database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-30 16:24:05 +03:00
Code Activity

MDEV-22563 Segfault on duplicate free of Item_func_in::array

Browse Source 
Same array instance in two Item_func_in instances. First Item_func_in
instance is freed on table close. Second one is freed on
cleanup_after_query().

get_copy() depends on copy ctor for copying an item and hence does
shallow copy for default copy ctor. Use build_clone() for deep copy of
Item_func_in.
This commit is contained in:
Aleksey Midenkov
2020-05-15 16:17:15 +03:00
parent 72789e4b2b
commit a4996f951d
4 changed files with 76 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
sql/field.cc
View File

@ -11396,7 +11396,7 @@ Virtual_column_info* Virtual_column_info::clone(THD *thd)
return NULL;
if (expr)
{
dst->expr= expr->get_copy(thd);
dst->expr= expr->build_clone(thd);
if (!dst->expr)
return NULL;
}