Skip to content

Commit 24e5d56

Browse files
committed
MDEV-35680 Table number > MAX_TABLES causes overflow of table_map at main.join test
Fix a regression introduced by commit d98ac85 (MDEV-29935, MDEV-26247) causing MAX_TABLES overflow in `setup_table_map()`. The check for MAX_TABLES was moved outside of the loop that increments table numbers, allowing overflows during loop iterations. Since setup_table_map() operates on a 64-bit bitmap, table numbers exceeding 64 triggered the UBSAN check. This commit returns the overflow check within the loop and adds a debug assertion to `setup_table_map()` to ensure no bitmap overrun occurs.
1 parent d878d80 commit 24e5d56

File tree

2 files changed

+10
-5
lines changed

2 files changed

+10
-5
lines changed

sql/sql_base.cc

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7862,11 +7862,15 @@ bool setup_tables(THD *thd, Name_resolution_context *context,
78627862
DBUG_RETURN(1);
78637863
}
78647864
tablenr++;
7865-
}
7866-
if (tablenr > MAX_TABLES)
7867-
{
7868-
my_error(ER_TOO_MANY_TABLES,MYF(0), static_cast<int>(MAX_TABLES));
7869-
DBUG_RETURN(1);
7865+
/*
7866+
Test MAX_TABLES overflow here inside the loop as setup_table_map()
7867+
called in each iteration is sensitive for this
7868+
*/
7869+
if (tablenr > MAX_TABLES)
7870+
{
7871+
my_error(ER_TOO_MANY_TABLES, MYF(0), static_cast<int>(MAX_TABLES));
7872+
DBUG_RETURN(1);
7873+
}
78707874
}
78717875
if (select_insert && !is_insert_tables_num_set)
78727876
{

sql/sql_base.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -353,6 +353,7 @@ inline void setup_table_map(TABLE *table, TABLE_LIST *table_list, uint tablenr)
353353
table->maybe_null= embedding->outer_join;
354354
embedding= embedding->embedding;
355355
}
356+
DBUG_ASSERT(tablenr <= MAX_TABLES);
356357
table->tablenr= tablenr;
357358
table->map= (table_map) 1 << tablenr;
358359
table->force_index= table_list->force_index;

0 commit comments

Comments
 (0)