database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-01 03:47:19 +03:00
Code Activity

BUG#12537203 - CRASH WHEN SUBSELECTING GLOBAL VARIABLES IN GEOMETRY FUNCTION ARGUMENTS

Browse Source 
A defect in the subquery substitution code may lead to a server crash:
setting substitution's name should be followed by setting its length
(to keep them in sync).


mysql-test/r/gis.result:
  BUG#12537203 - CRASH WHEN SUBSELECTING GLOBAL VARIABLES IN GEOMETRY FUNCTION ARGUMENTS
    test result.
mysql-test/t/gis.test:
  BUG#12537203 - CRASH WHEN SUBSELECTING GLOBAL VARIABLES IN GEOMETRY FUNCTION ARGUMENTS
    test case.
sql/item_subselect.cc:
  BUG#12537203 - CRASH WHEN SUBSELECTING GLOBAL VARIABLES IN GEOMETRY FUNCTION ARGUMENTS
    set substitution's name length as well as the name itself (to keep them in sync).
This commit is contained in:
Ramil Kalimullin
2012-03-05 22:15:23 +04:00
parent 8aea62fa8a
commit 30d32207e7
3 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
mysql-test/r/gis.result
View File

@ -1081,4 +1081,10 @@ DROP TABLE t0, t1, t2;
SELECT ISCLOSED(CONVERT(CONCAT(' ', 0x2), BINARY(20)));
ISCLOSED(CONVERT(CONCAT(' ', 0x2), BINARY(20)))
NULL
#
# BUG#12537203 - CRASH WHEN SUBSELECTING GLOBAL VARIABLES IN
# GEOMETRY FUNCTION ARGUMENTS
#
SELECT GEOMETRYCOLLECTION((SELECT @@OLD));
ERROR 22007: Illegal non geometric '' value found during parsing
End of 5.1 tests

7
mysql-test/t/gis.test
View File

@ -818,5 +818,12 @@ DROP TABLE t0, t1, t2;
--echo #
SELECT ISCLOSED(CONVERT(CONCAT(' ', 0x2), BINARY(20)));
--echo #
--echo # BUG#12537203 - CRASH WHEN SUBSELECTING GLOBAL VARIABLES IN
--echo # GEOMETRY FUNCTION ARGUMENTS
--echo #
--error ER_ILLEGAL_VALUE_FOR_TYPE
SELECT GEOMETRYCOLLECTION((SELECT @@OLD));
--echo End of 5.1 tests

1
sql/item_subselect.cc
View File

@ -173,6 +173,7 @@ bool Item_subselect::fix_fields(THD *thd_param, Item **ref)
(*ref)= substitution;
substitution->name= name;
substitution->name_length= name_length;
if (have_to_be_excluded)
engine->exclude();
substitution= 0;