Bug #76232 InnoDB: Missing brackets in fsp_flags_is_valid()
Submitted: 9 Mar 2015 16:43 Modified: 17 Mar 2015 22:26
Reporter: Kevin Lewis Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server: InnoDB storage engine Severity:S3 (Non-critical)
Version:5.7.7 OS:Any
Assigned to: CPU Architecture:Any

[9 Mar 2015 16:43] Kevin Lewis
Description:
Code inspection has revealed that there are missing brackets in the function fsp_flags_is_valid().

	/* Barracuda row formats COMPRESSED and DYNAMIC use a feature called
	ATOMIC_BLOBS which builds on the page structure introduced for the
	COMPACT row format by allowing long fields to be broken into prefix
	and externally stored parts. So if it is Post_antelope, it uses
	Atomic BLOBs. */
	if (post_antelope != atomic_blobs) {
		return(false);

	/* Make sure there are no bits that we do not know about. */
	if (unused != 0)
		return(false);
	}

The engine bracket is missing from the first condition and the starting bracket is missing from the second condition.

The effect is that this code will not recognize a corrupted datafile that specifically has bad  bits set in the unused portion of the FSP_FLAGS field.  It this happened, the overwhelming likelihood is that other bits in this field would be inconsistent and other portions of the header page would also be corrupted, the the corruption would be noticed by other parts of InnoDB.

This test is mainly here to prevent this release from being able to use a future release that adds a new flag for a datafile feature that this version does not know about.  So it is imperative that this fix get in before GA.

How to repeat:
See code.

Suggested fix:
	/* Barracuda row formats COMPRESSED and DYNAMIC use a feature called
	ATOMIC_BLOBS which builds on the page structure introduced for the
	COMPACT row format by allowing long fields to be broken into prefix
	and externally stored parts. So if it is Post_antelope, it uses
	Atomic BLOBs. */
	if (post_antelope != atomic_blobs) {
		return(false);
+	}

	/* Make sure there are no bits that we do not know about. */
-	if (unused != 0)
+	if (unused != 0) {
		return(false);
	}
[17 Mar 2015 22:26] Daniel Price
Posted by developer:
 
Fixed as of the upcoming 5.7.8, 5.8.0 releases, and here's the changelog entry:

Missing brackets in the "fsp_flags_is_valid" function could result in a
failure to recognize a corrupted data file.