1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Backport

Browse Source 
Bug #11764313 57135: CRASH IN ITEM_FUNC_CASE::FIND_ITEM WITH CASE WHEN
Bug #11764818 57692: Crash in item_func_in::val_int() with ZEROFILL
This commit is contained in:
Tor Didriksen 2012-09-25 16:03:05 +02:00
parent 862fc0f51a
commit abdb79062e
1 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
sql/item_cmpfunc.cc
View File

@ -1,4 +1,4 @@
/* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
/* Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@ -3045,6 +3045,15 @@ void Item_func_case::fix_length_and_dec()
return;
}
}
/*
Set cmp_context of all WHEN arguments. This prevents
Item_field::equal_fields_propagator() from transforming a
zerofill argument into a string constant. Such a change would
require rebuilding cmp_items.
*/
for (i= 0; i < ncases; i+= 2)
args[i]->cmp_context= item_cmp_type(left_result_type,
args[i]->result_type());
}
if (else_expr_num == -1 || args[else_expr_num]->maybe_null)
@ -4032,6 +4041,16 @@ void Item_func_in::fix_length_and_dec()
}
}
}
/*
Set cmp_context of all arguments. This prevents
Item_field::equal_fields_propagator() from transforming a zerofill integer
argument into a string constant. Such a change would require rebuilding
cmp_itmes.
*/
for (arg= args + 1, arg_end= args + arg_count; arg != arg_end ; arg++)
{
arg[0]->cmp_context= item_cmp_type(left_result_type, arg[0]->result_type());
}
max_length= 1;
}