MDEV-24245 REPAIR/OPTIMIZE on ARCHIVE table corrupts blob/text data#5428
MDEV-24245 REPAIR/OPTIMIZE on ARCHIVE table corrupts blob/text data#5428vaintroub wants to merge 1 commit into
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request addresses a potential blob data corruption issue during table optimization in the archive storage engine (specifically for version 3 and above) by copying blob data out of the shared record buffer before packing. It also adds a test case to verify the fix. The review feedback identifies a critical issue where the return value of buffer.alloc() is not checked, which could lead to a null pointer dereference in out-of-memory conditions.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
pack_row() and unpack_row() both used record_buffer. After unpack_row(), blob field pointers in record[0] reference data stored in record_buffer. When pack_row() then writes the new packed row into the same record_buffer, it overwrites the blob data that those pointers still reference. Subsequent Field_blob::pack() calls follow the stale pointers and read corrupted data. This only matters in the optimize/repair loop where the same handler reads then writes each row. Normal INSERT has no prior unpack_row() on the same handler. Fix: in the optimize loop, before writing, copy blob data out of record_buffer (the same approach already used by get_row_version2),so that blob pointers no longer reference record_buffer when pack_row() overwrites it. Free the temporary blob buffer after the loop.
b4a4cb9 to
ce238ac
Compare
pack_row() and unpack_row() both used record_buffer. After unpack_row(), blob field pointers in record[0] reference data stored in record_buffer. When pack_row() then writes the new packed row into the same record_buffer, it overwrites the blob data that those pointers still reference. Subsequent Field_blob::pack() calls follow the stale pointers and read corrupted data.
This only matters in the optimize/repair loop where the same handler reads then writes each row. Normal INSERT has no prior unpack_row() on the same handler.
Fix: in the optimize loop, before writing, copy blob data out of record_buffer (the same approach already used by get_row_version2),so that blob pointers no longer reference record_buffer when pack_row() overwrites it.
Free the temporary blob buffer after the loop.