database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

MDEV-28402 ASAN heap-use-after-free in create_tmp_table, Assertion `l_offset >= 0 && table->s->rec_buff_length - l_offset > 0'

Browse Source 
Make default() function follow Item_field and use get_tmp_table_item() for
change_to_use_tmp_fields().
This commit is contained in:
Oleksandr Byelkin
2022-05-04 19:51:26 +02:00
parent 624cb9735e
commit 141ab971d8
3 changed files with 40 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
sql/sql_select.cc
View File

@ -23727,12 +23727,14 @@ change_to_use_tmp_fields(THD *thd, Ref_ptr_array ref_pointer_array,
for (uint i= 0; (item= it++); i++)
{
Field *field;
if ((item->with_sum_func && item->type() != Item::SUM_FUNC_ITEM) ||
enum Item::Type item_type= item->type();
if ((item->with_sum_func && item_type != Item::SUM_FUNC_ITEM) ||
item->with_window_func)
item_field= item;
else if (item->type() == Item::FIELD_ITEM)
else if (item_type == Item::FIELD_ITEM ||
item_type == Item::DEFAULT_VALUE_ITEM)
item_field= item->get_tmp_table_item(thd);
else if (item->type() == Item::FUNC_ITEM &&
else if (item_type == Item::FUNC_ITEM &&
((Item_func*)item)->functype() == Item_func::SUSERVAR_FUNC)
{
field= item->get_tmp_table_field();