1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MDEV-9208: Function->Function->View = Mysqld segfault (Server crashes in Dependency_marker::visit_field on 2nd execution with merged subquery)

Browse Source 
Prevent crossing name resolution border in finding item tables.
This commit is contained in:
Oleksandr Byelkin 2016-12-19 22:03:28 +01:00
parent 991b9ee735
commit a4868c3509
3 changed files with 61 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
mysql-test/r/ps.result
View File

@ -4173,4 +4173,34 @@ Warnings:
Note 1003 select `test`.`t1`.`id` AS `id`,`test`.`t1`.`c` AS `c` from `test`.`t1` where 0
deallocate prepare stmt2;
drop table t1;
#
# MDEV-9208: Function->Function->View = Mysqld segfault
# (Server crashes in Dependency_marker::visit_field on 2nd
# execution with merged subquery)
#
CREATE TABLE t1 (i1 INT);
insert into t1 values(1),(2);
CREATE TABLE t2 (i2 INT);
insert into t2 values(1),(2);
prepare stmt from "
select 1 from (
select
if (i1<0, 0, 0) as f1,
(select f1) as f2
from t1, t2
) sq
";
execute stmt;
1
1
1
1
1
execute stmt;
1
1
1
1
1
drop table t1,t2;
# End of 5.5 tests

26
mysql-test/t/ps.test
View File

@ -3714,4 +3714,30 @@ deallocate prepare stmt2;
drop table t1;
--echo #
--echo # MDEV-9208: Function->Function->View = Mysqld segfault
--echo # (Server crashes in Dependency_marker::visit_field on 2nd
--echo # execution with merged subquery)
--echo #
CREATE TABLE t1 (i1 INT);
insert into t1 values(1),(2);
CREATE TABLE t2 (i2 INT);
insert into t2 values(1),(2);
prepare stmt from "
select 1 from (
select
if (i1<0, 0, 0) as f1,
(select f1) as f2
from t1, t2
) sq
";
execute stmt;
execute stmt;
drop table t1,t2;
--echo # End of 5.5 tests

6
sql/item.cc
View File

@ -6876,7 +6876,11 @@ public:
// Find which select the field is in. This is achieved by walking up
// the select tree and looking for the table of interest.
st_select_lex *sel;
for (sel= current_select; sel; sel= sel->outer_select())
for (sel= current_select;
sel ;
sel= (sel->context.outer_context ?
sel->context.outer_context->select_lex:
NULL))
{
List_iterator<TABLE_LIST> li(sel->leaf_tables);
TABLE_LIST *tbl;