1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MDEV-7339 Server crashes in Item_func_trig_cond::val_int

Browse Source 
Item_in_subselect::pushed_cond_guards[] array is allocated only when
left_expr->maybe_null. And it is used (for row expressions) when
left_expr->element_index(i)->maybe_null.

For left_expr being a multi-column subquery, its maybe_null is
always false when the subquery doesn't use tables (see
Item_singlerow_subselect::fix_length_and_dec()
and subselect_single_select_engine::fix_length_and_dec()),
otherwise it's always true.

But row elements can be NULL regardless, so let's always allocate
pushed_cond_guards for multi-column subqueries, no matter whether
its maybe_null was forced to true or false.
This commit is contained in:
Sergei Golubchik 2017-07-12 08:05:42 +02:00
parent f305a7ce4b
commit c5975eaea1
3 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
mysql-test/r/subselect_nulls.result
View File

@ -115,3 +115,9 @@ k d1 d2
set optimizer_switch= @tmp_subselect_nulls;
drop table x1;
drop table x2;
select (select 1, 2) in (select 3, 4);
(select 1, 2) in (select 3, 4)
0
select (select NULL, NULL) in (select 3, 4);
(select NULL, NULL) in (select 3, 4)
NULL

6
mysql-test/t/subselect_nulls.test
View File

@ -97,3 +97,9 @@ set optimizer_switch= @tmp_subselect_nulls;
drop table x1;
drop table x2;
#
# MDEV-7339 Server crashes in Item_func_trig_cond::val_int
#
select (select 1, 2) in (select 3, 4);
select (select NULL, NULL) in (select 3, 4);

3
sql/item_subselect.cc
View File

@ -2871,7 +2871,8 @@ bool Item_in_subselect::init_cond_guards()
{
DBUG_ASSERT(thd);
uint cols_num= left_expr->cols();
if (!abort_on_null && left_expr->maybe_null && !pushed_cond_guards)
if (!abort_on_null && !pushed_cond_guards &&
(left_expr->maybe_null || cols_num > 1))
{
if (!(pushed_cond_guards= (bool*)thd->alloc(sizeof(bool) * cols_num)))
return TRUE;