1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge mysql.com:/usr/local/bk/mysql-5.0

Browse Source 
into  mysql.com:/usr/home/pem/bug13941/mysql-5.0
This commit is contained in:
unknown 2005-10-21 13:24:41 +02:00
commit 0cd95ca6b8
3 changed files with 88 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
mysql-test/r/sp.result
View File

@ -3504,4 +3504,32 @@ drop procedure bug7049_5|
drop procedure bug7049_6|
drop function bug7049_1|
drop function bug7049_2|
drop function if exists bug13941|
drop procedure if exists bug13941|
create function bug13941(p_input_str text)
returns text
begin
declare p_output_str text;
set p_output_str = p_input_str;
set p_output_str = replace(p_output_str, 'xyzzy', 'plugh');
set p_output_str = replace(p_output_str, 'test', 'prova');
set p_output_str = replace(p_output_str, 'this', 'questo');
set p_output_str = replace(p_output_str, ' a ', 'una ');
set p_output_str = replace(p_output_str, 'is', '');
return p_output_str;
end|
create procedure bug13941(out sout varchar(128))
begin
set sout = 'Local';
set sout = ifnull(sout, 'DEF');
end|
select bug13941('this is a test')|
bug13941('this is a test')
questo una prova
call bug13941(@a)|
select @a|
@a
Local
drop function bug13941|
drop procedure bug13941|
drop table t1,t2;

43
mysql-test/t/sp.test
View File

@ -4390,6 +4390,49 @@ drop function bug7049_1|
drop function bug7049_2|
#
# BUG#13941: replace() string fuction behaves badly inside stored procedure
# (BUG#13914: IFNULL is returning garbage in stored procedure)
#
--disable_warnings
drop function if exists bug13941|
drop procedure if exists bug13941|
--enable_warnings
create function bug13941(p_input_str text)
returns text
begin
declare p_output_str text;
set p_output_str = p_input_str;
set p_output_str = replace(p_output_str, 'xyzzy', 'plugh');
set p_output_str = replace(p_output_str, 'test', 'prova');
set p_output_str = replace(p_output_str, 'this', 'questo');
set p_output_str = replace(p_output_str, ' a ', 'una ');
set p_output_str = replace(p_output_str, 'is', '');
return p_output_str;
end|
create procedure bug13941(out sout varchar(128))
begin
set sout = 'Local';
set sout = ifnull(sout, 'DEF');
end|
# Note: The bug showed different behaviour in different types of builds,
# giving garbage results in some, and seemingly working in others.
# Running with valgrind (or purify) is the safe way to check that it's
# really working correctly.
select bug13941('this is a test')|
call bug13941(@a)|
select @a|
drop function bug13941|
drop procedure bug13941|
#
# BUG#NNNN: New bug synopsis
#

18
sql/sp_head.cc
View File

@ -293,6 +293,22 @@ sp_eval_func_item(THD *thd, Item **it_addr, enum enum_field_types type,
if (it == reuse)
DBUG_RETURN(it);
/*
For some functions, 's' is now pointing to an argument of the
function, which might be a local variable that is to be reused.
In this case, new(reuse, &rsize) below will call the destructor
and 's' ends up pointing to freed memory.
A somewhat ugly fix is to simply copy the string to our local one
(which is unused by most functions anyway), but only if 's' is
pointing somewhere else than to 'tmp' or 'it->str_value'.
*/
if (reuse && s != &tmp && s != &it->str_value)
{
if (tmp.copy((const String)(*s)))
DBUG_RETURN(NULL);
s= &tmp;
}
CREATE_ON_CALLERS_ARENA(it= new(reuse, &rsize)
Item_string(it->collation.collation),
use_callers_arena, &backup_arena);
@ -323,7 +339,7 @@ sp_eval_func_item(THD *thd, Item **it_addr, enum enum_field_types type,
return_null_item:
CREATE_ON_CALLERS_ARENA(it= new(reuse, &rsize) Item_null(),
use_callers_arena, &backup_arena);
use_callers_arena, &backup_arena);
end:
it->rsize= rsize;