database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-31 22:22:30 +03:00
Code Activity

Fixed bug#17366: Unchecked Item_int results in server crash

Browse Source 
When there is conjunction of conds, the substitute_for_best_equal_field()
will call the eliminate_item_equal() function in loop to build final
expression. But if eliminate_item_equal() finds that some cond will always
evaluate to 0, then that cond will be substituted by Item_int with value ==
0. In this case on the next iteration eliminate_item_equal() will get that 
Item_int and treat it as Item_cond. This is leads to memory corruption and
server crash on cleanup phase.

To the eliminate_item_equal() function was added DBUG_ASSERT for checking
that all items treaten as Item_cond are really Item_cond.
The substitute_for_best_equal_field() now checks that if
eliminate_item_equal() returns Item_int and it's value is 0 then this 
value is returned as the result of whole conjunction.
This commit is contained in:
evgen@sunlight.local
2006-03-13 21:11:15 +03:00
parent f47ed62fb0
commit af660df0ef
3 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
sql/sql_select.cc
View File

@@ -7066,7 +7066,10 @@ static Item *eliminate_item_equal(COND *cond, COND_EQUAL *upper_levels,
if (!cond)
cond= new Item_cond_and(eq_list);
else
{
DBUG_ASSERT(cond->type() == Item::COND_ITEM);
((Item_cond *) cond)->add_at_head(&eq_list);
}
cond->quick_fix_field();
cond->update_used_tables();
@@ -7151,6 +7154,11 @@ static COND* substitute_for_best_equal_field(COND *cond,
while ((item_equal= it++))
{
cond= eliminate_item_equal(cond, cond_equal->upper_levels, item_equal);
// This occurs when eliminate_item_equal() founds that cond is
// always false and substitues it with Item_int 0.
// Due to this, value of item_equal will be 0, so just return it.
if (cond->type() != Item::ITEM_COND)
break;
}
}
}