1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bug #23279858: MYSQLD GOT SIGNAL 11 ON SIMPLE SELECT

Browse Source 
NAME_CONST QUERY

ISSUE:
------
Using NAME_CONST with a non-constant negated expression as
value can result in incorrect behavior.

SOLUTION:
---------
The problem can be avoided by checking whether the argument
is a constant value.

The fix is a backport of Bug#12735545.
This commit is contained in:
Sreeharsha Ramanavarapu 2016-05-24 07:44:21 +05:30
parent 4de9d9c261
commit 115f08284d
3 changed files with 24 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
mysql-test/r/func_misc.result
View File

@ -403,3 +403,10 @@ DROP TABLE t1;
#
# End of tests
#
SELECT NAME_CONST('a', -(1 OR 2)) OR 1;
ERROR HY000: Incorrect arguments to NAME_CONST
SELECT NAME_CONST('a', -(1 AND 2)) OR 1;
ERROR HY000: Incorrect arguments to NAME_CONST
SELECT NAME_CONST('a', -(1)) OR 1;
NAME_CONST('a', -(1)) OR 1
1

10
mysql-test/t/func_misc.test
View File

@ -544,3 +544,13 @@ DROP TABLE t1;
--echo #
--echo # End of tests
--echo #
#
# Bug#12735545 - PARSER STACK OVERFLOW WITH NAME_CONST
# CONTAINING OR EXPRESSION
#
--error ER_WRONG_ARGUMENTS
SELECT NAME_CONST('a', -(1 OR 2)) OR 1;
--error ER_WRONG_ARGUMENTS
SELECT NAME_CONST('a', -(1 AND 2)) OR 1;
SELECT NAME_CONST('a', -(1)) OR 1;

9
sql/item.cc
View File

@ -1358,6 +1358,11 @@ bool Item_name_const::is_null()
Item_name_const::Item_name_const(Item *name_arg, Item *val):
value_item(val), name_item(name_arg)
{
/*
The value argument to NAME_CONST can only be a literal constant. Some extra
tests are needed to support a collation specificer and to handle negative
values.
*/
if (!(valid_args= name_item->basic_const_item() &&
(value_item->basic_const_item() ||
((value_item->type() == FUNC_ITEM) &&
@ -1365,8 +1370,8 @@ Item_name_const::Item_name_const(Item *name_arg, Item *val):
Item_func::COLLATE_FUNC) ||
((((Item_func *) value_item)->functype() ==
Item_func::NEG_FUNC) &&
(((Item_func *) value_item)->key_item()->type() !=
FUNC_ITEM)))))))
(((Item_func *)
value_item)->key_item()->basic_const_item())))))))
my_error(ER_WRONG_ARGUMENTS, MYF(0), "NAME_CONST");
Item::maybe_null= TRUE;
}