Merge lp:~vkolesnikov/pbxt/pbxt-bug-451101 into lp:pbxt

[Vladimir Kolesnikov]

=== modified file 'ChangeLog'
--- ChangeLog	2009-10-06 08:21:17 +0000
+++ ChangeLog	2009-10-16 20:20:23 +0000
@@ -3,6 +3,12 @@
 
 ------- 1.0.09e RC3 - Not released yet
 
+RN281: Fixed bug #451101: jump or move depends on uninitialised value in myxt_get_key_length
+
+RN280: Fixed bug #451080: Uninitialised memory write in XTDatabaseLog::xlog_append
+
+RN279: Fixed bug #451085: jump or move depends on uninitialised value in my_type_to_string
+
 RN278: Fixed bug #441000: xtstat crashes with segmentation fault on startup if max_pbxt_threads exceeded.
 
 ------- 1.0.09d RC3 - 2009-09-30

=== modified file 'src/index_xt.cc'
--- src/index_xt.cc	2009-09-08 10:52:24 +0000
+++ src/index_xt.cc	2009-10-16 20:20:23 +0000
@@ -828,15 +828,18 @@
 	u_int	ilen;
 
 	result->sr_item.i_item_offset += result->sr_item.i_item_size + result->sr_item.i_node_ref_size;
-	bitem = branch->tb_data + result->sr_item.i_item_offset;
-	if (ind->mi_fix_key)
-		ilen = result->sr_item.i_item_size;
-	else {
-		ilen = myxt_get_key_length(ind, bitem) + XT_RECORD_REF_SIZE;
-		result->sr_item.i_item_size = ilen;
+	if (result->sr_item.i_item_offset < result->sr_item.i_total_size) {
+		bitem = branch->tb_data + result->sr_item.i_item_offset;
+	
+		if (ind->mi_fix_key)
+			ilen = result->sr_item.i_item_size;
+		else {
+			ilen = myxt_get_key_length(ind, bitem) + XT_RECORD_REF_SIZE;
+			result->sr_item.i_item_size = ilen;
+		}
+		xt_get_res_record_ref(bitem + ilen - XT_RECORD_REF_SIZE, result); /* (Only valid if i_item_offset < i_total_size) */
+		result->sr_branch = IDX_GET_NODE_REF(tab, bitem, result->sr_item.i_node_ref_size);
 	}
-	xt_get_res_record_ref(bitem + ilen - XT_RECORD_REF_SIZE, result); /* (Only valid if i_item_offset < i_total_size) */
-	result->sr_branch = IDX_GET_NODE_REF(tab, bitem, result->sr_item.i_node_ref_size);
 }
 
 xtPublic void xt_prev_branch_item_fix(XTTableHPtr XT_UNUSED(tab), XTIndexPtr XT_UNUSED(ind), XTIdxBranchDPtr branch, register XTIdxResultRec *result)

=== modified file 'src/myxt_xt.cc'
--- src/myxt_xt.cc	2009-09-23 07:53:51 +0000
+++ src/myxt_xt.cc	2009-10-16 20:20:23 +0000
@@ -2811,8 +2811,10 @@
 
 static char *my_type_to_string(XTThreadPtr self, Field *field, TABLE *XT_UNUSED(my_tab))
 {
-	char		buffer[MAX_FIELD_WIDTH + 400], *ptr;
+	char		buffer[MAX_FIELD_WIDTH + 400];
+	const char 	*ptr;
 	String		type((char *) buffer, sizeof(buffer), system_charset_info);
+	xtWord4		len;
 
 	/* GOTCHA:
 	 * - Above sets the string length to the same as the buffer,
@@ -2823,10 +2825,17 @@
 	 */
 	type.length(0);
 	field->sql_type(type);
-	ptr = type.c_ptr();
+	ptr = type.ptr();
+	len = type.length();
+
+	if (len >= sizeof(buffer))
+		len = sizeof(buffer)-1;
+
 	if (ptr != buffer)
-		xt_strcpy(sizeof(buffer), buffer, ptr);			
+		xt_strcpy(sizeof(buffer), buffer, ptr);
 
+	buffer[len] = 0;
+			
 	if (field->has_charset()) {
 		/* Always include the charset so that we can compare types
 		 * for FK/PK releations.

=== modified file 'src/xactlog_xt.cc'
--- src/xactlog_xt.cc	2009-09-08 10:52:24 +0000
+++ src/xactlog_xt.cc	2009-10-16 20:20:23 +0000
@@ -1108,6 +1108,9 @@
 		if ((part_size = xl_write_buf_pos % 512)) {
 			part_size = 512 - part_size;
 			xl_write_buffer[xl_write_buf_pos] = XT_LOG_ENT_END_OF_LOG;
+#ifdef HAVE_valgrind
+			memset(xl_write_buffer + xl_write_buf_pos + 1, 0x66, part_size);
+#endif
 			if (!xt_pwrite_file(xl_log_file, xl_write_log_offset, xl_write_buf_pos+part_size, xl_write_buffer, &thread->st_statistics.st_xlog, thread))
 				goto write_failed;			
 		}