From: Date: January 22 2007 1:34pm
Subject: bk commit into 4.1 tree (svoj:1.2594) BUG#24401
List-Archive: http://lists.mysql.com/commits/18536
X-Bug: 24401
Message-Id: <20070122123500.44FE241CEC2@june.myoffice.izhnet.ru>

Below is the list of changes that have just been committed into a local
4.1 repository of svoj. When svoj does a push these changes will
be propagated to the main repository and, within 24 hours after the
push, to the public repository.
For information on how to access the public repository
see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html

ChangeSet@stripped, 2007-01-22 16:34:58+04:00, svoj@stripped +1 -0
  BUG#24401 - MySQL server crashes if you try to retrieve data from
              corrupted table
  
  Accessing a table with corrupted column definition results in server
  crash.
  
  This is fixed by refusing to open such tables. Affects MyISAM only.
  No test case, since it requires crashed table.

  myisam/mi_open.c@stripped, 2007-01-22 16:34:57+04:00, svoj@stripped +7 -0
    Refuse to open MyISAM table with summary columns length bigger than
    length of the record.

# This is a BitKeeper patch.  What follows are the unified diffs for the
# set of deltas contained in the patch.  The rest of the patch, the part
# that BitKeeper cares about, is below these diffs.
# User:	svoj
# Host:	june.mysql.com
# Root:	/home/svoj/devel/mysql/BUG24401/mysql-4.1-engines

--- 1.89/myisam/mi_open.c	2007-01-16 18:05:36 +04:00
+++ 1.90/myisam/mi_open.c	2007-01-22 16:34:57 +04:00
@@ -435,6 +435,13 @@ MI_INFO *mi_open(const char *name, int m
       offset+=share->rec[i].length;
     }
     share->rec[i].type=(int) FIELD_LAST;	/* End marker */
+    if (offset > share->base.reclength)
+    {
+      /* purecov: begin inspected */
+      my_errno= HA_ERR_CRASHED;
+      goto err;
+      /* purecov: end */
+    }
 
     if (! lock_error)
     {