database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-05 13:16:09 +03:00
Code Activity

BUG#12537203 - CRASH WHEN SUBSELECTING GLOBAL VARIABLES IN GEOMETRY FUNCTION ARGUMENTS

Browse Source 
A defect in the subquery substitution code may lead to a server crash:
setting substitution's name should be followed by setting its length
(to keep them in sync).
This commit is contained in:
Ramil Kalimullin
2012-03-05 22:15:23 +04:00
parent 44d88da575
commit 97c429f65b
3 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
mysql-test/r/gis.result
View File

@@ -1081,4 +1081,10 @@ DROP TABLE t0, t1, t2;
SELECT ISCLOSED(CONVERT(CONCAT(' ', 0x2), BINARY(20))); SELECT ISCLOSED(CONVERT(CONCAT(' ', 0x2), BINARY(20)));
ISCLOSED(CONVERT(CONCAT(' ', 0x2), BINARY(20))) ISCLOSED(CONVERT(CONCAT(' ', 0x2), BINARY(20)))
NULL NULL
#
# BUG#12537203 - CRASH WHEN SUBSELECTING GLOBAL VARIABLES IN
# GEOMETRY FUNCTION ARGUMENTS
#
SELECT GEOMETRYCOLLECTION((SELECT @@OLD));
ERROR 22007: Illegal non geometric '' value found during parsing
End of 5.1 tests End of 5.1 tests

7
mysql-test/t/gis.test
View File

@@ -818,5 +818,12 @@ DROP TABLE t0, t1, t2;
--echo # --echo #
SELECT ISCLOSED(CONVERT(CONCAT(' ', 0x2), BINARY(20))); SELECT ISCLOSED(CONVERT(CONCAT(' ', 0x2), BINARY(20)));
--echo #
--echo # BUG#12537203 - CRASH WHEN SUBSELECTING GLOBAL VARIABLES IN
--echo # GEOMETRY FUNCTION ARGUMENTS
--echo #
--error ER_ILLEGAL_VALUE_FOR_TYPE
SELECT GEOMETRYCOLLECTION((SELECT @@OLD));
--echo End of 5.1 tests --echo End of 5.1 tests

1
sql/item_subselect.cc
View File

@@ -173,6 +173,7 @@ bool Item_subselect::fix_fields(THD *thd_param, Item **ref)
(*ref)= substitution; (*ref)= substitution;
substitution->name= name; substitution->name= name;
substitution->name_length= name_length;
if (have_to_be_excluded) if (have_to_be_excluded)
engine->exclude(); engine->exclude();
substitution= 0; substitution= 0;