Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
None
-
None
-
None
Description
We observed a problem with savepoints in Mariadb 5.5.25. The problem at the SQL layer is that a "rollback to savepoint" statement would get an error after the savepoint was created. The problem was caused by the savepoint name in the savepoint stack getting overwritten by the handlerton savepoint_set method.
We believe that the handler savepoint_offset initialization is WRONG. The ha_initialize_handlerton function executes the savepoint initialization twice, which breaks the contract spec'ed in the handler.h file.
Suppose that savepoint_alloc_size = 0, and hton->savepoint_offset = 32.
After the first savepoint init code is executed at line 504, savepoint_alloc_size = 32 and hton->savepoint_offset = 0.
After the second savepoint int code is executed at line 530, savepoint_alloc_size = 32 and hton->savepoint_offset = 32.
So, the handlerton's savepoint is outside of the memory allocated for the savepoint state.
Our fix is here: lp:~prohaska7/maria/5.5-savepoint-offset-fix