MDEV-11551 Server crashes in Field::is_real_null

sometimes table->s->stored_fields is less than table->s->null_fields
MariaDB · Jan 15, 2017 · 5dfab33 · 5dfab33
1 parent 7e2f9d0
commit 5dfab33
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 1 deletion.
diff --git a/mysql-test/r/trigger_null-8605.result b/mysql-test/r/trigger_null-8605.result
@@ -354,3 +354,13 @@ show columns from t1;
 Field	Type	Null	Key	Default	Extra
 a	int(11)	NO	PRI	NULL	
 drop table t1;
+create table t1 (
+pk int primary key,
+i int,
+v1 int as (i) virtual,
+v2 int as (i) virtual
+);
+create trigger tr before update on t1 for each row set @a = 1;
+insert into t1 (pk, i) values (null, null);
+ERROR 23000: Column 'pk' cannot be null
+drop table t1;
diff --git a/mysql-test/t/trigger_null-8605.test b/mysql-test/t/trigger_null-8605.test
@@ -373,3 +373,17 @@ show columns from t1;
 insert into t1 (a) values (3);
 show columns from t1;
 drop table t1;
+
+#
+# MDEV-11551 Server crashes in Field::is_real_null
+#
+create table t1 (
+  pk int primary key,
+  i int,
+  v1 int as (i) virtual,
+  v2 int as (i) virtual
+);
+create trigger tr before update on t1 for each row set @a = 1;
+--error ER_BAD_NULL_ERROR
+insert into t1 (pk, i) values (null, null);
+drop table t1;
diff --git a/sql/sql_trigger.cc b/sql/sql_trigger.cc
@@ -1082,7 +1082,7 @@ bool Table_triggers_list::prepare_record_accessors(TABLE *table)
       && (table->s->stored_fields != table->s->null_fields))
 
   {
-    int null_bytes= (table->s->stored_fields - table->s->null_fields + 7)/8;
+    int null_bytes= (table->s->fields - table->s->null_fields + 7)/8;
     if (!(extra_null_bitmap= (uchar*)alloc_root(&table->mem_root, null_bytes)))
       return 1;
     if (!(record0_field= (Field **)alloc_root(&table->mem_root,