• Annamalai Gurusami's avatar
    Bug #14500557 CRASH WHEN USING LONG INNODB INDEXES · dde12745
    Annamalai Gurusami authored
    The ha_innobase table handler contained two search key buffers
    (srch_key_val1, srch_key_val2) of fixed size used to store the search
    key.  The size of these buffers where fixed at
    REC_VERSION_56_MAX_INDEX_COL_LEN + 2.  But this size is not sufficient
    to hold the search key.  Hence the following assert in
    row_sel_convert_mysql_key_to_innobase() failed.
    
    2438                 /* Storing may use at most data_len bytes of buf */
    2439 
    2440                 if (UNIV_LIKELY(!is_null)) {
    2441                         ut_a(buf + data_len <= original_buf + buf_len);
    2442                         row_mysql_store_col_in_innobase_format(
    2443                                 dfield, buf,
    2444                                 FALSE, /* MySQL key value format col */
    2445                                 key_ptr + data_offset, data_len,
    2446                                 dict_table_is_comp(index->table));
    2447                         buf += data_len;
    2448                 }
    
    The buffer size is now calculated with the formula
    MAX_KEY_LENGTH + MAX_REF_PARTS*2.  This properly takes into account
    the extra bytes needed to store the length for each column.  An index
    can contain a maximum of MAX_REF_PARTS columns in it, and for each
    column 2 bytes are needed to store length.  
    
    rb://1238 approved by Marko and Vasil Dimov.
    dde12745
row0sel.c 132 KB