1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MDEV-25346: JSON_TABLE: Server crashes in Item_field::fix_outer_field ...

Browse Source 
mysql_derived_prepare() sets Name_resolution_context::outer_context=NULL
for the WHERE clause's context.
Do the same for all ON expressions, too.
This commit is contained in:
Sergei Petrunia 2021-04-09 00:37:57 +03:00 committed by Alexey Botchkov
parent bd1d6ee4b1
commit 90629aa83c
3 changed files with 43 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
mysql-test/suite/json/r/json_table.result
View File

@ -704,6 +704,17 @@ RIGHT JOIN JSON_TABLE('[]', '$' COLUMNS(o3 FOR ORDINALITY)) AS jt3
ON(1)
WHERE 0;
ERROR 42S22: Unknown column 'jt1.a' in 'JSON_TABLE argument'
#
# MDEV-25346: JSON_TABLE: Server crashes in Item_field::fix_outer_field upon subquery with unknown column
#
CREATE TABLE t1 (a INT);
CREATE TABLE t2 (b INT);
SELECT * FROM ( SELECT * FROM t1 JOIN t2 ON (b IN(SELECT x FROM (SELECT 1 AS c) AS sq1))) AS sq2;
ERROR 42S22: Unknown column 'x' in 'field list'
DROP TABLE t1, t2;
#
# Another testcase
#
create table t1 (item_name varchar(32), item_props varchar(1024));
insert into t1 values ('Jeans', '{"color": ["green", "brown"], "price": 50}');
insert into t1 values ('Shirt', '{"color": ["blue", "white"], "price": 20}');

14
mysql-test/suite/json/t/json_table.test
View File

@ -601,6 +601,20 @@ JSON_TABLE('[]', '$' COLUMNS(a TEXT PATH '$[*]')) AS jt1
ON(1)
WHERE 0;
--echo #
--echo # MDEV-25346: JSON_TABLE: Server crashes in Item_field::fix_outer_field upon subquery with unknown column
--echo #
CREATE TABLE t1 (a INT);
CREATE TABLE t2 (b INT);
--error ER_BAD_FIELD_ERROR
SELECT * FROM ( SELECT * FROM t1 JOIN t2 ON (b IN(SELECT x FROM (SELECT 1 AS c) AS sq1))) AS sq2;
DROP TABLE t1, t2;
--echo #
--echo # Another testcase
--echo #
create table t1 (item_name varchar(32), item_props varchar(1024));
insert into t1 values ('Jeans', '{"color": ["green", "brown"], "price": 50}');
insert into t1 values ('Shirt', '{"color": ["blue", "white"], "price": 20}');

18
sql/sql_derived.cc
View File

@ -23,6 +23,7 @@
#include "mariadb.h" /* NO_EMBEDDED_ACCESS_CHECKS */
#include <functional>
#include "sql_priv.h"
#include "unireg.h"
#include "sql_derived.h"
@ -760,7 +761,24 @@ bool mysql_derived_prepare(THD *thd, LEX *lex, TABLE_LIST *derived)
/* prevent name resolving out of derived table */
for (SELECT_LEX *sl= first_select; sl; sl= sl->next_select())
{
// Prevent it for the WHERE clause
sl->context.outer_context= 0;
// And for ON clauses, if there are any
std::function<void(List<TABLE_LIST>&)> reset_context=
[&](List<TABLE_LIST> &join_list)
{
List_iterator<TABLE_LIST> li(join_list);
while (TABLE_LIST *table= li++)
{
if (table->on_context)
table->on_context->outer_context= NULL;
if (table->nested_join)
reset_context(table->nested_join->join_list);
}
};
reset_context(*sl->join_list);
if (!derived->is_with_table_recursive_reference() ||
(!derived->with->with_anchor &&
!derived->with->is_with_prepared_anchor()))