Skip to content

Commit ba5ef63

Browse files
committed
MDEV-27476 heap-use-after-free in buf_pool_t::is_block_field()
This follows up commit 017d1b8. In commit aaef2e1 (MDEV-27058) some more problematic debug assertions were added. btr_search_update_block_hash_info(), trx_purge_truncate_history(): Use simpler assertions to check that an uncompressed page is present.
1 parent 0261eac commit ba5ef63

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

storage/innobase/btr/btr0sea.cc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
33
Copyright (c) 1996, 2016, Oracle and/or its affiliates. All Rights Reserved.
44
Copyright (c) 2008, Google Inc.
5-
Copyright (c) 2017, 2021, MariaDB Corporation.
5+
Copyright (c) 2017, 2022, MariaDB Corporation.
66
77
Portions of this file contain modifications contributed and copyrighted by
88
Google, Inc. Those modifications are gratefully acknowledged and are described
@@ -412,7 +412,7 @@ btr_search_update_block_hash_info(btr_search_t* info, buf_block_t* block)
412412
ut_ad(block->page.lock.have_x() || block->page.lock.have_s());
413413

414414
info->last_hash_succ = FALSE;
415-
ut_ad(buf_pool.is_uncompressed(block));
415+
ut_ad(block->page.frame);
416416
ut_ad(info->magic_n == BTR_SEARCH_MAGIC_N);
417417

418418
if ((block->n_hash_helps > 0)

storage/innobase/trx/trx0purge.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -703,8 +703,8 @@ TRANSACTIONAL_TARGET static void trx_purge_truncate_history()
703703
if (bpage->id().space() == space.id &&
704704
bpage->oldest_modification() != 1)
705705
{
706+
ut_ad(bpage->frame);
706707
auto block= reinterpret_cast<buf_block_t*>(bpage);
707-
ut_ad(buf_pool.is_uncompressed(block));
708708
if (!bpage->lock.x_lock_try())
709709
{
710710
/* Let buf_pool_t::release_freed_page() proceed. */

0 commit comments

Comments
 (0)