database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-01 03:47:19 +03:00
Code Activity

MDEV-32225 Test case from opt_tvc.test fails with statement memory protection

Browse Source 
Memory for type holders of the columns of a table value constructor must
be allocated only once.

Approved by Oleksandr Byelkin <sanja@mariadb.com>
This commit is contained in:
Igor Babaev
2023-09-23 19:02:52 -07:00
parent 1ee0d09a2b
commit ab9b1461a0
2 changed files with 31 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
sql/sql_tvc.cc
View File

@ -227,7 +227,7 @@ bool table_value_constr::prepare(THD *thd, SELECT_LEX *sl,
List_item *first_elem= li++;
uint cnt= first_elem->elements;
Type_holder *holders;
Type_holder *holders= type_holders;
if (cnt == 0)
{
@ -238,32 +238,35 @@ bool table_value_constr::prepare(THD *thd, SELECT_LEX *sl,
if (fix_fields_for_tvc(thd, li))
DBUG_RETURN(true);
if (!(holders= new (thd->stmt_arena->mem_root) Type_holder[cnt]) ||
join_type_handlers_for_tvc(thd, li, holders, cnt) ||
get_type_attributes_for_tvc(thd, li, holders,
lists_of_values.elements, cnt))
DBUG_RETURN(true);
List_iterator_fast<Item> it(*first_elem);
Item *item;
Query_arena *arena, backup;
arena=thd->activate_stmt_arena_if_needed(&backup);
sl->item_list.empty();
for (uint pos= 0; (item= it++); pos++)
if (!holders)
{
/* Error's in 'new' will be detected after loop */
Item_type_holder *new_holder= new (thd->mem_root)
Item_type_holder(thd, item, holders[pos].type_handler(),
&holders[pos]/*Type_all_attributes*/,
holders[pos].get_maybe_null());
sl->item_list.push_back(new_holder);
holders= type_holders= new (thd->stmt_arena->mem_root) Type_holder[cnt];
if (!holders ||
join_type_handlers_for_tvc(thd, li, holders, cnt) ||
get_type_attributes_for_tvc(thd, li, holders,
lists_of_values.elements, cnt))
DBUG_RETURN(true);
List_iterator_fast<Item> it(*first_elem);
Item *item;
Query_arena *arena, backup;
arena=thd->activate_stmt_arena_if_needed(&backup);
sl->item_list.empty();
for (uint pos= 0; (item= it++); pos++)
{
/* Error's in 'new' will be detected after loop */
Item_type_holder *new_holder= new (thd->mem_root)
Item_type_holder(thd, item, holders[pos].type_handler(),
&holders[pos]/*Type_all_attributes*/,
holders[pos].get_maybe_null());
sl->item_list.push_back(new_holder);
}
if (arena)
thd->restore_active_arena(arena, &backup);
if (unlikely(thd->is_fatal_error))
DBUG_RETURN(true); // out of memory
}
if (arena)
thd->restore_active_arena(arena, &backup);
if (unlikely(thd->is_fatal_error))
DBUG_RETURN(true); // out of memory
result= tmp_result;