Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40985

row_end access out of bounds in ALTER TABLE

    XMLWordPrintable

Details

    • Can result in hang or crash
    • An ALTER TABLE on a system-versioned table that contains virtual columns and a fulltext index could crash.

    Description

      --source include/have_innodb.inc
      CREATE TABLE t1 (c1 TEXT,v1 INT AS(1),v2 INT AS(1),v3 INT AS(1),v4 INT AS(1),v5 INT AS(1),FULLTEXT(c1)) WITH SYSTEM VERSIONING;
      ALTER TABLE t1 FORCE;
      

      Leads to:

      CS 13.0.2 be111d2cd60d035d555b71da019765cfb42ea0d3 (Debug, Clang 22.1.8-20260621) Build 21/08/2026

      mariadbd: /test/13.0_dbg/storage/innobase/include/dict0dict.inl:320: dict_col_t *dict_table_get_nth_col(const dict_table_t *, ulint): Assertion `pos < table->n_def' failed.
      

      CS 13.0.2 be111d2cd60d035d555b71da019765cfb42ea0d3 (Debug, Clang 22.1.8-20260621) Build 21/08/2026

      Core was generated by `/test/MD210826-mariadb-13.0.2-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
       
      [Current thread is 1 (LWP 3781910)]
      (gdb) bt
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
      #1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
      #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
      #3  0x00007ba09dc4527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
      #4  0x00007ba09dc288ff in __GI_abort () at ./stdlib/abort.c:79
      #5  0x00007ba09dc2881b in __assert_fail_base (fmt=0x7ba09ddd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5b07893b52de "pos < table->n_def", file=file@entry=0x5b07893b5064 "/test/13.0_dbg/storage/innobase/include/dict0dict.inl", line=line@entry=320, function=function@entry=0x5b07893b52f1 "dict_col_t *dict_table_get_nth_col(const dict_table_t *, ulint)") at ./assert/assert.c:96
      #6  0x00007ba09dc3b517 in __assert_fail (assertion=0x5b07893b52de "pos < table->n_def", file=0x5b07893b5064 "/test/13.0_dbg/storage/innobase/include/dict0dict.inl", line=320, function=0x5b07893b52f1 "dict_col_t *dict_table_get_nth_col(const dict_table_t *, ulint)") at ./assert/assert.c:105
      #7  0x00005b0788a43f26 in dict_table_get_nth_col (table=0x739f6405e3c8, pos=7)at include/dict0dict.inl:320
      #8  0x00005b0788a75aed in dict_table_get_col_name (table=0x739f6405e3c8, col_nr=7) at include/dict0dict.h:742
      #9  0x00005b0788c2dcb9 in row_merge_create_index (table=0x739f6405e3c8, index_def=0x739f6405e108, add_v=0x0)at /test/13.0_dbg/storage/innobase/row/row0merge.cc:4538
      #10 0x00005b0788a988af in prepare_inplace_alter_table_dict (ha_alter_info=0x7ba09c0d8c08, altered_table=0x7ba09c0d8f30, old_table=0x739f64028d70, old_opt=0x739f6404e240, table_name=0x739f6404cd15 "t1", flags=33, flags2=94, fts_doc_id_col=3, add_fts_doc_id=true, add_fts_doc_id_idx=true)at /test/13.0_dbg/storage/innobase/handler/handler0alter.cc:7007
      #11 0x00005b0788a9309c in ha_innobase::prepare_inplace_alter_table (this=0x739f640291c0, altered_table=0x7ba09c0d8f30, ha_alter_info=0x7ba09c0d8c08)at /test/13.0_dbg/storage/innobase/handler/handler0alter.cc:8757
      #12 0x00005b078867ccd1 in handler::ha_prepare_inplace_alter_table (this=0x739f640291c0, altered_table=0x7ba09c0d8f30, ha_alter_info=0x7ba09c0d8c08) at /test/13.0_dbg/sql/handler.cc:6003
      #13 0x00005b0788388018 in mysql_inplace_alter_table (thd=0x739f64000d60, table_list=0x739f6401a4c0, table=0x739f64028d70, altered_table=0x7ba09c0d8f30, ha_alter_info=0x7ba09c0d8c08, target_mdl_request=0x7ba09c0daec0, ddl_log_state=0x7ba09c0d8ea0, trigger_param=0x7ba09c0daac0, alter_ctx=0x7ba09c0d9d48, partial_alter=@0x7ba09c0d8e6d: false, start_alter_id=@0x7ba09c0d8e60: 0, if_exists=false) at /test/13.0_dbg/sql/sql_table.cc:8251
      #14 0x00005b07883810b4 in mysql_alter_table (thd=0x739f64000d60, new_db=0x739f64005ba0, new_name=0x739f64006038, create_info=0x7ba09c0dbf90, table_list=0x739f6401a4c0, recreate_info=0x7ba09c0db6a8, alter_info=0x7ba09c0dbe18, order_num=0, order=0x0, ignore=false, if_exists=false)at /test/13.0_dbg/sql/sql_table.cc:11810
      #15 0x00005b078844137c in Sql_cmd_alter_table::execute (this=0x739f6401ac10, thd=0x739f64000d60) at /test/13.0_dbg/sql/sql_alter.cc:705
      #16 0x00005b0788272c06 in mysql_execute_command (thd=0x739f64000d60, is_called_from_prepared_stmt=false) at /test/13.0_dbg/sql/sql_parse.cc:5905
