From b8f906dd4b2094deb30812c5d0b6c71151be1d6b Mon Sep 17 00:00:00 2001
From: Alexander Barkov <bar@mariadb.org>
Date: Wed, 15 Nov 2017 14:18:46 +0400
Subject: [PATCH] MDEV-12846 sql_mode=ORACLE: using Oracle-style placeholders
 in direct query execution makes the server crash

---
 mysql-test/suite/compat/oracle/r/ps.result | 15 +++++++++++++++
 mysql-test/suite/compat/oracle/t/ps.test   | 19 +++++++++++++++++++
 sql/sql_lex.cc                             |  5 +++++
 3 files changed, 39 insertions(+)

diff --git a/mysql-test/suite/compat/oracle/r/ps.result b/mysql-test/suite/compat/oracle/r/ps.result
index ed7cb4c51d5..158d15e9f90 100644
--- a/mysql-test/suite/compat/oracle/r/ps.result
+++ b/mysql-test/suite/compat/oracle/r/ps.result
@@ -247,3 +247,18 @@ DROP PROCEDURE p1;
 #
 # End of MDEV-10866 Extend PREPARE and EXECUTE IMMEDIATE to understand expressions
 #
+#
+# MDEV-12846 sql_mode=ORACLE: using Oracle-style placeholders in direct query execution makes the server crash
+#
+SELECT ? FROM DUAL;
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '? FROM DUAL' at line 1
+SELECT :a FROM DUAL;
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ':a FROM DUAL' at line 1
+SELECT :1 FROM DUAL;
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ':1 FROM DUAL' at line 1
+SELECT 1+? FROM DUAL;
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '? FROM DUAL' at line 1
+SELECT 1+:a FROM DUAL;
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ':a FROM DUAL' at line 1
+SELECT 1+:1 FROM DUAL;
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ':1 FROM DUAL' at line 1
diff --git a/mysql-test/suite/compat/oracle/t/ps.test b/mysql-test/suite/compat/oracle/t/ps.test
index 08bb957c33f..d5a325d526f 100644
--- a/mysql-test/suite/compat/oracle/t/ps.test
+++ b/mysql-test/suite/compat/oracle/t/ps.test
@@ -264,3 +264,22 @@ DROP PROCEDURE p1;
 --echo #
 --echo # End of MDEV-10866 Extend PREPARE and EXECUTE IMMEDIATE to understand expressions
 --echo #
+
+
+--echo #
+--echo # MDEV-12846 sql_mode=ORACLE: using Oracle-style placeholders in direct query execution makes the server crash
+--echo #
+
+--error ER_PARSE_ERROR
+SELECT ? FROM DUAL;
+--error ER_PARSE_ERROR
+SELECT :a FROM DUAL;
+--error ER_PARSE_ERROR
+SELECT :1 FROM DUAL;
+
+--error ER_PARSE_ERROR
+SELECT 1+? FROM DUAL;
+--error ER_PARSE_ERROR
+SELECT 1+:a FROM DUAL;
+--error ER_PARSE_ERROR
+SELECT 1+:1 FROM DUAL;
diff --git a/sql/sql_lex.cc b/sql/sql_lex.cc
index 831b4ee4ca7..049004e0e16 100644
--- a/sql/sql_lex.cc
+++ b/sql/sql_lex.cc
@@ -6438,6 +6438,11 @@ Item *LEX::create_and_link_Item_trigger_field(THD *thd,
 Item_param *LEX::add_placeholder(THD *thd, const LEX_CSTRING *name,
                                  const char *start, const char *end)
 {
+  if (!thd->m_parser_state->m_lip.stmt_prepare_mode)
+  {
+    thd->parse_error(ER_SYNTAX_ERROR, start);
+    return NULL;
+  }
   if (!parsing_options.allows_variable)
   {
     my_error(ER_VIEW_SELECT_VARIABLE, MYF(0));