MDEV-33245 SIGSEGV in wsrep_check_sequence

The segfault in wsrep_check_sequence is due to a
null pointer deference on:
  db_type= thd->lex->create_info.db_type->db_type;

Where create_info.db_type is null. This occured under
a used_engine==true condition which is set in the calling
function based on create_info.used_fields==HA_CREATE_USED_ENGINE.

However the create_info.used_fields was a left over
from the parsing of the previous failed CREATE TABLE where
because of its failure, db_type wasn't populated.

This is corrected by cleaning the create_info when we start
to parse ALTER SEQUENCE statements.

Other paths to wsrep_check_sequence is via CREATE SEQUENCE
and CREATE TABLE LIKE which both initialize the create_info
correctly.
This commit is contained in:
Daniel Black 2024-12-06 11:35:58 +11:00
parent ee287821e3
commit 7181ea5663
3 changed files with 27 additions and 0 deletions

View File

@ -314,3 +314,14 @@ NEXTVAL(t)
connection node_1;
DROP TABLE t1;
DROP SEQUENCE t;
MDEV-33245 SIGSEGV in wsrep_check_sequence | Sql_cmd_alter_sequence::execute
CREATE TABLE t (a INT) ENGINE=InnoDB;
INSERT INTO t VALUES (0);
CREATE TABLE t1 (c VARCHAR) ENGINE=InnoDB;
ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ') ENGINE=InnoDB' at line 1
ALTER SEQUENCE IF EXISTS t MINVALUE=1;
ERROR 42000: This version of MariaDB doesn't yet support 'CACHE without INCREMENT BY 0 in Galera cluster'
DROP TABLE t;
End of 10.5 tests

View File

@ -341,3 +341,18 @@ SELECT NEXTVAL(t);
--connection node_1
DROP TABLE t1;
DROP SEQUENCE t;
--echo
--echo MDEV-33245 SIGSEGV in wsrep_check_sequence | Sql_cmd_alter_sequence::execute
--echo
CREATE TABLE t (a INT) ENGINE=InnoDB;
INSERT INTO t VALUES (0);
--error ER_PARSE_ERROR
CREATE TABLE t1 (c VARCHAR) ENGINE=InnoDB;
--error ER_NOT_SUPPORTED_YET
ALTER SEQUENCE IF EXISTS t MINVALUE=1;
DROP TABLE t;
--echo End of 10.5 tests

View File

@ -7472,6 +7472,7 @@ alter:
{
LEX *lex= Lex;
lex->sql_command= SQLCOM_ALTER_SEQUENCE;
lex->create_info.init();
DBUG_ASSERT(!lex->m_sql_cmd);
if (Lex->main_select_push())
MYSQL_YYABORT;