database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-01 03:47:19 +03:00
Code Activity

Fixed crashing bug in recursive SQL if write to tmp table would fail

Browse Source 
This error was discovered while working on
MDEV-30540 Wrong result with IN list length reaching
           IN_PREDICATE_CONVERSION_THRESHOLD

If there is read error from handler::ha_rnd_next() during a recursive
query, st_select_lex_unit::exec_recursive() will crash as it will try to
get the error code from a structure that was deleted by the callee.
The code was using the construct:
   sl->join->exec();
   saved_error=sl->join->error;
This does not work as sl->join was freed by the exec() and sl->join would
be set to 0.
Fixed by having JOIN::exec() return the error code.
The included test case simulates the error in ha_rnd_next(), which causes
a crash without the patch.
scovered whle working on
MDEV-30540 Wrong result with IN list length reaching
           IN_PREDICATE_CONVERSION_THRESHOLD

If there is read error from handler::ha_rnd_next() during a recursive
query, st_select_lex_unit::exec_recursive() will crash as it will try to
get the error code from a structure that was deleted by the callee.
The code was using the construct:
   sl->join->exec();
   saved_error=sl->join->error;
This does not work as sl->join was freed by the exec() and sl->join was
set to 0.
Fixed by having JOIN::exec() return the error code.
The included test case simulates the error in ha_rnd_next(), which causes
a crash without the patch.
This commit is contained in:
Monty
2023-03-01 19:59:42 +02:00
parent bc3596fe12
commit ae05097714
10 changed files with 171 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
sql/sql_select.h
View File

@ -1717,9 +1717,8 @@ public:
bool build_explain();
int reinit();
int init_execution();
void exec();
void exec_inner();
int exec() __attribute__((warn_unused_result));
int exec_inner();
bool prepare_result(List<Item> **columns_list);
int destroy();
void restore_tmp();