1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #27362: crash at evaluation of IN predicate when one

Browse Source 
of its argument happened to be a decimal expression returning
the NULL value.
The crash was due to the fact the function in_decimal::set did
not take into account that val_decimal() could return 0 if 
the decimal expression had been evaluated to NULL.
This commit is contained in:
igor@olga.mysql.com 2007-03-22 00:05:36 -07:00
parent e2c9c9cc20
commit 03ae298ec3
3 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
mysql-test/r/func_in.result
View File

@ -470,4 +470,9 @@ a
Warnings: Warnings:
Warning 1292 Incorrect date value: '19772-07-29' for column 'a' at row 1 Warning 1292 Incorrect date value: '19772-07-29' for column 'a' at row 1
DROP TABLE t1,t2,t3,t4; DROP TABLE t1,t2,t3,t4;
CREATE TABLE t1 (id int not null);
INSERT INTO t1 VALUES (1),(2);
SELECT id FROM t1 WHERE id IN(4564, (SELECT IF(1=0,1,1/0)) );
id
DROP TABLE t1;
End of 5.0 tests End of 5.0 tests

11
mysql-test/t/func_in.test
View File

@ -360,4 +360,15 @@ SELECT * FROM t4 WHERE a IN ('1972-02-06','19772-07-29');
DROP TABLE t1,t2,t3,t4; DROP TABLE t1,t2,t3,t4;
#
# BUG#27362: IN with a decimal expression that may return NULL
#
CREATE TABLE t1 (id int not null);
INSERT INTO t1 VALUES (1),(2);
SELECT id FROM t1 WHERE id IN(4564, (SELECT IF(1=0,1,1/0)) );
DROP TABLE t1;
--echo End of 5.0 tests --echo End of 5.0 tests

3
sql/item_cmpfunc.cc
View File

@ -2423,7 +2423,8 @@ void in_decimal::set(uint pos, Item *item)
dec->len= DECIMAL_BUFF_LENGTH; dec->len= DECIMAL_BUFF_LENGTH;
dec->fix_buffer_pointer(); dec->fix_buffer_pointer();
my_decimal *res= item->val_decimal(dec); my_decimal *res= item->val_decimal(dec);
if (res != dec) /* if item->val_decimal() is evaluated to NULL then res == 0 */
if (!item->null_value && res != dec)
my_decimal2decimal(res, dec); my_decimal2decimal(res, dec);
} }