1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bug#20755389 SERVER CRASHES IN ITEM_FUNC_GROUP_CONCAT::FIX_FIELDS ON

Browse Source 
2ND EXECUTION OF PS

Description:
------------
When MySQL calls 'EXECUTE stmt' firstly to deal with ORDER BY clause which is
similar with 'ORDER BY 1,(t2a.f2+1)' in find_order_in_list(), it believes the
first expression is a position, the function replaces the pointer of the first
expression with Item_field object associated with a temporary table field,
then releases it after the end of the execution, that behavior destroys the
pointer of first expression.

After that, when MySQL calls 'EXECUTE stmt' once more, the first expression
points to an invalid pointer, so it crashed.

Fix:
----
If an item of ORDER clause is a location, reset 'args' with a original value.
This commit is contained in:
Chaithra Gopalareddy 2015-11-02 16:30:57 +05:30
parent 1942506b82
commit 9b6ac73419
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sql/item_sum.cc
View File

@ -3184,7 +3184,9 @@ void Item_func_group_concat::cleanup()
ORDER **order_ptr= order;
for (uint i= 0; i < arg_count_order; i++)
{
(*order_ptr)->item= &args[arg_count_field + i];
if ((*order_ptr)->counter_used)
args[arg_count_field + i]= (*order_ptr)->item_ptr;
order_ptr++;
}
DBUG_VOID_RETURN;