1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Backport of bug #55564 to 5.0-security

Browse Source
This commit is contained in:
Georgi Kodinov 2010-12-03 16:56:36 +02:00
parent d85c305362
commit 5df7f9bc26
4 changed files with 46 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
mysql-test/r/user_var.result
View File

@ -378,4 +378,21 @@ FROM t1,t2 WHERE t1.f1 = t2.f1 ORDER BY t2.f1;
MIN(t2.f1) @bar:= (SELECT MIN(t3.f2) FROM t3 WHERE t3.f2 > foo) MIN(t2.f1) @bar:= (SELECT MIN(t3.f2) FROM t3 WHERE t3.f2 > foo)
10 NULL 10 NULL
DROP TABLE t1, t2, t3; DROP TABLE t1, t2, t3;
CREATE TABLE t1(a INT);
INSERT INTO t1 VALUES (0),(0);
# BUG#55615 : should not crash
SELECT (@a:=((SELECT @a:=1 FROM t1 LIMIT 1))) AND COUNT(1) FROM t1 GROUP BY @a;
(@a:=((SELECT @a:=1 FROM t1 LIMIT 1))) AND COUNT(1)
1
1
# BUG#55564 : should not crash
SELECT IF(
@v:=LEAST((SELECT 1 FROM t1 t2 LEFT JOIN t1 ON (@v) GROUP BY t1.a), a),
count(*), 1)
FROM t1 GROUP BY a LIMIT 1;
IF(
@v:=LEAST((SELECT 1 FROM t1 t2 LEFT JOIN t1 ON (@v) GROUP BY t1.a), a),
count(*), 1)
1
DROP TABLE t1;
End of 5.0 tests End of 5.0 tests

20
mysql-test/t/user_var.test
View File

@ -268,4 +268,24 @@ FROM t1,t2 WHERE t1.f1 = t2.f1 ORDER BY t2.f1;
DROP TABLE t1, t2, t3; DROP TABLE t1, t2, t3;
#
# Bug #55615: debug assertion after using variable in assignment and
# referred to
# Bug #55564: crash with user variables, assignments, joins...
#
CREATE TABLE t1(a INT);
INSERT INTO t1 VALUES (0),(0);
--echo # BUG#55615 : should not crash
SELECT (@a:=((SELECT @a:=1 FROM t1 LIMIT 1))) AND COUNT(1) FROM t1 GROUP BY @a;
--echo # BUG#55564 : should not crash
SELECT IF(
@v:=LEAST((SELECT 1 FROM t1 t2 LEFT JOIN t1 ON (@v) GROUP BY t1.a), a),
count(*), 1)
FROM t1 GROUP BY a LIMIT 1;
DROP TABLE t1;
--echo End of 5.0 tests --echo End of 5.0 tests

8
sql/item_func.cc
View File

@ -4303,6 +4303,14 @@ longlong Item_func_set_user_var::val_int_result()
return entry->val_int(&null_value); return entry->val_int(&null_value);
} }
bool Item_func_set_user_var::val_bool_result()
{
DBUG_ASSERT(fixed == 1);
check(TRUE);
update(); // Store expression
return entry->val_int(&null_value) != 0;
}
String *Item_func_set_user_var::str_result(String *str) String *Item_func_set_user_var::str_result(String *str)
{ {
DBUG_ASSERT(fixed == 1); DBUG_ASSERT(fixed == 1);

1
sql/item_func.h
View File

@ -1300,6 +1300,7 @@ public:
my_decimal *val_decimal(my_decimal *); my_decimal *val_decimal(my_decimal *);
double val_result(); double val_result();
longlong val_int_result(); longlong val_int_result();
bool val_bool_result();
String *str_result(String *str); String *str_result(String *str);
my_decimal *val_decimal_result(my_decimal *); my_decimal *val_decimal_result(my_decimal *);
bool is_null_result(); bool is_null_result();