Fix Bug#13894 Server crashes on update of CSV table

mysql-test/r/csv.result

@@ -4929,3 +4929,23 @@ Warnings:
 Note	1051	Unknown table 't2'
 Note	1051	Unknown table 't3'
 Note	1051	Unknown table 't4'
+DROP TABLE IF EXISTS bug13894;
+CREATE TABLE bug13894 ( val integer ) ENGINE = CSV;
+INSERT INTO bug13894 VALUES (5);
+INSERT INTO bug13894 VALUES (10);
+INSERT INTO bug13894 VALUES (11);
+INSERT INTO bug13894 VALUES (10);
+SELECT * FROM bug13894;
+val
+5
+10
+11
+10
+UPDATE  bug13894 SET val=6 WHERE val=10;
+SELECT * FROM bug13894;
+val
+5
+11
+6
+6
+DROP TABLE bug13894;

mysql-test/t/csv.test

@@ -1314,4 +1314,22 @@ select period from t1;
 
 drop table if exists t1,t2,t3,t4;
 
+#
+# Bug #13894    Server crashes on update of CSV table
+#
+
+--disable_warnings
+DROP TABLE IF EXISTS bug13894;
+--enable_warnings
+
+CREATE TABLE bug13894 ( val integer ) ENGINE = CSV;
+INSERT INTO bug13894 VALUES (5);
+INSERT INTO bug13894 VALUES (10);
+INSERT INTO bug13894 VALUES (11);
+INSERT INTO bug13894 VALUES (10);
+SELECT * FROM bug13894;
+UPDATE  bug13894 SET val=6 WHERE val=10;
+SELECT * FROM bug13894;
+DROP TABLE bug13894;
+
 # End of 4.1 tests

sql/examples/ha_tina.cc

@@ -59,11 +59,15 @@ static int tina_init= 0;
  *****************************************************************************/
 
 /*
-  Used for sorting  chains.
+  Used for sorting chains with qsort().
 */
 int sort_set (tina_set *a, tina_set *b)
 {
-  return ( a->begin > b->begin ? 1 : ( a->begin < b->begin ? -1 : 0 ) );
+  /*
+    We assume that intervals do not intersect. So, it is enought to compare
+    any two points. Here we take start of intervals for comparison.
+  */
+  return ( a->begin > b->begin ? -1 : ( a->begin < b->begin ? 1 : 0 ) );
 }
 
 static byte* tina_get_key(TINA_SHARE *share,uint *length,
@@ -739,13 +743,8 @@ int ha_tina::rnd_end()
     qsort(chain, (size_t)(chain_ptr - chain), sizeof(tina_set), (qsort_cmp)sort_set);
     for (ptr= chain; ptr < chain_ptr; ptr++)
     {
-      /* We peek a head to see if this is the last chain */
-      if (ptr+1 == chain_ptr)
       memmove(share->mapped_file + ptr->begin, share->mapped_file + ptr->end,
               length - (size_t)ptr->end);
-      else
-        memmove((caddr_t)share->mapped_file + ptr->begin, (caddr_t)share->mapped_file + ptr->end,
-                (size_t)((ptr++)->begin - ptr->end));
       length= length - (size_t)(ptr->end - ptr->begin);
     }