Skip to content

Commit 107d1ef

Browse files
committed
MDEV-37033 UBSAN: row_log_table_apply_ops runtime error: applying non-zero offset 1048576 to null pointer
In a UBSAN debug build, the comparisons with next_mrec_end are made with index->online_log's head/tail members' block ptr with a sort buffer size offset (1048576). The logic that flows though to this point means that even srv_sort_buf_size above a null pointer wouldn't contain the value of next_mrec_end. As such this is a UBSAN type fix where we first check if the head.block / tail.block is null before doing the asserts around this debug condition. This would be required for the assertions conditions not to segfault anyway.
1 parent 32128ab commit 107d1ef

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

storage/innobase/row/row0log.cc

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2691,7 +2691,8 @@ row_log_table_apply_ops(
26912691
ut_ad((mrec == NULL) == (index->online_log->head.bytes == 0));
26922692

26932693
#ifdef UNIV_DEBUG
2694-
if (next_mrec_end == index->online_log->head.block
2694+
if (index->online_log->head.block &&
2695+
next_mrec_end == index->online_log->head.block
26952696
+ srv_sort_buf_size) {
26962697
/* If tail.bytes == 0, next_mrec_end can also be at
26972698
the end of tail.block. */
@@ -2706,7 +2707,8 @@ row_log_table_apply_ops(
27062707
ut_ad(index->online_log->tail.blocks
27072708
> index->online_log->head.blocks);
27082709
}
2709-
} else if (next_mrec_end == index->online_log->tail.block
2710+
} else if (index->online_log->tail.block &&
2711+
next_mrec_end == index->online_log->tail.block
27102712
+ index->online_log->tail.bytes) {
27112713
ut_ad(next_mrec == index->online_log->tail.block
27122714
+ index->online_log->head.bytes);

0 commit comments

Comments
 (0)