• Sergey Glukhov's avatar
    Bug#41212 crash after race condition between merge table and table_cache evictions · f54beb2d
    Sergey Glukhov authored
    On 64-bit Windows: querying MERGE table with keys may cause
    server crash.The problem is generic and may affect any statement
    accessing MERGE table cardinality values.
    When MERGE engine was copying cardinality statistics, it was
    using incorrect size of element in cardinality statistics array
    (sizeof(ptr)==8 instead of sizeof(ulong)==4), causing access
    of memory beyond of the allocated bounds.
    
    
    sql/ha_myisam.cc:
      When copying rec_per_key array (an array of ulong) use proper
      size of element, that is sizeof(ulong).
    sql/ha_myisammrg.cc:
      When copying rec_per_key array (an array of ulong) use proper
      size of element, that is sizeof(ulong).
    sql/table.cc:
      When allocating rec_per_key array (an array of ulong) use proper
      size of element, that is sizeof(ulong).
    f54beb2d
table.cc 88.6 KB