From: Date: October 18 2006 2:57pm
Subject: bk commit into 4.1 tree (svoj:1.2530) BUG#23175
List-Archive: http://lists.mysql.com/commits/13866
X-Bug: 23175
Message-Id: <20061018125733.1B27FA4C@april.pils.ru>

Below is the list of changes that have just been committed into a local
4.1 repository of svoj. When svoj does a push these changes will
be propagated to the main repository and, within 24 hours after the
push, to the public repository.
For information on how to access the public repository
see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html

ChangeSet@stripped, 2006-10-18 17:57:29+05:00, svoj@stripped +3 -0
  BUG#23175 - MYISAM crash/repair failed during repair
  
  Repair table could crash a server if there is not sufficient
  memory (myisam_sort_buffer_size) to operate. Affects not only
  repair, but also all statements that use create index by sort:
  repair by sort, parallel repair, bulk insert.
  
  Return an error if there is not sufficient memory to store at
  least one key per BUFFPEK.
  
  Also fixed memory leak if thr_find_all_keys returns an error.

  myisam/sort.c@stripped, 2006-10-18 17:57:28+05:00, svoj@stripped +6 -2
    maxbuffer is number of BUFFPEK-s for repair. It is calculated
    as records / keys. keys is number of keys that can be stored
    in memory (myisam_sort_buffer_size). There must be sufficient
    memory to store both BUFFPEK-s and keys. It was checked
    correctly before this patch. However there is another
    requirement that wasn't checked: there must be sufficient
    memory for at least one key per BUFFPEK, otherwise repair
    by sort/parallel repair cannot operate.
    
    Return an error if there is not sufficient memory to store at
    least one key per BUFFPEK.
    
    Also fixed memory leak if thr_find_all_keys returns an error.

  mysql-test/r/repair.result@stripped, 2006-10-18 17:57:28+05:00, svoj@stripped +28 -0
    A test case for BUG#23175.

  mysql-test/t/repair.test@stripped, 2006-10-18 17:57:28+05:00, svoj@stripped +28 -0
    A test case for BUG#23175.

# This is a BitKeeper patch.  What follows are the unified diffs for the
# set of deltas contained in the patch.  The rest of the patch, the part
# that BitKeeper cares about, is below these diffs.
# User:	svoj
# Host:	april.(none)
# Root:	/home/svoj/devel/mysql/BUG23175/mysql-4.1-engines

--- 1.47/myisam/sort.c	2006-10-18 17:57:33 +05:00
+++ 1.48/myisam/sort.c	2006-10-18 17:57:33 +05:00
@@ -148,7 +148,8 @@ int _create_index_by_sort(MI_SORT_PARAM 
 	skr=maxbuffer;
 	if (memavl < sizeof(BUFFPEK)*(uint) maxbuffer ||
 	    (keys=(memavl-sizeof(BUFFPEK)*(uint) maxbuffer)/
-	     (sort_length+sizeof(char*))) <= 1)
+             (sort_length+sizeof(char*))) <= 1 ||
+            keys < (uint) maxbuffer)
 	{
 	  mi_check_print_error(info->sort_info->param,
 			       "sort_buffer_size is to small");
@@ -363,7 +364,8 @@ pthread_handler_decl(thr_find_all_keys,a
         skr=maxbuffer;
         if (memavl < sizeof(BUFFPEK)*maxbuffer ||
             (keys=(memavl-sizeof(BUFFPEK)*maxbuffer)/
-             (sort_length+sizeof(char*))) <= 1)
+             (sort_length+sizeof(char*))) <= 1 ||
+            keys < (uint) maxbuffer)
         {
           mi_check_print_error(sort_param->sort_info->param,
                                "sort_buffer_size is to small");
@@ -497,6 +499,8 @@ int thr_write_keys(MI_SORT_PARAM *sort_p
     if (!sinfo->sort_keys)
     {
       got_error=1;
+      my_free(mi_get_rec_buff_ptr(info, sinfo->rec_buff),
+              MYF(MY_ALLOW_ZERO_PTR));
       continue;
     }
     if (!got_error)

--- 1.18/mysql-test/r/repair.result	2006-10-18 17:57:33 +05:00
+++ 1.19/mysql-test/r/repair.result	2006-10-18 17:57:33 +05:00
@@ -48,3 +48,31 @@ Table	Non_unique	Key_name	Seq_in_index	C
 t1	1	a	1	a	A	5	NULL	NULL	YES	BTREE	
 SET myisam_repair_threads=@@global.myisam_repair_threads;
 DROP TABLE t1;
+CREATE TABLE t1(a CHAR(255), KEY(a));
+SET myisam_sort_buffer_size=4096;
+INSERT INTO t1 VALUES
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0');
+SET myisam_repair_threads=2;
+REPAIR TABLE t1;
+Table	Op	Msg_type	Msg_text
+test.t1	repair	error	sort_buffer_size is to small
+test.t1	repair	warning	Number of rows changed from 0 to 157
+test.t1	repair	status	OK
+SET myisam_repair_threads=@@global.myisam_repair_threads;
+SET myisam_sort_buffer_size=@@global.myisam_sort_buffer_size;
+DROP TABLE t1;

--- 1.15/mysql-test/t/repair.test	2006-10-18 17:57:33 +05:00
+++ 1.16/mysql-test/t/repair.test	2006-10-18 17:57:33 +05:00
@@ -45,4 +45,32 @@ SHOW INDEX FROM t1;
 SET myisam_repair_threads=@@global.myisam_repair_threads;
 DROP TABLE t1;
 
+#
+# BUG#23175 - MYISAM crash/repair failed during repair
+#
+CREATE TABLE t1(a CHAR(255), KEY(a));
+SET myisam_sort_buffer_size=4096;
+INSERT INTO t1 VALUES
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),('0'),
+('0'),('0'),('0'),('0'),('0'),('0'),('0');
+SET myisam_repair_threads=2;
+REPAIR TABLE t1;
+SET myisam_repair_threads=@@global.myisam_repair_threads;
+SET myisam_sort_buffer_size=@@global.myisam_sort_buffer_size;
+DROP TABLE t1;
+
 # End of 4.1 tests