1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MDEV-35975 Server crashes after CREATE VIEW as SELECT ST_COLLECT...

Browse Source 
Ensure that orig_args is populated during Item_func_collect::fix_fields_impl
This commit is contained in:
Dave Gosselin 2025-01-29 16:46:24 -05:00 committed by Dave Gosselin
parent b93e8c1556
commit d5cb996270
3 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
mysql-test/main/spatial_utility_function_collect.result
View File

@ -135,3 +135,10 @@ tb1 CREATE TABLE `tb1` (
`(ST_collect(( POINTFROMTEXT(' POINT( 4 1 ) ') )) )` geometry DEFAULT NULL
) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
DROP TABLE tb1;
#
# MDEV-35975 Server crashes after CREATE VIEW as SELECT ST_COLLECT
#
create view v1 as SELECT ST_COLLECT(ST_GEOMFROMTEXT('POINT(0 0)'));
drop view v1;
create view v1 as SELECT GROUP_CONCAT(ST_GEOMFROMTEXT('POINT(0 0)'));
drop view v1;

8
mysql-test/main/spatial_utility_function_collect.test
View File

@ -197,3 +197,11 @@ SELECT ST_astext(ST_collect(( POINTFROMTEXT(' POINT( 4 1 ) ') )));
CREATE TABLE tb1 AS SELECT (ST_collect(( POINTFROMTEXT(' POINT( 4 1 ) ') )) );
SHOW CREATE TABLE tb1;
DROP TABLE tb1;
--echo #
--echo # MDEV-35975 Server crashes after CREATE VIEW as SELECT ST_COLLECT
--echo #
create view v1 as SELECT ST_COLLECT(ST_GEOMFROMTEXT('POINT(0 0)'));
drop view v1;
create view v1 as SELECT GROUP_CONCAT(ST_GEOMFROMTEXT('POINT(0 0)'));
drop view v1;

5
sql/item_sum.cc
View File

@ -3553,6 +3553,9 @@ Item_sum_str::fix_fields(THD *thd, Item **ref)
if (check_sum_func(thd, ref))
return TRUE;
if (arg_count)
memcpy (orig_args, args, sizeof (Item *) * arg_count);
base_flags|= item_base_t::FIXED;
return FALSE;
}
@ -3988,8 +3991,6 @@ Item_func_group_concat(THD *thd, Name_resolution_context *context_arg,
/* orig_args is only used for print() */
orig_args= (Item**) (order + arg_count_order);
if (arg_count)
memcpy(orig_args, args, sizeof(Item*) * arg_count);
if (limit_clause)
{
row_limit= row_limit_arg;