database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-30 16:24:05 +03:00
Code Activity

MDEV-16699 heap-use-after-free in group_concat with compressed or GIS columns

Browse Source 
Field_blob::store() has special code for GROUP_CONCAT temporary table
(to store blob values in Blob_mem_storage - this prevents them
from being freed/overwritten when a next row is read).

Field_geom and Field_blob_compressed inherit from Field_blob but they
have their own ::store() method without this special Blob_mem_storage
support.

Considering that non-grouping CONCAT() of such fields converts
them to plain BLOB, let's do the same for GROUP_CONCAT. To do it,
Item_func_group_concat::setup will signal that it's creating
a temporary table for GROUP_CONCAT, and Field_blog::make_new_field()
override will create base Field_blob when under group concat.
This commit is contained in:
Sergei Golubchik
2024-08-31 23:57:33 +02:00
parent 65418ca9ad
commit 3ea71a2c8e
11 changed files with 89 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
sql/sql_class.h
View File

@ -6148,6 +6148,7 @@ public:
aggregate functions as normal functions.
*/
bool precomputed_group_by;
bool group_concat;
bool force_copy_fields;
/*
If TRUE, create_tmp_field called from create_tmp_table will convert
@ -6166,7 +6167,7 @@ public:
group_length(0), group_null_parts(0),
using_outer_summary_function(0),
schema_table(0), materialized_subquery(0), force_not_null_cols(0),
precomputed_group_by(0),
precomputed_group_by(0), group_concat(0),
force_copy_fields(0), bit_fields_as_long(0), skip_create_table(0)
{}
~TMP_TABLE_PARAM()