      #17 0x00005b0788263d18 in mysql_parse (thd=0x739f64000d60, rawbuf=0x739f6401a3c0 "ALTER TABLE t1 FORCE", length=20, parser_state=0x7ba09c0dd9f0) at /test/13.0_dbg/sql/sql_parse.cc:7943
      #18 0x00005b078826146e in dispatch_command (command=COM_QUERY, thd=0x739f64000d60, packet=0x739f6400b5f1 "ALTER TABLE t1 FORCE", packet_length=20, blocking=true) at /test/13.0_dbg/sql/sql_parse.cc:1903
      #19 0x00005b078826479a in do_command (thd=0x739f64000d60, blocking=true)at /test/13.0_dbg/sql/sql_parse.cc:1437
      #20 0x00005b078843675e in do_handle_one_connection (connect=0x5b078b1ce880, put_in_cache=true) at /test/13.0_dbg/sql/sql_connect.cc:1514
      #21 0x00005b0788436541 in handle_one_connection (arg=0x5b078b1ad1e0)at /test/13.0_dbg/sql/sql_connect.cc:1426
      #22 0x00007ba09dc9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #23 0x00007ba09dd29d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.11  dbg  210826  6415902490b1b0a9a500cee9bc0a41c342190605  pos < table->n_def|SIGABRT|dict_table_get_nth_col|dict_table_get_col_name|row_merge_create_index|prepare_inplace_alter_table_dict
      CS  10.11  opt  210826  6415902490b1b0a9a500cee9bc0a41c342190605  No bug found                  
      CS  11.4   dbg  210826  1a052f27e374fc9b4cb5b1fd098cf10f0e1381cc  pos < table->n_def|SIGABRT|dict_table_get_nth_col|dict_table_get_col_name|row_merge_create_index|prepare_inplace_alter_table_dict
      CS  11.4   opt  210826  1a052f27e374fc9b4cb5b1fd098cf10f0e1381cc  No bug found                  
      CS  11.8   dbg  210826  d26f9ab217a7fcf9d4eccc62c01020ff275ff42e  pos < table->n_def|SIGABRT|dict_table_get_nth_col|dict_table_get_col_name|row_merge_create_index|prepare_inplace_alter_table_dict
      CS  11.8   opt  210826  d26f9ab217a7fcf9d4eccc62c01020ff275ff42e  No bug found                  
      CS  12.3   dbg  210826  add63991988734383c5e942de2a19c6c45f511f7  pos < table->n_def|SIGABRT|dict_table_get_nth_col|dict_table_get_col_name|row_merge_create_index|prepare_inplace_alter_table_dict
      CS  12.3   opt  210826  add63991988734383c5e942de2a19c6c45f511f7  No bug found                  
      CS  13.0   dbg  210826  be111d2cd60d035d555b71da019765cfb42ea0d3  pos < table->n_def|SIGABRT|dict_table_get_nth_col|dict_table_get_col_name|row_merge_create_index|prepare_inplace_alter_table_dict
      CS  13.0   opt  210826  be111d2cd60d035d555b71da019765cfb42ea0d3  No bug found                  
      CS  13.1   dbg  210826  ff09eefbe4e8b57846435ee4a928f17e49f0fdfc  pos < table->n_def|SIGABRT|dict_table_get_nth_col|dict_table_get_col_name|row_merge_create_index|prepare_inplace_alter_table_dict
      CS  13.1   opt  210826  ff09eefbe4e8b57846435ee4a928f17e49f0fdfc  No bug found                  
      ES  10.6   dbg  210826  fcecb2620f25965723d640decede7c018bcb1dcc  pos < table->n_def|SIGABRT|dict_table_get_nth_col|dict_table_get_col_name|row_merge_create_index|prepare_inplace_alter_table_dict
      ES  10.6   opt  210826  fcecb2620f25965723d640decede7c018bcb1dcc  No bug found                  
      ES  11.4   dbg  210826  3b34189bfe675c18c4ced3ef531d016ea74c76f4  pos < table->n_def|SIGABRT|dict_table_get_nth_col|dict_table_get_col_name|row_merge_create_index|prepare_inplace_alter_table_dict
      ES  11.4   opt  210826  3b34189bfe675c18c4ced3ef531d016ea74c76f4  No bug found                  
      ES  11.8   dbg  210826  4694e931d10fecf733c34f83ea2146d31b708eb3  pos < table->n_def|SIGABRT|dict_table_get_nth_col|dict_table_get_col_name|row_merge_create_index|prepare_inplace_alter_table_dict
      ES  11.8   opt  210826  4694e931d10fecf733c34f83ea2146d31b708eb3  No bug found                  
      ES  12.3   dbg  210826  f513f503feacabfb219d4a6f965b5f72b86d4db0  pos < table->n_def|SIGABRT|dict_table_get_nth_col|dict_table_get_col_name|row_merge_create_index|prepare_inplace_alter_table_dict
      ES  12.3   opt  210826  f513f503feacabfb219d4a6f965b5f72b86d4db0  No bug found                  
      

      Attachments

        Issue Links

          Activity

            People

              marko Marko Mäkelä
              saahil Saahil Alam
              Marko Mäkelä Marko Mäkelä
              Thirunarayanan Balathandayuthapani Thirunarayanan Balathandayuthapani
              Saahil Alam Saahil Alam
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 0d
                  0d
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 2.15h
                  2.15h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.