Bug #35406 5.1-opt crashes on select from I_S.REFERENTIAL_CONSTRAINTS
Submitted: 18 Mar 16:32 Modified: 2 Apr 20:46
Reporter: Sergey Gluhov
Status: Closed
Category:Server: I_S Severity:S3 (Non-critical)
Version:5.1-opt OS:Any
Assigned to: Sergey Gluhov Target Version:5.1-opt
Triage: D1 (Critical)

[18 Mar 16:32] Sergey Gluhov
Description:
5.1-opt crashes on select from I_S.REFERENTIAL_CONSTRAINTS because of uninitialized
variable.
In function
int
ha_innobase::get_foreign_key_list(THD *thd, List<FOREIGN_KEY_INFO> *f_key_list)

we have the following code:

         if (foreign->referenced_index &&
              foreign->referenced_index->name)
	    f_key_info.referenced_key_name = thd_make_lex_string(
		    thd, f_key_info.referenced_key_name,
		    foreign->referenced_index->name,
		    strlen(foreign->referenced_index->name), 1);

If referenced table is dropped(foreign->referenced_index=0)  then
f_key_info.referenced_key_name field may be uninitialized. It
leads to crash in get_referential_constraints_record(),sql_show.cc

How to repeat:
Test case from the bug#35108  report:

create table p1(id int primary key) engine = Innodb;

create table c1(pid int, foreign key (pid) references p1(id)) engine = Innodb;

select * 
from information_schema.referential_constraints 
where constraint_schema = schema();

set foreign_key_checks = 0;

drop table p1;

select * 
from information_schema.referential_constraints 
where constraint_schema = schema();

Suggested fix:
http://lists.mysql.com/commits/44101
[18 Mar 16:43] Bugs System
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/44179

ChangeSet@1.2563, 2008-03-18 19:42:04+04:00, gluh@mysql.com +1 -0
  Bug#35406 5.1-opt crashes on select from I_S.REFERENTIAL_CONSTRAINTS
  added intialization of f_key_info.referenced_key_name for the case when
  referenced table is dropped
[28 Mar 10:21] Bugs System
Pushed into 5.1.24-rc
[31 Mar 15:58] Bugs System
Pushed into 6.0.5-alpha
[2 Apr 20:46] Paul DuBois
Noted in 5.1.24, 6.0.5 changelogs.

Selecting from INFORMATION_SCHEMA.REFERENTIAL_CONSTRAINTS could cause
a server crash.