Many files:

  Merge InnoDB-3.23.52c
ha_innobase.cc:
  Test the ref length sanity also in the production version


sql/ha_innobase.cc:
  Test the ref length sanity also in the production version
innobase/btr/btr0cur.c:
  Merge InnoDB-3.23.52c
innobase/buf/buf0buf.c:
  Merge InnoDB-3.23.52c
innobase/buf/buf0lru.c:
  Merge InnoDB-3.23.52c
innobase/ha/ha0ha.c:
  Merge InnoDB-3.23.52c
innobase/log/log0recv.c:
  Merge InnoDB-3.23.52c
innobase/mtr/mtr0log.c:
  Merge InnoDB-3.23.52c
innobase/os/os0file.c:
  Merge InnoDB-3.23.52c
innobase/page/page0cur.c:
  Merge InnoDB-3.23.52c
innobase/include/btr0btr.h:
  Merge InnoDB-3.23.52c
innobase/include/dyn0dyn.h:
  Merge InnoDB-3.23.52c
innobase/include/log0recv.h:
  Merge InnoDB-3.23.52c
innobase/include/buf0buf.ic:
  Merge InnoDB-3.23.52c
innobase/include/log0log.ic:
  Merge InnoDB-3.23.52c

1 files changed, 34 insertions, 3 deletions

diff --git a/innobase/mtr/mtr0log.c b/innobase/mtr/mtr0log.c
index b582afc5710..2cfe81d3261 100644
--- a/innobase/mtr/mtr0log.c
+++ b/innobase/mtr/mtr0log.c
@@ -14,6 +14,7 @@ Created 12/7/1995 Heikki Tuuri
 
 #include "buf0buf.h"
 #include "dict0boot.h"
+#include "log0recv.h"
 
 /************************************************************
 Catenates n bytes to the mtr log. */
@@ -121,7 +122,7 @@ byte*
 mlog_parse_nbytes(
 /*==============*/
 			/* out: parsed record end, NULL if not a complete
-			record */
+			record or a corrupt record */
 	ulint	type,	/* in: log record type: MLOG_1BYTE, ... */
 	byte*	ptr,	/* in: buffer */
 	byte*	end_ptr,/* in: buffer end */
@@ -141,6 +142,12 @@ mlog_parse_nbytes(
 	offset = mach_read_from_2(ptr);
 	ptr += 2;
 		
+	if (offset >= UNIV_PAGE_SIZE) {
+		recv_sys->found_corrupt_log = TRUE;
+
+		return(NULL);
+	}
+
 	if (type == MLOG_8BYTES) {
 		ptr = mach_dulint_parse_compressed(ptr, end_ptr, &dval);
 
@@ -163,13 +170,33 @@ mlog_parse_nbytes(
 		return(NULL);
 	}
 
+	if (type == MLOG_1BYTE) {
+		if (val > 0xFF) {
+			recv_sys->found_corrupt_log = TRUE;
+
+			return(NULL);
+		}
+	} else if (type == MLOG_2BYTES) {
+		if (val > 0xFFFF) {
+			recv_sys->found_corrupt_log = TRUE;
+
+			return(NULL);
+		}
+	} else {
+		if (type != MLOG_4BYTES) {
+			recv_sys->found_corrupt_log = TRUE;
+
+			return(NULL);
+		}
+	}
+
 	if (page) {
 		if (type == MLOG_1BYTE) {
 			mach_write_to_1(page + offset, val);
 		} else if (type == MLOG_2BYTES) {
 			mach_write_to_2(page + offset, val);
 		} else {
-			ut_ad(type == MLOG_4BYTES);
+			ut_a(type == MLOG_4BYTES);
 			mach_write_to_4(page + offset, val);
 		}
 	}
@@ -338,7 +365,11 @@ mlog_parse_string(
 	offset = mach_read_from_2(ptr);
 	ptr += 2;
 
-	ut_a(offset < UNIV_PAGE_SIZE);
+	if (offset >= UNIV_PAGE_SIZE) {
+		recv_sys->found_corrupt_log = TRUE;
+
+		return(NULL);
+	}
 
 	len = mach_read_from_2(ptr);
 	ptr += 2;