bk commit into 4.1 tree (ingo:1.2521) BUG#19835

[ingo]

Below is the list of changes that have just been committed into a local
4.1 repository of mydev. When mydev does a push these changes will
be propagated to the main repository and, within 24 hours after the
push, to the public repository.
For information on how to access the public repository
see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html

ChangeSet
  1.2521 06/06/28 16:07:39 ingo@stripped +1 -0
  Bug#19835 - Binary copy of corrupted tables crash the server when issuing a query
  
  A corrupt table with dynamic record format can crash the 
  server when trying to select from it.
          
  I fixed the crash that resulted from the particular type 
  of corruption that has been reported for this bug.
  
  No test case. To test it, one needs a table with a very special
  corruption. The bug report contains a file with such a table.

  myisam/mi_dynrec.c
    1.38 06/06/28 16:06:59 ingo@stripped +3 -0
    Bug#19835 - Binary copy of corrupted tables crash the server when issuing a query
    Added a protection against corrupted records. A dynamic 
    record header with invalid 'next' pointer could trigger 
    the assert in _mi_get_block_info(). Now I avoid this by 
    reporting a corruption error.

# This is a BitKeeper patch.  What follows are the unified diffs for the
# set of deltas contained in the patch.  The rest of the patch, the part
# that BitKeeper cares about, is below these diffs.
# User:	ingo
# Host:	chilla.local
# Root:	/home/mydev/mysql-4.1-bug19835

--- 1.37/myisam/mi_dynrec.c	2005-04-11 20:04:43 +02:00
+++ 1.38/myisam/mi_dynrec.c	2006-06-28 16:06:59 +02:00
@@ -1116,6 +1116,9 @@ int _mi_read_dynamic_record(MI_INFO *inf
 	  info->rec_cache.pos_in_file <= block_info.next_filepos &&
 	  flush_io_cache(&info->rec_cache))
 	goto err;
+      /* A corrupted table can have wrong pointers. (Bug# 19835) */
+      if (block_info.next_filepos == HA_OFFSET_ERROR)
+        goto panic;
       info->rec_cache.seek_not_done=1;
       if ((b_type=_mi_get_block_info(&block_info,file,
 				     block_info.next_filepos))