mirror of
https://github.com/MariaDB/server.git
synced 2025-08-07 00:04:31 +03:00
MDEV-24935: Server crashes in Field_iterator_natural_join::next or Field_iterator_table_ref::set_field_iterator upon 2nd execution of SP
Calling a stored routine that executes a join on three or more tables and referencing not-existent column name in the USING clause resulted in a crash on its second invocation. Server crash taken place by the reason of dereferencing null pointer in condition of DBUG_ASSERT inside the method Field_iterator_natural_join::next() There the data member cur_column_ref->table_field->field has the nullptr value that was reset at the end of first execution of a stored routine when the standalone procedure cleanup_items() called by the method sp_head::execute. Later this data member is not re-initialized and never referenced in any place except the DBUG_ASSERT on second and later invocations of the stored routine. To fix the issue, the assert's condition should be augmented by a condition '|| !cur_column_ref->table_field' before dereferencing cur_column_ref->table_field. Such extra checking is aligned with conditions used by DBUG_ASSERT macros used by implementation of the class Field_iterator_table_ref that aggregated the class Field_iterator_natural_join.
This commit is contained in:
@@ -6948,6 +6948,7 @@ void Field_iterator_natural_join::next()
|
||||
{
|
||||
cur_column_ref= column_ref_it++;
|
||||
DBUG_ASSERT(!cur_column_ref || ! cur_column_ref->table_field ||
|
||||
!cur_column_ref->table_field->field ||
|
||||
cur_column_ref->table_ref->table ==
|
||||
cur_column_ref->table_field->field->table);
|
||||
}
|
||||
|
Reference in New Issue
Block a user