database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

Fixed bug#19225: unchecked error results in server crash

Browse Source 
In multi-table delete a table for delete can't be used for selecting in
subselects. Appropriate error was raised but wasn't checked which leads to a
crash at the execution phase.

The mysql_execute_command() now checks for errors before executing select
for multi-delete.
This commit is contained in:
evgen@moonbone.local
2006-05-29 00:32:59 +04:00
parent 7667b271d8
commit 1f30bf5a33
3 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
mysql-test/r/multi_update.result
View File

@ -475,3 +475,8 @@ aclid bigint, index idx_acl(aclid)
insert into t2 values(1,null); insert into t2 values(1,null);
delete t2, t1 from t2 left join t1 on (t2.aclid=t1.aclid) where t2.refid='1'; delete t2, t1 from t2 left join t1 on (t2.aclid=t1.aclid) where t2.refid='1';
drop table t1, t2; drop table t1, t2;
create table t1(a int);
create table t2(a int);
delete from t1,t2 using t1,t2 where t1.a=(select a from t1);
ERROR HY000: You can't specify target table 't1' for update in FROM clause
drop table t1, t2;

8
mysql-test/t/multi_update.test
View File

@ -448,4 +448,12 @@ insert into t2 values(1,null);
delete t2, t1 from t2 left join t1 on (t2.aclid=t1.aclid) where t2.refid='1'; delete t2, t1 from t2 left join t1 on (t2.aclid=t1.aclid) where t2.refid='1';
drop table t1, t2; drop table t1, t2;
#
# Bug#19225: unchecked error leads to server crash
#
create table t1(a int);
create table t2(a int);
--error 1093
delete from t1,t2 using t1,t2 where t1.a=(select a from t1);
drop table t1, t2;
# End of 4.1 tests # End of 4.1 tests

4
sql/sql_parse.cc
View File

@ -3047,8 +3047,8 @@ unsent_create_error:
} }
} }
if (!thd->is_fatal_error && (result= new multi_delete(thd,aux_tables, if (!res && !thd->is_fatal_error &&
table_count))) (result= new multi_delete(thd,aux_tables, table_count)))
{ {
res= mysql_select(thd, &select_lex->ref_pointer_array, res= mysql_select(thd, &select_lex->ref_pointer_array,
select_lex->get_table_list(), select_lex->get_table_list(),