MySQL Bugs: #1781: Error Releasing Memory

Bug #1781	Error Releasing Memory
Submitted:	7 Nov 2003 15:24	Modified:	18 Dec 2003 8:16
Reporter:	Dan Pickett	Email Updates:
Status:	No Feedback	Impact on me:	None
Category:	MySQL Server: Embedded Library ( libmysqld )	Severity:	S3 (Non-critical)
Version:	4.0.15	OS:	Windows (Windows 2000)
Assigned to:		CPU Architecture:	Any

Description:
An error occurs when freeing memory in my_no_flags_free.  This occurs after I change the name of a column with the following SQL statement using mysql_query; "ALTER TABLE petinfo CHANGE death dead DATE".

int ha_myisam::create(...) allocates memory for recinfo and later frees this memory at the end of the routine, this is where the exception occurs.

Also, one thing to note, I don't have any data in this table, I've only defined tables with columns.

How to repeat:
I've successfully repeated this by launching my application in Windows 2000, opening my pet data base, showing the column names for the table, selecting a column name and issuing the following SQL statement via mysql_query: "ALTER TABLE petinfo CHANGE death dead DATE".

Suggested fix:
Determine what memory error occurred.  At first, I figured this to be a memory overrun, but I haven't been able to prove it as I expected so it is probably something else.  Also, the value of recinfo doesn't change after the memory allocation, so I don't see it being a pointer error.

I wasn't able to find anything suspicious by looking at the code, and your "how-to-repeat" doesn't really allow somebody to repeat a crash, does it ?

Could you provide a repeatable test case ?
something like

  CREATE TABLE petinfo ...
  ALTER TABLE petinfo CHANGE death dead DATE;

alternatively you may try to use libmysql+mysqld to isolate the error. Use debug version of mysqld, if the crash still happens on the server side.

No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".