy ( record , tmp_record , head - > s - > reclength ) ;
result = 0 ;
}
return result ;