Skip to content

Commit 8cc9751

Browse files
author
Jan Lindström
committed
MDEV-7538: Wrong constraint (TINYINT or MEDIUMINT and INT)
causes server crash Analysis: If wrong data types used on foreign constraint there was possibility that foreign->id is NULL when incorrect foreign constraint was removed from the dictionary cache. Fix: Add guard foreign->id != NULL before trying to lookup or remove the foreign constraint from dictionary cache. Tested using user database where problem was repeatable.
1 parent 422ffe9 commit 8cc9751

File tree

2 files changed

+18
-6
lines changed

2 files changed

+18
-6
lines changed

storage/innobase/dict/dict0dict.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2530,7 +2530,7 @@ dict_foreign_remove_from_cache(
25302530

25312531
rbt = foreign->referenced_table->referenced_rbt;
25322532

2533-
if (rbt != NULL) {
2533+
if (rbt != NULL && foreign->id != NULL) {
25342534
const ib_rbt_node_t* node
25352535
= rbt_lookup(rbt, foreign->id);
25362536
dict_foreign_t* val = *(dict_foreign_t**) node->value;
@@ -2549,7 +2549,7 @@ dict_foreign_remove_from_cache(
25492549
foreign);
25502550
rbt = foreign->foreign_table->foreign_rbt;
25512551

2552-
if (rbt != NULL) {
2552+
if (rbt != NULL && foreign->id != NULL) {
25532553
const ib_rbt_node_t* node
25542554
= rbt_lookup(rbt, foreign->id);
25552555
dict_foreign_t* val = *(dict_foreign_t**) node->value;

storage/xtradb/dict/dict0dict.c

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2650,8 +2650,14 @@ dict_foreign_remove_from_cache(
26502650
foreign);
26512651

26522652
rbt = foreign->referenced_table->referenced_rbt;
2653-
if (rbt != NULL) {
2654-
rbt_delete(rbt, foreign->id);
2653+
if (rbt != NULL && foreign->id != NULL) {
2654+
const ib_rbt_node_t* node
2655+
= rbt_lookup(rbt, foreign->id);
2656+
dict_foreign_t* val = *(dict_foreign_t**) node->value;
2657+
2658+
if (val == foreign) {
2659+
rbt_delete(rbt, foreign->id);
2660+
}
26552661
}
26562662
}
26572663

@@ -2663,8 +2669,14 @@ dict_foreign_remove_from_cache(
26632669
foreign);
26642670
rbt = foreign->foreign_table->foreign_rbt;
26652671

2666-
if (rbt != NULL) {
2667-
rbt_delete(rbt, foreign->id);
2672+
if (rbt != NULL && foreign->id != NULL) {
2673+
const ib_rbt_node_t* node
2674+
= rbt_lookup(rbt, foreign->id);
2675+
dict_foreign_t* val = *(dict_foreign_t**) node->value;
2676+
2677+
if (val == foreign) {
2678+
rbt_delete(rbt, foreign->id);
2679+
}
26682680
}
26692681
}
26702682

0 commit comments

Comments
 (0)