bk commit into 5.1 tree (mtaylor:1.2582)

[Monty Taylor]

Below is the list of changes that have just been committed into a local
5.1 repository of mtaylor.  When mtaylor does a push these changes
will be propagated to the main repository and, within 24 hours after the
push, to the public repository.
For information on how to access the public repository
see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html

ChangeSet@stripped, 2008-04-09 15:54:29+02:00, mtaylor@solace.(none) +1 -0
  Patch for the double free.

  sql/table.cc@stripped, 2008-04-09 15:54:27+02:00, mtaylor@solace.(none) +9 -11
    Patch for the double free.

diff -Nrup a/sql/table.cc b/sql/table.cc
--- a/sql/table.cc	2008-04-08 14:51:47 +02:00
+++ b/sql/table.cc	2008-04-09 15:54:27 +02:00
@@ -668,7 +668,7 @@ static int open_binary_frm(THD *thd, TAB
   const char **interval_array;
   enum legacy_db_type legacy_db_type;
   my_bitmap_map *bitmaps;
-  uchar *buff= 0;
+  uchar *buffbuff= 0;
   uchar *field_extra_info= 0;
   DBUG_ENTER("open_binary_frm");
 
@@ -847,14 +847,14 @@ static int open_binary_frm(THD *thd, TAB
     /* Read extra data segment */
     uchar *next_chunk, *buff_end;
     DBUG_PRINT("info", ("extra segment size is %u bytes", n_length));
-    if (!(next_chunk= buff= (uchar*) my_malloc(n_length, MYF(MY_WME))))
+    if (!(next_chunk= buffbuff= (uchar*) my_malloc(n_length, MYF(MY_WME))))
       goto err;
-    if (my_pread(file, buff, n_length, record_offset + share->reclength,
+    if (my_pread(file, buffbuff, n_length, record_offset + share->reclength,
                  MYF(MY_NABP)))
     {
       goto err;
     }
-    share->connect_string.length= uint2korr(buff);
+    share->connect_string.length= uint2korr(buffbuff);
     if (!(share->connect_string.str= strmake_root(&share->mem_root,
                                                   (char*) next_chunk + 2,
                                                   share->connect_string.
@@ -863,7 +863,7 @@ static int open_binary_frm(THD *thd, TAB
       goto err;
     }
     next_chunk+= share->connect_string.length + 2;
-    buff_end= buff + n_length;
+    buff_end= buffbuff + n_length;
     if (next_chunk + 2 < buff_end)
     {
       uint str_db_type_length= uint2korr(next_chunk);
@@ -880,7 +880,6 @@ static int open_binary_frm(THD *thd, TAB
                 plugin_data(tmp_plugin, handlerton *)))
         {
           /* bad file, legacy_db_type did not match the name */
-          my_free(buff, MYF(0));
           goto err;
         }
         /*
@@ -916,7 +915,6 @@ static int open_binary_frm(THD *thd, TAB
         /* purecov: begin inspected */
         error= 8;
         my_error(ER_UNKNOWN_STORAGE_ENGINE, MYF(0), name.str);
-        my_free(buff, MYF(0));
         goto err;
         /* purecov: end */
       }
@@ -1622,13 +1620,13 @@ static int open_binary_frm(THD *thd, TAB
   if (use_hash)
     (void) hash_check(&share->name_hash);
 #endif
-  if (buff)
-    my_free(buff, MYF(0));
+  if (buffbuff)
+    my_free(buffbuff, MYF(0));
   DBUG_RETURN (0);
 
  err:
-  if (buff)
-    my_free(buff, MYF(0));
+  if (buffbuff)
+    my_free(buffbuff, MYF(0));
   share->error= error;
   share->open_errno= my_errno;
   share->errarg= errarg;