MDEV-40494 KEY_OP_DEL_PREFIX subtracts unchecked length from page_length - #5579
Open
KhaledR57 wants to merge 1 commit into
Open
MDEV-40494 KEY_OP_DEL_PREFIX subtracts unchecked length from page_length#5579KhaledR57 wants to merge 1 commit into
KhaledR57 wants to merge 1 commit into
Conversation
The KEY_OP_DEL_PREFIX branch of _ma_apply_redo_index() subtracted the logged length from page_length and used the difference as a bmove() size, guarded only by a DBUG_ASSERT, which is compiled out when DBUG_OFF is set. A length larger than the used page underflows that size, and a length larger than page_length wraps page_length itself. Turn the assert into a runtime check, written as an addition rather than the assert's subtraction, which underflows on a page shorter than its own header. A refused record takes the error path that was already there. The test forges the logged length with corrupt_del_prefix, then crashes the server so recovery has to replay the record. The workload splits and merges index pages: this record comes from the underflow path, so plain inserts never produce one.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
KEY_OP_DEL_PREFIXbranch of_ma_apply_redo_index()subtracted the logged length frompage_lengthand used the difference as abmove()size, guarded only by aDBUG_ASSERT, which is compiled out whenDBUG_OFFis set. A length larger than the used page underflows that size, and a length larger thanpage_lengthwrapspage_lengthitself.Turn the assert into a runtime check, written as an addition rather than the assert's subtraction, which underflows on a page shorter than its own header. A refused record takes the error path that was already there.
The test forges the logged length with
corrupt_del_prefix, then crashes the server so recovery has to replay the record. The workload splits and merges index pages, this record comes from the underflow path, so plain inserts never produce one.