MDEV-11883 MariaDB crashes with out-of-memory when query information_schema

CSV engine didn't expect CSM files to be read-only

3 files changed, 58 insertions, 6 deletions

diff --git a/mysql-test/suite/csv/read_only.result b/mysql-test/suite/csv/read_only.result
new file mode 100644
index 00000000000..d6936681f65
--- /dev/null
+++ b/mysql-test/suite/csv/read_only.result
@@ -0,0 +1,30 @@
+create table t1 (a int not null) engine=csv;
+insert t1 values (1),(2);
+flush tables;
+select * from information_schema.tables where table_schema='test';
+TABLE_CATALOG	def
+TABLE_SCHEMA	test
+TABLE_NAME	t1
+TABLE_TYPE	BASE TABLE
+ENGINE	NULL
+VERSION	NULL
+ROW_FORMAT	NULL
+TABLE_ROWS	NULL
+AVG_ROW_LENGTH	NULL
+DATA_LENGTH	NULL
+MAX_DATA_LENGTH	NULL
+INDEX_LENGTH	NULL
+DATA_FREE	NULL
+AUTO_INCREMENT	NULL
+CREATE_TIME	NULL
+UPDATE_TIME	NULL
+CHECK_TIME	NULL
+TABLE_COLLATION	NULL
+CHECKSUM	NULL
+CREATE_OPTIONS	NULL
+TABLE_COMMENT	File './test/t1.CSM' not found (Errcode: 13 "Permission denied")
+Warnings:
+Level	Warning
+Code	29
+Message	File './test/t1.CSM' not found (Errcode: 13 "Permission denied")
+drop table t1;
diff --git a/mysql-test/suite/csv/read_only.test b/mysql-test/suite/csv/read_only.test
new file mode 100644
index 00000000000..2af209182d0
--- /dev/null
+++ b/mysql-test/suite/csv/read_only.test
@@ -0,0 +1,19 @@
+#
+# MDEV-11883 MariaDB crashes with out-of-memory when query information_schema
+#
+source include/have_csv.inc;
+
+let datadir=`select @@datadir`;
+
+create table t1 (a int not null) engine=csv;
+insert t1 values (1),(2);
+flush tables;
+
+chmod 0400 $datadir/test/t1.CSM;
+chmod 0400 $datadir/test/t1.CSV;
+
+--replace_result $datadir ./
+query_vertical select * from information_schema.tables where table_schema='test';
+
+drop table t1;
+
diff --git a/storage/csv/ha_tina.cc b/storage/csv/ha_tina.cc
index 92ac20a8f82..35596a59c86 100644
--- a/storage/csv/ha_tina.cc
+++ b/storage/csv/ha_tina.cc
@@ -289,7 +289,7 @@ static int read_meta_file(File meta_file, ha_rows *rows)
   mysql_file_seek(meta_file, 0, MY_SEEK_SET, MYF(0));
   if (mysql_file_read(meta_file, (uchar*)meta_buffer, META_BUFFER_SIZE, 0)
       != META_BUFFER_SIZE)
-    DBUG_RETURN(HA_ERR_CRASHED_ON_USAGE);
+    DBUG_RETURN(my_errno= HA_ERR_CRASHED_ON_USAGE);
 
   /*
     Parse out the meta data, we ignore version at the moment
@@ -418,10 +418,13 @@ static int free_share(TINA_SHARE *share)
   int result_code= 0;
   if (!--share->use_count){
     /* Write the meta file. Mark it as crashed if needed. */
-    (void)write_meta_file(share->meta_file, share->rows_recorded,
-                          share->crashed ? TRUE :FALSE);
-    if (mysql_file_close(share->meta_file, MYF(0)))
-      result_code= 1;
+    if (share->meta_file != -1)
+    {
+      (void)write_meta_file(share->meta_file, share->rows_recorded,
+                            share->crashed ? TRUE :FALSE);
+      if (mysql_file_close(share->meta_file, MYF(0)))
+        result_code= 1;
+    }
     if (share->tina_write_opened)
     {
       if (mysql_file_close(share->tina_write_filedes, MYF(0)))
@@ -930,7 +933,7 @@ int ha_tina::open(const char *name, int mode, uint open_options)
   if (share->crashed && !(open_options & HA_OPEN_FOR_REPAIR))
   {
     free_share(share);
-    DBUG_RETURN(HA_ERR_CRASHED_ON_USAGE);
+    DBUG_RETURN(my_errno ? my_errno : HA_ERR_CRASHED_ON_USAGE);
   }
 
   local_data_file_version= share->data_file_version;