database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-30 16:24:05 +03:00
Code Activity

MDEV-31296: Crash in Item_func::fix_fields when prepared statement with subqueries and window function is executed with sql_mode = ONLY_FULL_GROUP_BY

Browse Source 
Crash was caused by referencing a null pointer on getting
the number of the nesting levels of the set function for the current
select_lex at the method Item_field::fix_fields.

The current select for processing is taken from Name_resolution_context
that filled in at the function set_new_item_local_context() and
where initialization of the data member Name_resolution_context
was mistakenly removed by the commit
  d6ee351bbb
   (Revert "MDEV-24454 Crash at change_item_tree")

To fix the issue, correct initialization of data member
  Name_resolution_context::select_lex
that was removed by the commit d6ee351bbb
is restored.
This commit is contained in:
Dmitry Shulga
2023-12-07 20:16:41 +07:00
parent 4ced4898fd
commit 47f2b16a8c
4 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
mysql-test/main/win.result
View File

@ -4415,5 +4415,18 @@ NULL
DROP FUNCTION f;
DROP TABLE t;
#
# MDEV-31296: Crash in Item_func::fix_fields when prepared statement
# with subqueries and window function is executed with
# sql_mode = ONLY_FULL_GROUP_BY
#
CREATE TABLE t1 ( a INT, i INT) ;
CREATE TABLE t2 ( a INT);
INSERT INTO t2 VALUES (4000);
SET SESSION sql_mode = "ONLY_FULL_GROUP_BY";
EXECUTE IMMEDIATE "SELECT SUM(i) OVER (ORDER BY i) FROM t1 NATURAL JOIN t2";
SUM(i) OVER (ORDER BY i)
# Clean up
DROP TABLE t1, t2;
#
# End of 10.6 tests
#

14
mysql-test/main/win.test
View File

@ -2898,6 +2898,20 @@ EXECUTE IMMEDIATE "SELECT LEAD(c) OVER (ORDER BY c) FROM (SELECT 1 AS c) AS a NA
DROP FUNCTION f;
DROP TABLE t;
--echo #
--echo # MDEV-31296: Crash in Item_func::fix_fields when prepared statement
--echo # with subqueries and window function is executed with
--echo # sql_mode = ONLY_FULL_GROUP_BY
--echo #
CREATE TABLE t1 ( a INT, i INT) ;
CREATE TABLE t2 ( a INT);
INSERT INTO t2 VALUES (4000);
SET SESSION sql_mode = "ONLY_FULL_GROUP_BY";
EXECUTE IMMEDIATE "SELECT SUM(i) OVER (ORDER BY i) FROM t1 NATURAL JOIN t2";
--echo # Clean up
DROP TABLE t1, t2;
--echo #
--echo # End of 10.6 tests
--echo #

13
mysql-test/suite/encryption/r/tempfiles_encrypted.result
View File

@ -4421,6 +4421,19 @@ NULL
DROP FUNCTION f;
DROP TABLE t;
#
# MDEV-31296: Crash in Item_func::fix_fields when prepared statement
# with subqueries and window function is executed with
# sql_mode = ONLY_FULL_GROUP_BY
#
CREATE TABLE t1 ( a INT, i INT) ;
CREATE TABLE t2 ( a INT);
INSERT INTO t2 VALUES (4000);
SET SESSION sql_mode = "ONLY_FULL_GROUP_BY";
EXECUTE IMMEDIATE "SELECT SUM(i) OVER (ORDER BY i) FROM t1 NATURAL JOIN t2";
SUM(i) OVER (ORDER BY i)
# Clean up
DROP TABLE t1, t2;
#
# End of 10.6 tests
#
#

1
sql/sql_base.cc
View File

@ -6930,6 +6930,7 @@ set_new_item_local_context(THD *thd, Item_ident *item, TABLE_LIST *table_ref)
if (!(context= new (thd->mem_root) Name_resolution_context))
return TRUE;
context->init();
context->select_lex= table_ref->select_lex;
context->first_name_resolution_table=
context->last_name_resolution_table= table_ref;
item->context= context;