database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

MDEV-17869 AddressSanitizer: use-after-poison in Item_change_list::rollback_item_tree_changes

Browse Source 
it's incorrect to use change_item_tree() to replace arguments
of top-level AND/OR, because they (arguments) are stored in a List,
so a pointer to an argument is in the list_node, and individual
list_node's of top-level AND/OR can be deleted in Item_cond::build_equal_items().
In that case rollback_item_tree_changes() will modify the deleted object.

Luckily, it's not needed to use change_item_tree() for top-level
AND/OR, because the whole top-level item is copied and preserved
in prep_where and prep_on, and restored from there.

So, just don't.

Additionally to the test case in the commit it fixes
* ASAN failure of main.opt_tvc --ps
* ASAN failure of main.having_cond_pushdown --ps
This commit is contained in:
Sergei Golubchik
2022-11-17 19:23:08 +01:00
parent df82d68421
commit 6cb84346e1
8 changed files with 86 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
sql/sql_select.cc
View File

@ -28295,11 +28295,11 @@ void JOIN::cache_const_exprs()
return;
if (conds)
conds->compile(thd, &Item::cache_const_expr_analyzer, &analyzer_arg,
conds->top_level_compile(thd, &Item::cache_const_expr_analyzer, &analyzer_arg,
&Item::cache_const_expr_transformer, &cache_flag);
cache_flag= FALSE;
if (having)
having->compile(thd, &Item::cache_const_expr_analyzer,
having->top_level_compile(thd, &Item::cache_const_expr_analyzer,
&analyzer_arg, &Item::cache_const_expr_transformer, &cache_flag);
for (JOIN_TAB *tab= first_depth_first_tab(this); tab;
@ -28308,7 +28308,7 @@ void JOIN::cache_const_exprs()
if (*tab->on_expr_ref)
{
cache_flag= FALSE;
(*tab->on_expr_ref)->compile(thd, &Item::cache_const_expr_analyzer,
(*tab->on_expr_ref)->top_level_compile(thd, &Item::cache_const_expr_analyzer,
&analyzer_arg, &Item::cache_const_expr_transformer, &cache_flag);
}
}
@ -29365,7 +29365,6 @@ select_handler *SELECT_LEX::find_select_handler(THD *thd)
}
/**
@} (end of group Query_Optimizer)
*/