From 27abb692500d7986dca016d960e1863069b41f26 Mon Sep 17 00:00:00 2001
From: "pem@mysql.comhem.se" <>
Date: Fri, 28 May 2004 19:43:06 +0200
Subject: [PATCH] Fixed BUG#2460: Crash wih Stored Procedure and UNION.

---
 mysql-test/r/sp.result | 45 +++++++++++++++++++++++++++++++++++++++++
 mysql-test/t/sp.test   | 46 ++++++++++++++++++++++++++++++++++++++++++
 sql/sql_union.cc       |  4 +++-
 3 files changed, 94 insertions(+), 1 deletion(-)

diff --git a/mysql-test/r/sp.result b/mysql-test/r/sp.result
index d0a37c742a4..8595f1ecebd 100644
--- a/mysql-test/r/sp.result
+++ b/mysql-test/r/sp.result
@@ -1273,6 +1273,51 @@ select @a|
 @a
 5
 drop procedure bug3863|
+drop table if exists t3|
+create table t3 (
+id int(10) unsigned not null default 0,
+rid int(10) unsigned not null default 0,
+msg text not null,
+primary key (id),
+unique key rid (rid, id)
+)|
+create procedure bug2460_1(in v int)
+begin
+( select n0.id from t3 as n0 where n0.id = v )
+union
+( select n0.id from t3 as n0, t3 as n1
+where n0.id = n1.rid and n1.id = v )
+union
+( select n0.id from t3 as n0, t3 as n1, t3 as n2
+where n0.id = n1.rid and n1.id = n2.rid and n2.id = v );
+end|
+call bug2460_1(2)|
+id
+call bug2460_1(2)|
+id
+insert into t3 values (1, 1, 'foo'), (2, 1, 'bar'), (3, 1, 'zip zap')|
+call bug2460_1(2)|
+id
+2
+1
+call bug2460_1(2)|
+id
+2
+1
+create procedure bug2460_2()
+begin
+drop table if exists t3;
+create table t3 (s1 int);
+insert into t3 select 1 union select 1;
+end|
+call bug2460_2()|
+call bug2460_2()|
+select * from t3|
+s1
+1
+drop procedure bug2460_1|
+drop procedure bug2460_2|
+drop table t3|
 drop table if exists fac|
 create table fac (n int unsigned not null primary key, f bigint unsigned)|
 create procedure ifac(n int unsigned)
diff --git a/mysql-test/t/sp.test b/mysql-test/t/sp.test
index bd6606332b9..05847ba220c 100644
--- a/mysql-test/t/sp.test
+++ b/mysql-test/t/sp.test
@@ -1471,6 +1471,52 @@ select @a|
 
 drop procedure bug3863|
 
+#
+# BUG#2460
+#
+--disable_warnings
+drop table if exists t3|
+--enable_warnings
+create table t3 (
+  id int(10) unsigned not null default 0,
+  rid int(10) unsigned not null default 0,
+  msg text not null,
+  primary key (id),
+  unique key rid (rid, id)
+)|
+
+create procedure bug2460_1(in v int)
+begin
+    ( select n0.id from t3 as n0 where n0.id = v )
+  union
+    ( select n0.id from t3 as n0, t3 as n1
+        where n0.id = n1.rid and n1.id = v )
+  union
+    ( select n0.id from t3 as n0, t3 as n1, t3 as n2
+        where n0.id = n1.rid and n1.id = n2.rid and n2.id = v );
+end|
+
+call bug2460_1(2)|
+call bug2460_1(2)|
+insert into t3 values (1, 1, 'foo'), (2, 1, 'bar'), (3, 1, 'zip zap')|
+call bug2460_1(2)|
+call bug2460_1(2)|
+
+create procedure bug2460_2()
+begin
+  drop table if exists t3;
+  create table t3 (s1 int);
+  insert into t3 select 1 union select 1;
+end|
+
+call bug2460_2()|
+call bug2460_2()|
+select * from t3|
+
+drop procedure bug2460_1|
+drop procedure bug2460_2|
+drop table t3|
+
 
 #
 # Some "real" examples
diff --git a/sql/sql_union.cc b/sql/sql_union.cc
index 794fbc74c73..81f64400400 100644
--- a/sql/sql_union.cc
+++ b/sql/sql_union.cc
@@ -457,7 +457,9 @@ int st_select_lex_unit::exec()
       else
       {
 	JOIN_TAB *tab,*end;
-	for (tab=join->join_tab,end=tab+join->tables ; tab != end ; tab++)
+	for (tab=join->join_tab, end=tab+join->tables ;
+	     tab && tab != end ;
+	     tab++)
 	{
 	  delete tab->select;
 	  delete tab->quick;