1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixed LP bug #798621.

Browse Source 
The patch for bugs 717577 and 724942 has missed to make adjustments for the
call item_equal->add_const(const_item, orig_field_item) in the function
check_simple_equality that builds multiple equality for a field and a constant.
As a result, when this field happens to be a view field and the corresponding
Item_field object F is wrapped in an Item_direct_view_ref object R the object
F is placed in the multiple equality instead of the object R.
A substitution of an equal item for F potentially can cause very serious
problems and in some cases can lead to crashes of the server.
This commit is contained in:
Igor Babaev 2011-06-21 18:00:58 -07:00
parent 44570d2b12
commit e7578ac612
3 changed files with 46 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
mysql-test/r/view.result
View File

@ -4184,3 +4184,26 @@ DELETE FROM v3;
ERROR HY000: The target table v3 of the DELETE is not updatable
DROP VIEW v1,v2,v3;
DROP TABLE t1;
#
# Bug#798621: crash with a view string field equal
# to a constant
#
CREATE TABLE t1 (a varchar(32), b int) ;
INSERT INTO t1 VALUES ('j', NULL), ('c', 8), ('c', 1);
CREATE VIEW v1 AS SELECT * FROM t1;
CREATE TABLE t2 (a varchar(32)) ;
INSERT INTO t2 VALUES ('j'), ('c');
SELECT * FROM v1 LEFT JOIN t2 ON t2.a = v1.a
WHERE v1.b = 1 OR v1.a = 'a' AND LENGTH(v1.a) >= v1.b;
a b a
c 1 c
EXPLAIN EXTENDED
SELECT * FROM v1 LEFT JOIN t2 ON t2.a = v1.a
WHERE v1.b = 1 OR v1.a = 'a' AND LENGTH(v1.a) >= v1.b;
id select_type table type possible_keys key key_len ref rows filtered Extra
1 SIMPLE t1 ALL NULL NULL NULL NULL 3 100.00 Using where
1 SIMPLE t2 ALL NULL NULL NULL NULL 2 100.00 Using where
Warnings:
Note 1003 select `test`.`t1`.`a` AS `a`,`test`.`t1`.`b` AS `b`,`test`.`t2`.`a` AS `a` from `test`.`t1` left join `test`.`t2` on((`test`.`t2`.`a` = `test`.`t1`.`a`)) where ((`test`.`t1`.`b` = 1) or ((`test`.`t1`.`a` = 'a') and (length(`test`.`t1`.`a`) >= `test`.`t1`.`b`)))
DROP VIEW v1;
DROP TABLE t1,t2;

21
mysql-test/t/view.test
View File

@ -4134,3 +4134,24 @@ DELETE FROM v3;
DROP VIEW v1,v2,v3;
DROP TABLE t1;
--echo #
--echo # Bug#798621: crash with a view string field equal
--echo # to a constant
--echo #
CREATE TABLE t1 (a varchar(32), b int) ;
INSERT INTO t1 VALUES ('j', NULL), ('c', 8), ('c', 1);
CREATE VIEW v1 AS SELECT * FROM t1;
CREATE TABLE t2 (a varchar(32)) ;
INSERT INTO t2 VALUES ('j'), ('c');
SELECT * FROM v1 LEFT JOIN t2 ON t2.a = v1.a
WHERE v1.b = 1 OR v1.a = 'a' AND LENGTH(v1.a) >= v1.b;
EXPLAIN EXTENDED
SELECT * FROM v1 LEFT JOIN t2 ON t2.a = v1.a
WHERE v1.b = 1 OR v1.a = 'a' AND LENGTH(v1.a) >= v1.b;
DROP VIEW v1;
DROP TABLE t1,t2;

4
sql/sql_select.cc
View File

@ -10334,7 +10334,7 @@ static bool check_simple_equality(Item *left_item, Item *right_item,
!((Item_field*)left_item)->get_depended_from() &&
right_item->const_item() && !right_item->is_expensive())
{
orig_field_item= left_item;
orig_field_item= orig_left_item;
field_item= (Item_field *) left_item;
const_item= right_item;
}
@ -10342,7 +10342,7 @@ static bool check_simple_equality(Item *left_item, Item *right_item,
!((Item_field*)right_item)->get_depended_from() &&
left_item->const_item() && !left_item->is_expensive())
{
orig_field_item= right_item;
orig_field_item= orig_right_item;
field_item= (Item_field *) right_item;
const_item= left_item;
}