diff --git a/mysql-test/main/type_timestamp.result b/mysql-test/main/type_timestamp.result index b01f37ba125..2e797cb2b42 100644 --- a/mysql-test/main/type_timestamp.result +++ b/mysql-test/main/type_timestamp.result @@ -2207,5 +2207,17 @@ Warnings: Note 1003 select `test`.`t1`.`a` AS `a` from `test`.`t1` where `test`.`t1`.`a` >= TIMESTAMP/*WITH LOCAL TIME ZONE*/'2024-01-01 00:00:00.000000' DROP TABLE t1; # +# MDEV-34085 Server crash ASAN used-after-poison upon 2nd execution of PS with erroneous timestamp conversion +# +CREATE TABLE t1 (a int, b timestamp); +INSERT INTO t1 VALUES (1,'2000-01-01'),(2,'2001-12-31'); +PREPARE stmt FROM 'UPDATE t1 SET a = 0 WHERE 1 IN (SELECT b FROM t1)'; +EXECUTE stmt; +ERROR 22007: Truncated incorrect datetime value: '1' +EXECUTE stmt; +ERROR 22007: Truncated incorrect datetime value: '1' +DEALLOCATE PREPARE stmt; +DROP TABLE t1; +# # End of 11.3 tests # diff --git a/mysql-test/main/type_timestamp.test b/mysql-test/main/type_timestamp.test index c39965b0c42..1b362251d76 100644 --- a/mysql-test/main/type_timestamp.test +++ b/mysql-test/main/type_timestamp.test @@ -1255,6 +1255,21 @@ EXPLAIN EXTENDED SELECT * FROM t1 WHERE YEAR(a) >= 2024; DROP TABLE t1; +--echo # +--echo # MDEV-34085 Server crash ASAN used-after-poison upon 2nd execution of PS with erroneous timestamp conversion +--echo # + +CREATE TABLE t1 (a int, b timestamp); +INSERT INTO t1 VALUES (1,'2000-01-01'),(2,'2001-12-31'); +PREPARE stmt FROM 'UPDATE t1 SET a = 0 WHERE 1 IN (SELECT b FROM t1)'; +--error ER_TRUNCATED_WRONG_VALUE +EXECUTE stmt; +--error ER_TRUNCATED_WRONG_VALUE +EXECUTE stmt; +DEALLOCATE PREPARE stmt; +DROP TABLE t1; + + --echo # --echo # End of 11.3 tests --echo # diff --git a/sql/sql_type.cc b/sql/sql_type.cc index bd807db4bf7..4e78dab6e4a 100644 --- a/sql/sql_type.cc +++ b/sql/sql_type.cc @@ -7776,7 +7776,7 @@ Type_handler_datetime_common::convert_item_for_comparison( Sql_condition **cond_hdl) { hit++; - return *level == Sql_condition::WARN_LEVEL_WARN; + return *level >= Sql_condition::WARN_LEVEL_WARN; } } cnt_handler;