Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-13238

Dynamic columns are corrupted by COLUMN_ADD when value goes out of bounds

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Major
    • Resolution: Not a Bug
    • Affects Version/s: 10.0, 10.1, 10.2
    • Fix Version/s: N/A
    • Component/s: Dynamic Columns
    • Labels:
      None

      Description

      All contents of a blob containing dynamic columns can be easily corrupted by simply adding a value, when the field length is exceeded.

      CREATE TABLE t1 (b TINYBLOB);
      --echo #
      --echo # The column gets created normally, that's good
      INSERT INTO t1 VALUES (COLUMN_CREATE('Column1',REPEAT('a',200)));
      SELECT COLUMN_JSON(b) FROM t1;
      --echo #
      --echo # The column gets created, but the value is truncated, that's expected
      UPDATE t1 SET b = COLUMN_ADD(b,'Column2',REPEAT('b',200));
      SELECT COLUMN_JSON(b) FROM t1;
      --echo #
      --echo # The warning says that the value is truncated again...
      UPDATE t1 SET b = COLUMN_ADD(b,'Column3',REPEAT('c',200));
      --echo #
      --echo # ...but in fact the whole column is corrupt
      SELECT COLUMN_JSON(b) FROM t1;
      DROP TABLE t1;
      

      Here in the test case the maximum length of the blob is 255 symbols.
      The first dynamic column with value of 200 symbols long fits all right.
      The second one with value of 200 symbols long is still created, but its value is truncated. It's fine.
      But the third one is still attempted to be added and this attempt corrupts the whole column.

      MariaDB [test]> UPDATE t1 SET b = COLUMN_ADD(b,'Column3',REPEAT('c',200));
      Query OK, 1 row affected, 1 warning (0.04 sec)
      Rows matched: 1  Changed: 1  Warnings: 1
       
      MariaDB [test]> SHOW WARNINGS;
      +---------+------+----------------------------------------+
      | Level   | Code | Message                                |
      +---------+------+----------------------------------------+
      | Warning | 1265 | Data truncated for column 'b' at row 1 |
      +---------+------+----------------------------------------+
      1 row in set (0.00 sec)
       
      MariaDB [test]> SELECT COLUMN_JSON(b) FROM t1;
      ERROR 1919 (HY000): Encountered illegal format of dynamic column string
      

      The last UPDATE should just fail, but not touch the existing value.

      Note: the same result can be achieved by 2 columns, I intentionally made it 3-step to show that the current logic is capable of truncating a value in some circumstances but not other.

        Attachments

          Activity

            People

            Assignee:
            sanja Oleksandr Byelkin
            Reporter:
            elenst Elena Stepanova
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:

                Git Integration