mirror of
https://github.com/MariaDB/server.git
synced 2025-07-29 05:21:33 +03:00
Fix BUG#2674: Crash if return system variable in stored procedures.
Had to initialize some fields in lex before parsing an SP read from mysql.proc. mysql-test/r/sp.result: New test case for BUG#2674. mysql-test/t/sp.test: New test case for BUG#2674. sql/sp.cc: We need to initialize some thd->lex fields (e.g. unit master pointers) since LEX::uncacheable() depends on this, and it's called when looking up system variables during parsing.
This commit is contained in:
@ -989,6 +989,12 @@ call bug2614()|
|
||||
call bug2614()|
|
||||
drop table t3|
|
||||
drop procedure bug2614|
|
||||
create function bug2674 () returns int
|
||||
return @@sort_buffer_size|
|
||||
select bug2674()|
|
||||
bug2674()
|
||||
262136
|
||||
drop function bug2674|
|
||||
drop table if exists fac|
|
||||
create table fac (n int unsigned not null primary key, f bigint unsigned)|
|
||||
create procedure ifac(n int unsigned)
|
||||
|
@ -1138,6 +1138,16 @@ call bug2614()|
|
||||
drop table t3|
|
||||
drop procedure bug2614|
|
||||
|
||||
#
|
||||
# BUG#2674
|
||||
#
|
||||
|
||||
create function bug2674 () returns int
|
||||
return @@sort_buffer_size|
|
||||
|
||||
select bug2674()|
|
||||
drop function bug2674|
|
||||
|
||||
|
||||
#
|
||||
# Some "real" examples
|
||||
|
15
sql/sp.cc
15
sql/sp.cc
@ -230,7 +230,20 @@ db_find_routine(THD *thd, int type, char *name, uint namelen, sp_head **sphp)
|
||||
goto done;
|
||||
}
|
||||
|
||||
lex_start(thd, (uchar*)defstr, deflen);
|
||||
{
|
||||
/* This is something of a kludge. We need to initialize some fields
|
||||
* in thd->lex (the unit and master stuff), and the easiest way to
|
||||
* do it is, is to call mysql_init_query(), but this unfortunately
|
||||
* resets teh value_list where we keep the CALL parameters. So we
|
||||
* copy the list and then restore it.
|
||||
*/
|
||||
List<Item> vals= thd->lex->value_list;
|
||||
|
||||
mysql_init_query(thd, TRUE);
|
||||
lex_start(thd, (uchar*)defstr, deflen);
|
||||
thd->lex->value_list= vals;
|
||||
}
|
||||
|
||||
if (yyparse(thd) || thd->is_fatal_error || thd->lex->sphead == NULL)
|
||||
{
|
||||
LEX *newlex= thd->lex;
|
||||
|
Reference in New Issue
Block a user