Commit 83aade73 authored by unknown's avatar unknown
Browse files

Fix Bug#15205 "Select from CSV table without the datafile causes crash" 


mysql-test/r/csv.result:
  update result file
mysql-test/t/csv.test:
  add a test for the bug
sql/examples/ha_tina.cc:
  move open() call before my_hash_insert, so that we don't insert invalid
  share to the hash. To avoid other possible problems also add
  hash_delete(), so that the share is removed from hash before it is freed.
parent 0eaae415

mysql-test/r/csv.result

+10 −0
Original line number Diff line number Diff line
@@ -5000,3 +5000,13 @@ insert t1 values (1),(2),(3),(4),(5); 
truncate table t1;

affected rows: 0

drop table t1;

create table bug15205 (val int(11) default null) engine=csv;

create table bug15205_2 (val int(11) default null) engine=csv;

select * from bug15205;

ERROR HY000: Got error 1 from storage engine

select * from bug15205_2;

val

select * from bug15205;

val

drop table bug15205;

drop table bug15205_2;

mysql-test/t/csv.test

+24 −0
Original line number Diff line number Diff line
@@ -1384,3 +1384,27 @@ truncate table t1; -- truncate 
--disable_info

drop table t1;



#

# Bug #15205   Select from CSV table without the datafile causes crash

#

# NOTE: the bug is not deterministic



# The crash happens because the necessary cleanup after an error wasn't

# performed. Namely, the table share, inserted in the hash during table

# open, was not deleted from hash. At the same time the share was freed

# when an error was encountered. Thus, subsequent access to the hash

# resulted in scanning through deleted memory and we were geting a crash.

# that's why we need two tables in the bugtest



create table bug15205 (val int(11) default null) engine=csv;

create table bug15205_2 (val int(11) default null) engine=csv;

--exec rm $MYSQLTEST_VARDIR/master-data/test/bug15205.CSV

# system error (can't open the datafile)

--error ER_GET_ERRNO

select * from bug15205;

select * from bug15205_2;

--exec touch $MYSQLTEST_VARDIR/master-data/test/bug15205.CSV

select * from bug15205;

drop table bug15205;

drop table bug15205_2;

sql/examples/ha_tina.cc

+8 −5
Original line number Diff line number Diff line
@@ -184,16 +184,18 @@ static TINA_SHARE *get_share(const char *table_name, TABLE *table) 
    share->table_name_length=length;

    share->table_name=tmp_name;

    strmov(share->table_name,table_name);

    fn_format(data_file_name, table_name, "", ".CSV",MY_REPLACE_EXT|MY_UNPACK_FILENAME);

    fn_format(data_file_name, table_name, "", ".CSV",

              MY_REPLACE_EXT | MY_UNPACK_FILENAME);



    if ((share->data_file= my_open(data_file_name, O_RDWR|O_APPEND,

                                   MYF(0))) == -1)

      goto error;



    if (my_hash_insert(&tina_open_tables, (byte*) share))

      goto error;

    thr_lock_init(&share->lock);

    pthread_mutex_init(&share->mutex,MY_MUTEX_INIT_FAST);



    if ((share->data_file= my_open(data_file_name, O_RDWR|O_APPEND,

                                   MYF(0))) == -1)

      goto error2;



    /* We only use share->data_file for writing, so we scan to the end to append */

    if (my_seek(share->data_file, 0, SEEK_END, MYF(0)) == MY_FILEPOS_ERROR)

      goto error2;
@@ -212,6 +214,7 @@ static TINA_SHARE *get_share(const char *table_name, TABLE *table) 
error2:

  thr_lock_delete(&share->lock);

  pthread_mutex_destroy(&share->mutex);

  hash_delete(&tina_open_tables, (byte*) share);

error:

  pthread_mutex_unlock(&tina_mutex);

  my_free((gptr) share, MYF(0));