From 2c1345ab278962caf4902cc69a9517589a8afdbc Mon Sep 17 00:00:00 2001
From: Rex <rex.johnston@mariadb.com>
Date: Fri, 17 Nov 2023 13:33:07 +1200
Subject: [PATCH] MDEV-31995 Fix2 allocate memory in mem_root properly.

Lex_ident_sys had no new operator and was used incorrectly in
save_item_list_names(), so leaked memory.
---
 sql/sql_lex.cc | 5 +++--
 sql/sql_lex.h  | 9 +++++++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/sql/sql_lex.cc b/sql/sql_lex.cc
index 582494a0fd6..2e8bf40003e 100644
--- a/sql/sql_lex.cc
+++ b/sql/sql_lex.cc
@@ -10697,8 +10697,9 @@ bool st_select_lex::save_item_list_names(THD *thd)
 
   while ((item= li++))
   {
-    if (unlikely(orig_names_of_item_list_elems->push_back(
-          new Lex_ident_sys(item->name.str, item->name.length), thd->mem_root)))
+    Lex_ident_sys *name= new (thd->mem_root) Lex_ident_sys(thd, &item->name);
+    if (unlikely(!name ||
+          orig_names_of_item_list_elems->push_back(name,  thd->mem_root)))
     {
       if (arena)
         thd->restore_active_arena(arena, &backup);
diff --git a/sql/sql_lex.h b/sql/sql_lex.h
index 97be0571903..0f2e096fdc6 100644
--- a/sql/sql_lex.h
+++ b/sql/sql_lex.h
@@ -143,6 +143,11 @@ public:
 struct Lex_ident_sys_st: public LEX_CSTRING
 {
 public:
+  static void *operator new(size_t size, MEM_ROOT *mem_root) throw ()
+  { return alloc_root(mem_root, size); }
+  static void operator delete(void *ptr,size_t size) { TRASH_FREE(ptr, size); }
+  static void operator delete(void *ptr, MEM_ROOT *mem_root) {}
+
   bool copy_ident_cli(THD *thd, const Lex_ident_cli_st *str);
   bool copy_keyword(THD *thd, const Lex_ident_cli_st *str);
   bool copy_sys(THD *thd, const LEX_CSTRING *str);
@@ -176,6 +181,10 @@ public:
     LEX_CSTRING tmp= {name, length};
     set_valid_utf8(&tmp);
   }
+  Lex_ident_sys(THD *thd, const LEX_CSTRING *str)
+  {
+    set_valid_utf8(str);
+  }
   Lex_ident_sys & operator=(const Lex_ident_sys_st &name)
   {
     Lex_ident_sys_st::operator=(name);