Bug #28449 | Server crashes on closing a temporary table after SELECT ... GROUP BY | ||
---|---|---|---|
Submitted: | 15 May 2007 15:50 | Modified: | 14 Jun 2007 19:26 |
Reporter: | Alexey Kopytov | Email Updates: | |
Status: | Closed | Impact on me: | |
Category: | MySQL Server: General | Severity: | S2 (Serious) |
Version: | 5.0, 5.1.19 | OS: | Any |
Assigned to: | Igor Babaev | CPU Architecture: | Any |
Tags: | crash, DoS, hang |
[15 May 2007 15:50]
Alexey Kopytov
[17 May 2007 13:08]
MySQL Verification Team
Verified on debug build using this testcase: set session tmp_table_size=1024; set session max_heap_table_size=16384; drop table if exists test_table_is_full; CREATE TABLE test_table_is_full( test_col1 varchar(32) character set utf8 collate utf8_bin NOT NULL, test_col2 varchar(32) character set utf8 collate utf8_bin NOT NULL ) ENGINE=MyISAM DEFAULT CHARSET=utf8; INSERT INTO test_table_is_full values ('AAAAAAAAAA','AAAAAAAAAA'), ('AAAAAAAAAB ','AAAAAAAAAB '), ('AAAAAAAAAB','AAAAAAAAAB'), ('AAAAAAAAAC','AAAAAAAAAC'), ('AAAAAAAAAD','AAAAAAAAAD'), ('AAAAAAAAAE','AAAAAAAAAE'), ('AAAAAAAAAF','AAAAAAAAAF'), ('AAAAAAAAAG','AAAAAAAAAG'), ('AAAAAAAAAH','AAAAAAAAAH'), ('AAAAAAAAAI','AAAAAAAAAI'), ('AAAAAAAAAJ','AAAAAAAAAJ'), ('AAAAAAAAAK','AAAAAAAAAK'); SELECT MAX( test_col1 ) FROM test_table_is_full GROUP BY test_col1,test_col2,null;
[17 May 2007 13:17]
MySQL Verification Team
On windows 5.0.42BK and 5.1.19BK, debug build crashed. 5.1.19 release build corrupted memory, and caused a 100% cpu hang. After KILLing the hung thread, and reconnecting, the server then crashed due to the memory being corrupted.
[7 Jun 2007 7:53]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/28263 ChangeSet@1.2518, 2007-06-07 00:53:34-07:00, igor@olga.mysql.com +3 -0 Fixed bug #28449: a crash may happen at some rare conditions when a temporary table has grown out of heap memory reserved for it and the remaining disk space is not big enough to store the table as a MyISAM table. The crash happens because the function create_myisam_from_heap does not handle safely the mem_root structure associated with the converted table in the case when an error has occurred.
[7 Jun 2007 7:58]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/28265 ChangeSet@1.2518, 2007-06-07 00:59:08-07:00, igor@olga.mysql.com +4 -0 Fixed bug #28449: a crash may happen at some rare conditions when a temporary table has grown out of heap memory reserved for it and the remaining disk space is not big enough to store the table as a MyISAM table. The crash happens because the function create_myisam_from_heap does not handle safely the mem_root structure associated with the converted table in the case when an error has occurred.
[14 Jun 2007 19:01]
Bugs System
Pushed into 5.0.44
[14 Jun 2007 19:01]
Bugs System
Pushed into 5.1.20-beta
[14 Jun 2007 19:26]
Paul DuBois
Noted in 5.0.44, 5.1.20 changelogs.