MDEV-37659 CHECK TABLE…EXTENDED error on a column prefix index

trx_undo_prev_version(): Prevent unsafe BLOB access.

Tested by: Saahil Alam
Reviewed by: Thirunarayanan Balathandayuthapani

Author: dr-m

storage/innobase/include/trx0purge.h

@@ -451,6 +451,9 @@ class purge_sys_t
 
     /** @return purge_sys.view or purge_sys.end_view */
     inline const ReadViewBase &view() const;
+
+    /** @return whether this is part of CHECK TABLE ... EXTENDED */
+    bool is_extended() const noexcept { return latch < END_VIEW; }
   };
 
   struct end_view_guard

storage/innobase/trx/trx0rec.cc

@@ -2229,6 +2229,21 @@ static dberr_t trx_undo_prev_version(const rec_t *rec, dict_index_t *index,
 	byte* buf;
 
 	if (row_upd_changes_field_size_or_external(index, offsets, update)) {
+		/* When CHECK TABLE ... EXTENDED checks for orphan
+		records in secondary indexes, it normally covers some
+		history that is already being purged. This is safe as
+		long as the undo log records have not been freed yet.
+
+		However, BLOBs are only safe to access as long as the
+		purge_sys.view does not permit them to be freed. The
+		check.latch will freeze the purge_sys.view by blocking
+		purge_sys.clone_oldest_view() at the start of
+		trx_purge() or by blocking purge_sys.batch_cleanup()
+		at the end of trx_purge(). */
+		if (check.is_extended() && purge_sys.is_purgeable(trx_id)) {
+			return DB_SUCCESS;
+		}
+
 		/* We should confirm the existence of disowned external data,
 		if the previous version record is delete marked. If the trx_id
 		of the previous record is seen by purge view, we should treat