MDEV-29600 Memory leak in row_log_table_apply_update()

row_log_table_apply_update(): Free the pcur.old_rec_buf before returning.
It may be allocated by btr_pcur_store_position() inside
btr_blob_log_check_t::check() and btr_store_big_rec_extern_fields().

This memory leak was introduced in
commit 2e814d4 (MariaDB Server 10.2.2)
via mysql/mysql-server@ce0a1e8
(MySQL 5.7.5).

mysql-test/suite/innodb/r/innodb-table-online.result

@@ -433,7 +433,6 @@ c22f	c1	c3	c4
 5	46	46foofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoo	Online
 connection con1;
 ALTER TABLE t1 DISCARD TABLESPACE;
-disconnect con1;
 connection default;
 SHOW CREATE TABLE t1;
 Table	Create Table
@@ -447,6 +446,23 @@ t1	CREATE TABLE `t1` (
 SET DEBUG_SYNC = 'RESET';
 SET GLOBAL innodb_monitor_disable = module_ddl;
 DROP TABLE t1;
+#
+# MDEV-29600 Memory leak in row_log_table_apply_update()
+#
+CREATE TABLE t1 (pk INT PRIMARY KEY, f TEXT) ENGINE=InnoDB;
+INSERT INTO t1 SET pk=1;
+connection con1;
+SET DEBUG_SYNC = 'row_log_table_apply1_before SIGNAL created WAIT_FOR updated';
+ALTER TABLE t1 FORCE;
+connection default;
+SET DEBUG_SYNC = 'now WAIT_FOR created';
+UPDATE t1 SET f = REPEAT('a', 20000);
+SET DEBUG_SYNC = 'now SIGNAL updated';
+connection con1;
+disconnect con1;
+connection default;
+DROP TABLE t1;
+SET DEBUG_SYNC = 'RESET';
 SET GLOBAL innodb_file_per_table = @global_innodb_file_per_table_orig;
 SET GLOBAL innodb_monitor_enable  = default;
 SET GLOBAL innodb_monitor_disable = default;

mysql-test/suite/innodb/t/innodb-table-online.test

@@ -388,14 +388,37 @@ SELECT * FROM t1 LIMIT 10;
 
 connection con1;
 ALTER TABLE t1 DISCARD TABLESPACE;
-disconnect con1;
 
 connection default;
 SHOW CREATE TABLE t1;
 SET DEBUG_SYNC = 'RESET';
 SET GLOBAL innodb_monitor_disable = module_ddl;
 DROP TABLE t1;
 
+--echo #
+--echo # MDEV-29600 Memory leak in row_log_table_apply_update()
+--echo #
+
+CREATE TABLE t1 (pk INT PRIMARY KEY, f TEXT) ENGINE=InnoDB;
+INSERT INTO t1 SET pk=1;
+
+connection con1;
+SET DEBUG_SYNC = 'row_log_table_apply1_before SIGNAL created WAIT_FOR updated';
+send ALTER TABLE t1 FORCE;
+
+connection default;
+SET DEBUG_SYNC = 'now WAIT_FOR created';
+UPDATE t1 SET f = REPEAT('a', 20000);
+SET DEBUG_SYNC = 'now SIGNAL updated';
+
+connection con1;
+reap;
+disconnect con1;
+
+connection default;
+DROP TABLE t1;
+SET DEBUG_SYNC = 'RESET';
+
 # Check that all connections opened by test cases in this file are really
 # gone so execution of other tests won't be affected by their presence.
 --source include/wait_until_count_sessions.inc

storage/innobase/row/row0log.cc

@@ -1,7 +1,7 @@
 /*****************************************************************************
 
 Copyright (c) 2011, 2018, Oracle and/or its affiliates. All Rights Reserved.
-Copyright (c) 2017, 2021, MariaDB Corporation.
+Copyright (c) 2017, 2022, MariaDB Corporation.
 
 This program is free software; you can redistribute it and/or modify it under
 the terms of the GNU General Public License as published by the Free Software
@@ -2169,6 +2169,7 @@ row_log_table_apply_update(
 		}
 func_exit_committed:
 		ut_ad(mtr.has_committed());
+		ut_free(pcur.old_rec_buf);
 
 		if (error != DB_SUCCESS) {
 			/* Report the erroneous row using the new
@@ -2356,7 +2357,8 @@ row_log_table_apply_update(
 		entry = row_build_index_entry(old_row, old_ext, index, heap);
 		if (!entry) {
 			ut_ad(0);
-			return(DB_CORRUPTION);
+			error = DB_CORRUPTION;
+			goto func_exit_committed;
 		}
 
 		mtr_start(&mtr);