Hi, Alexey! On Nov 02, Alexey Botchkov wrote:

revision-id: cf04c06a58e3d0e700491f8f9167e9323cf1de1d (mariadb-10.1.18-28-gcf04c06) parent(s): c18054deb2b5cfcf1f13aa71574406f2bafb87c6 committer: Alexey Botchkov timestamp: 2016-11-02 13:02:32 +0400 message:

MDEV-10435 crash with bad stat tables.

Functions from sql/statistics.cc don't seem to expect stat tables to fail or to have inadequate structure. Table open errors suppressed and some validity checks added.

diff --git a/sql/sql_statistics.cc b/sql/sql_statistics.cc index 4020cbc..3f341ac 100644 --- a/sql/sql_statistics.cc +++ b/sql/sql_statistics.cc @@ -129,6 +129,30 @@ inline void init_table_list_for_single_stat_table(TABLE_LIST *tbl, }

+static +inline int stat_tables_are_inadequate(TABLE_LIST *tables) +{ + TABLE_SHARE *cur_s; + + /* If the number of tables changes, we should revise this function. */ + DBUG_ASSERT(STATISTICS_TABLES == 3); + + cur_s= tables[TABLE_STAT].table->s; + if (cur_s->fields < TABLE_STAT_N_FIELDS || cur_s->keys == 0) + return TRUE; + + cur_s= tables[COLUMN_STAT].table->s; + if (cur_s->fields < COLUMN_STAT_N_FIELDS || cur_s->keys == 0) + return TRUE; + + cur_s= tables[INDEX_STAT].table->s; + if (cur_s->fields < INDEX_STAT_N_FIELDS || cur_s->keys == 0) + return TRUE; + + return FALSE; +}

I'd suggest to use Table_check_intact interface instead. Regards, Sergei Chief Architect MariaDB and security@mariadb.org