database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

MDEV-16353 Server crash on query with CTE

Browse Source 
This bug caused crashes for queries with unreferenced non-recursive
CTEs specified by unions.It happened because the function
st_select_lex_unit::prepare() tried to use the value of the field 'derived'
that could not be set for unferenced CTEs as there was no derived
table associated with an unreferenced CTE.
This commit is contained in:
Igor Babaev
2018-05-31 18:55:07 -07:00
parent a31e99a89c
commit b2f86ebdd2
3 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
mysql-test/r/cte_nonrecursive.result
View File

@ -1462,3 +1462,19 @@ a b
4 5
4 3
DROP TABLE t1;
#
# MDEV-16353: unreferenced CTE specified by query with UNION
#
with cte as
(select 1 union select 2 union select 3)
select 1 as f;
f
1
create table t1 (a int);
insert into t1 values (2), (1), (7), (1), (4);
with cte as
(select * from t1 where a < 2 union select * from t1 where a > 5)
select 2 as f;
f
2
drop table t1;

18
mysql-test/t/cte_nonrecursive.test
View File

@ -1012,3 +1012,21 @@ SELECT a FROM cte;
WITH cte(a,b) AS (SELECT 4,5 UNION SELECT 4,3) SELECT a,b FROM cte;
DROP TABLE t1;
--echo #
--echo # MDEV-16353: unreferenced CTE specified by query with UNION
--echo #
with cte as
(select 1 union select 2 union select 3)
select 1 as f;
create table t1 (a int);
insert into t1 values (2), (1), (7), (1), (4);
with cte as
(select * from t1 where a < 2 union select * from t1 where a > 5)
select 2 as f;
drop table t1;

2
sql/sql_union.cc
View File

@ -625,7 +625,7 @@ bool st_select_lex_unit::prepare(THD *thd_arg, select_result *sel_result,
{
if (with_element)
{
if (derived->with->rename_columns_of_derived_unit(thd, this))
if (with_element->rename_columns_of_derived_unit(thd, this))
goto err;
if (check_duplicate_names(thd, sl->item_list, 0))
goto err;