database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-01 03:47:19 +03:00
Code Activity

This is a fix for the memory corruption occurred in one of test cases

Browse Source 
from func_group.test after the patch for bug #27229 had been applied.
The memory corruption happened because in some rare cases the function
count_field_types underestimated the number of elements in
in the array param->items_to_copy.
This commit is contained in:
igor@olga.mysql.com
2007-03-25 23:44:06 -07:00
parent 92d1d74037
commit 18ea806864
2 changed files with 17 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
sql/item_sum.cc
View File

@ -449,7 +449,6 @@ void Item_sum::update_used_tables ()
used_tables_cache&= PSEUDO_TABLE_BITS; used_tables_cache&= PSEUDO_TABLE_BITS;
/* the aggregate function is aggregated into its local context */ /* the aggregate function is aggregated into its local context */
if (aggr_level == nest_level)
used_tables_cache |= (1 << aggr_sel->join->tables) - 1; used_tables_cache |= (1 << aggr_sel->join->tables) - 1;
} }
} }

12
sql/sql_select.cc
View File

@ -9196,9 +9196,12 @@ create_tmp_table(THD *thd,TMP_TABLE_PARAM *param,List<Item> &fields,
Item::Type type=item->type(); Item::Type type=item->type();
if (not_all_columns) if (not_all_columns)
{ {
if (item->with_sum_func && type != Item::SUM_FUNC_ITEM && if (item->with_sum_func && type != Item::SUM_FUNC_ITEM)
(type == Item::SUBSELECT_ITEM || {
(item->used_tables() & ~PSEUDO_TABLE_BITS))) if (item->used_tables() & OUTER_REF_TABLE_BIT)
item->update_used_tables();
if (type == Item::SUBSELECT_ITEM ||
(item->used_tables() & ~OUTER_REF_TABLE_BIT))
{ {
/* /*
Mark that the we have ignored an item that refers to a summary Mark that the we have ignored an item that refers to a summary
@ -9208,6 +9211,7 @@ create_tmp_table(THD *thd,TMP_TABLE_PARAM *param,List<Item> &fields,
param->using_indirect_summary_function=1; param->using_indirect_summary_function=1;
continue; continue;
} }
}
if (item->const_item() && (int) hidden_field_count <= 0) if (item->const_item() && (int) hidden_field_count <= 0)
continue; // We don't have to store this continue; // We don't have to store this
} }
@ -9391,6 +9395,7 @@ create_tmp_table(THD *thd,TMP_TABLE_PARAM *param,List<Item> &fields,
table->s->default_values= table->record[1]+alloc_length; table->s->default_values= table->record[1]+alloc_length;
} }
copy_func[0]=0; // End marker copy_func[0]=0; // End marker
param->func_count= copy_func - param->items_to_copy;
recinfo=param->start_recinfo; recinfo=param->start_recinfo;
null_flags=(uchar*) table->record[0]; null_flags=(uchar*) table->record[0];
@ -13571,6 +13576,7 @@ count_field_types(TMP_TABLE_PARAM *param, List<Item> &fields,
if (!sum_item->quick_group) if (!sum_item->quick_group)
param->quick_group=0; // UDF SUM function param->quick_group=0; // UDF SUM function
param->sum_func_count++; param->sum_func_count++;
param->func_count++;
for (uint i=0 ; i < sum_item->arg_count ; i++) for (uint i=0 ; i < sum_item->arg_count ; i++)
{ {