Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Not a Bug
-
10.11, 11.4, 11.8, 12.3, 13.1, 13.2
-
None
-
Can result in hang or crash
-
Q4/2026 Server Maintenance, Q1/2027 Server Maintenance
Description
ALTER TABLE ... IMPORT TABLESPACE reads every page of the .ibd file
being imported and, for the clustered index, rewrites each record's
DB_TRX_ID/DB_ROLL_PTR system columns and any BLOB external reference
it finds (PageConverter::update_records() and adjust_cluster_index_blob_column()).
The imported page's internal checksum is verified before this step,
but nothing checks that the record positions and record offsets computed
from the page content, nor the length field inside a BLOB external
reference, are actually sane. They are trusted as if they came from
a page InnoDB itself had written.
Two concrete problems were found:
1. Unvalidated record offsets. The record "next" pointer chaining
records together on a page is only range-checked by a debug-only
assertion. In a release build a corrupted pointer can make the
iterator land on an arbitrary byte within the page, which is then
decoded as if it were a real record's field count/offsets
2. Unvalidated BLOB pointer length. A BLOB external reference's
8-byte length field (BTR_EXTERN_LEN) is trusted outright.
btr_copy_externally_stored_field() only consults the low 32 bits of
this field, so a corrupted high dword is completely invisible to
ordinary reads
This is created to port mysql bug#39295605 patch