database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-01-06 05:22:24 +03:00
Code Activity

Bug#26361149 MYSQL SERVER CRASHES AT: COL IN(IFNULL(CONST, COL), NAME_CONST('NAME', NULL))

Browse Source 
based on:

commit f7316aa0c9
Author: Ajo Robert <ajo.robert@oracle.com>
Date:   Thu Aug 24 17:03:21 2017 +0530

    Bug#26361149  MYSQL SERVER CRASHES AT: COL IN(IFNULL(CONST,
                           COL), NAME_CONST('NAME', NULL))

    Backport of Bug#19143243 fix.

    NAME_CONST item can return NULL_ITEM type in case of incorrect arguments.
    NULL_ITEM has special processing in Item_func_in function.
    In Item_func_in::fix_length_and_dec an array of possible comparators is
    created. Since NAME_CONST function has NULL_ITEM type, corresponding
    array element is empty. Then NAME_CONST is wrapped to ITEM_CACHE.
    ITEM_CACHE can not return proper type(NULL_ITEM) in Item_func_in::val_int(),
    so the NULL_ITEM is attempted compared with an empty comparator.
    The fix is to disable the caching of Item_name_const item.
This commit is contained in:
Sergei Golubchik
2017-10-17 10:57:51 +02:00
parent df5f25fa7a
commit b000e16956
3 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
mysql-test/r/func_in.result
View File

@@ -812,3 +812,9 @@ EXECUTE s;
1
DROP TABLE t1;
# End of 5.3 tests
create table t1 (a int);
insert t1 values (1),(2),(3);
select * from t1 where 1 in (a, name_const('a', null));
a
1
drop table t1;

8
mysql-test/t/func_in.test
View File

@@ -606,3 +606,11 @@ EXECUTE s;
DROP TABLE t1;
--echo # End of 5.3 tests
#
# Bug#26361149 MYSQL SERVER CRASHES AT: COL IN(IFNULL(CONST, COL), NAME_CONST('NAME', NULL))
#
create table t1 (a int);
insert t1 values (1),(2),(3);
select * from t1 where 1 in (a, name_const('a', null));
drop table t1;

1
sql/item.cc
View File

@@ -6726,6 +6726,7 @@ bool Item::cache_const_expr_analyzer(uchar **arg)
*/
if (const_item() &&
!(basic_const_item() || item->basic_const_item() ||
item->type() == Item::NULL_ITEM || /* Item_name_const hack */
item->type() == Item::FIELD_ITEM ||
item->type() == SUBSELECT_ITEM ||
/*