Fix #7664: DROP TABLE executed for a table with big records may lead …

…to "wrong page type" or "end of file" error
FirebirdSQL · Jul 7, 2023 · 5b49409 · 5b49409
1 parent 97119c4
commit 5b49409
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 10 deletions.
diff --git a/src/jrd/dpm.epp b/src/jrd/dpm.epp
@@ -2276,6 +2276,8 @@ void DPM_update( thread_db* tdbb, record_param* rpb, PageStack* stack, const jrd
 	Database* dbb = tdbb->getDatabase();
 	CHECK_DBB(dbb);
 
+	rpb->rpb_flags &= ~(rpb_fragment | rpb_incomplete | rpb_large | rpb_chained | rpb_gc_active | rpb_long_tranum);
+
 #ifdef VIO_DEBUG
 	jrd_rel* relation = rpb->rpb_relation;
 	VIO_trace(DEBUG_WRITES,
@@ -2538,20 +2540,31 @@ static void delete_tail(thread_db* tdbb, rhdf* header, const USHORT page_space,
 
 	if (!(header->rhdf_flags & rhd_blob))
 	{
+		USHORT flags = header->rhdf_flags;
 		ULONG page_number = header->rhdf_f_page;
-		while (true)
+		fb_assert(flags & rhd_incomplete);
+
+		while (flags & rhd_incomplete)
 		{
 			window.win_page = page_number;
 			data_page* dpage = (data_page*) CCH_FETCH(tdbb, &window, LCK_read, pag_data);
-			header = (rhdf*) ((UCHAR *) dpage + dpage->dpg_rpt[0].dpg_offset);
-			const USHORT flags = header->rhdf_flags;
-			page_number = header->rhdf_f_page;
 
-			CCH_RELEASE_TAIL(tdbb, &window);
-			PAG_release_page(tdbb, window.win_page, ZERO_PAGE_NUMBER);
+			if (dpage->dpg_header.pag_flags & dpg_orphan &&
+				dpage->dpg_header.pag_flags & dpg_full &&
+				dpage->dpg_count == 1)
+			{
+				header = (rhdf*) ((UCHAR *) dpage + dpage->dpg_rpt[0].dpg_offset);
+				flags = header->rhdf_flags;
+				page_number = header->rhdf_f_page;
 
-			if (!(flags & rhd_incomplete))
+				CCH_RELEASE_TAIL(tdbb, &window);
+				PAG_release_page(tdbb, window.win_page, ZERO_PAGE_NUMBER);
+			}
+			else
+			{
+				fb_assert(false);
 				break;
+			}
 		}
 		return;
 	}

diff --git a/src/jrd/vio.cpp b/src/jrd/vio.cpp
@@ -702,8 +702,6 @@ void VIO_backout(thread_db* tdbb, record_param* rpb, const jrd_tra* transaction)
 		else
 		{
 			// There is cleanup to be done.  Bring the old version forward first
-
-			rpb->rpb_flags &= ~(rpb_fragment | rpb_incomplete | rpb_chained | rpb_gc_active | rpb_long_tranum);
 			DPM_update(tdbb, rpb, 0, transaction);
 			delete_tail(tdbb, &temp2, rpb->rpb_page, 0, 0);
 		}
@@ -6137,7 +6135,6 @@ static void replace_record(thread_db*		tdbb,
 #endif
 
 	record_param temp = *rpb;
-	rpb->rpb_flags &= ~(rpb_fragment | rpb_incomplete | rpb_chained | rpb_gc_active | rpb_long_tranum);
 	DPM_update(tdbb, rpb, stack, transaction);
 	delete_tail(tdbb, &temp, rpb->rpb_page, 0, 0);