[MDEV-18749] rec_get_converted_size_comp_prefix_low: Conditional jump or move depends on uninitialised value upon adding FULLTEXT index Created: 2019-02-26 Updated: 2019-03-12 Resolved: 2019-03-06 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Storage Engine - InnoDB, Storage Engine - XtraDB |
| Affects Version/s: | 10.4 |
| Fix Version/s: | 10.2.23, 10.1.39, 10.3.14, 10.4.4 |
| Type: | Bug | Priority: | Major |
| Reporter: | Elena Stepanova | Assignee: | Marko Mäkelä |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Description |
|
Not reproducible on 10.3. |
| Comments |
| Comment by Marko Mäkelä [ 2019-03-06 ] | |||
|
The problem is that most of field->col is uninitialized for this index, whose names is tmp_fts_index, created in row_merge_create_fts_sort_index(). The uninitialized bits seem to include field->col->ind, which we are checking in the first part of the debug assertion:
The fix is simple: row_merge_create_fts_sort_index() should invoke mem_heap_zalloc() instead of mem_heap_alloc() when allocating the 3 copies of field->col. I think that this is best done in 10.1 already, to prevent other potential issues in this area. |