1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bug#38291 memory corruption and server crash with view/sp/function

Browse Source 
Send_field.org_col_name has broken value on secondary execution.
It happens when result field is created from the field which belongs to view
due to forgotten assignment of some Send_field attributes. 
The fix:
set Send_field.org_col_name,org_table_name with correct value during Send_field intialization.

mysql-test/r/metadata.result:
  result fix
  The result file was changed because now forgotten attributes are properly set.
mysql-test/r/sp.result:
  test result
mysql-test/t/sp.test:
  test case
sql/item.cc:
  Send_field.org_col_name has broken value on secondary execution.
  It happens when result field is created from the field which belongs to view
  due to forgotten assignment of some Send_field attributes. 
  The fix:
  set Send_field.org_col_name,org_table_name with correct value during Send_field intialization.
tests/mysql_client_test.c:
  test case fix
  The test was changed because now forgotten attributes are properly set.
This commit is contained in:
Sergey Glukhov 2008-08-20 14:49:28 +05:00
parent 40bd9a4218
commit de73b72954
5 changed files with 51 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
mysql-test/r/metadata.result
View File

@ -108,11 +108,11 @@ id
1
select * from v1 group by id limit 0;
Catalog Database Table Table_alias Column Column_alias Type Length Max length Is_null Flags Decimals Charsetnr
def test t1 v1 id id 3 10 0 Y 32768 0 63
def test v1 v1 id id 3 10 0 Y 32768 0 63
id
select * from v1 where id=1000 group by id;
Catalog Database Table Table_alias Column Column_alias Type Length Max length Is_null Flags Decimals Charsetnr
def test t1 v1 id id 3 10 0 Y 32768 0 63
def test v1 v1 id id 3 10 0 Y 32768 0 63
id
select * from v1 where id=1 group by id;
Catalog Database Table Table_alias Column Column_alias Type Length Max length Is_null Flags Decimals Charsetnr
@ -126,7 +126,7 @@ renamed
1
select * from v3 where renamed=1 group by renamed;
Catalog Database Table Table_alias Column Column_alias Type Length Max length Is_null Flags Decimals Charsetnr
def v3 renamed 8 12 0 Y 32896 0 63
def v3 v3 renamed renamed 8 12 0 Y 32896 0 63
renamed
drop table t1;
drop view v1,v2,v3;
@ -156,8 +156,8 @@ c1
3
SELECT v1.c1, v2.c2 FROM v1 JOIN v2 ON c1=c2;
Catalog Database Table Table_alias Column Column_alias Type Length Max length Is_null Flags Decimals Charsetnr
def test t1 v1 c1 c1 254 1 1 Y 0 0 8
def test t2 v2 c2 c2 254 1 1 Y 0 0 8
def test v1 v1 c1 c1 254 1 1 Y 0 0 8
def test v2 v2 c2 c2 254 1 1 Y 0 0 8
c1 c2
1 1
2 2

16
mysql-test/r/sp.result
View File

@ -6646,6 +6646,22 @@ ttt
2
drop function func30787;
drop table t1;
create table t1(c1 INT);
create function f1(p1 int) returns varchar(32)
return 'aaa';
create view v1 as select f1(c1) as parent_control_name from t1;
create procedure p1()
begin
select parent_control_name as c1 from v1;
end //
call p1();
c1
call p1();
c1
drop procedure p1;
drop function f1;
drop view v1;
drop table t1;
# ------------------------------------------------------------------
# -- End of 5.0 tests
# ------------------------------------------------------------------

24
mysql-test/t/sp.test
View File

@ -7794,6 +7794,30 @@ drop function func30787;
drop table t1;
#
# Bug#38291 memory corruption and server crash with view/sp/function
#
create table t1(c1 INT);
create function f1(p1 int) returns varchar(32)
return 'aaa';
create view v1 as select f1(c1) as parent_control_name from t1;
delimiter //;
create procedure p1()
begin
select parent_control_name as c1 from v1;
end //
delimiter ;//
call p1();
call p1();
drop procedure p1;
drop function f1;
drop view v1;
drop table t1;
--echo # ------------------------------------------------------------------
--echo # -- End of 5.0 tests
--echo # ------------------------------------------------------------------

4
sql/item.cc
View File

@ -5764,6 +5764,10 @@ void Item_ref::make_field(Send_field *field)
field->table_name= table_name;
if (db_name)
field->db_name= db_name;
if (orig_field_name)
field->org_col_name= orig_field_name;
if (orig_table_name)
field->org_table_name= orig_table_name;
}

4
tests/mysql_client_test.c
View File

@ -16162,7 +16162,7 @@ static void test_bug32265()
metadata= mysql_stmt_result_metadata(stmt);
field= mysql_fetch_field(metadata);
DIE_UNLESS(strcmp(field->table, "v1") == 0);
DIE_UNLESS(strcmp(field->org_table, "t1") == 0);
DIE_UNLESS(strcmp(field->org_table, "v1") == 0);
DIE_UNLESS(strcmp(field->db, "client_test_db") == 0);
mysql_free_result(metadata);
mysql_stmt_close(stmt);
@ -16174,7 +16174,7 @@ static void test_bug32265()
metadata= mysql_stmt_result_metadata(stmt);
field= mysql_fetch_field(metadata);
DIE_UNLESS(strcmp(field->table, "v1") == 0);
DIE_UNLESS(strcmp(field->org_table, "t1") == 0);
DIE_UNLESS(strcmp(field->org_table, "v1") == 0);
DIE_UNLESS(strcmp(field->db, "client_test_db") == 0);
mysql_free_result(metadata);
mysql_stmt_close(stmt);