database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-01-06 05:22:24 +03:00
Code Activity

MDEV-8833 Crash of server on prepared statement with conversion to semi-join

Browse Source 
Correct context chain made to allow outer fields pullout.
This commit is contained in:
Oleksandr Byelkin
2015-11-10 12:41:26 +01:00
parent ee97274ca7
commit b9631e310b
3 changed files with 81 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
mysql-test/r/ps.result
View File

@@ -4072,4 +4072,35 @@ id value
deallocate prepare stmt;
SET SESSION sql_mode = @save_sql_mode;
DROP TABLE t1,t2;
# End of 10.0 tests
#
# MDEV-8833: Crash of server on prepared statement with
# conversion to semi-join
#
CREATE TABLE t1 (column1 INT);
INSERT INTO t1 VALUES (3),(9);
CREATE TABLE t2 (column2 INT);
INSERT INTO t2 VALUES (1),(4);
CREATE TABLE t3 (column3 INT);
INSERT INTO t3 VALUES (6),(8);
CREATE TABLE t4 (column4 INT);
INSERT INTO t4 VALUES (2),(5);
PREPARE stmt FROM "SELECT ( SELECT MAX( table1.column1 ) AS field1
FROM t1 AS table1
WHERE table3.column3 IN ( SELECT table2.column2 AS field2 FROM t2 AS table2 )
) AS sq
FROM t3 AS table3, t4 AS table4";
EXECUTE stmt;
sq
NULL
NULL
NULL
NULL
EXECUTE stmt;
sq
NULL
NULL
NULL
NULL
deallocate prepare stmt;
drop table t1,t2,t3,t4;
# End of 5.5 tests

29
mysql-test/t/ps.test
View File

@@ -3653,5 +3653,32 @@ deallocate prepare stmt;
SET SESSION sql_mode = @save_sql_mode;
DROP TABLE t1,t2;
--echo #
--echo # MDEV-8833: Crash of server on prepared statement with
--echo # conversion to semi-join
--echo #
--echo # End of 10.0 tests
CREATE TABLE t1 (column1 INT);
INSERT INTO t1 VALUES (3),(9);
CREATE TABLE t2 (column2 INT);
INSERT INTO t2 VALUES (1),(4);
CREATE TABLE t3 (column3 INT);
INSERT INTO t3 VALUES (6),(8);
CREATE TABLE t4 (column4 INT);
INSERT INTO t4 VALUES (2),(5);
PREPARE stmt FROM "SELECT ( SELECT MAX( table1.column1 ) AS field1
FROM t1 AS table1
WHERE table3.column3 IN ( SELECT table2.column2 AS field2 FROM t2 AS table2 )
) AS sq
FROM t3 AS table3, t4 AS table4";
EXECUTE stmt;
EXECUTE stmt;
deallocate prepare stmt;
drop table t1,t2,t3,t4;
--echo # End of 5.5 tests

23
sql/item.cc
View File

@@ -2778,9 +2778,28 @@ void Item_field::fix_after_pullout(st_select_lex *new_parent, Item **ref)
if (context)
{
Name_resolution_context *ctx= new Name_resolution_context();
ctx->outer_context= NULL; // We don't build a complete name resolver
ctx->table_list= NULL; // We rely on first_name_resolution_table instead
if (context->select_lex == new_parent)
{
/*
This field was pushed in then pulled out
(for example left part of IN)
*/
ctx->outer_context= context->outer_context;
}
else if (context->outer_context)
{
/* just pull to the upper context */
ctx->outer_context= context->outer_context->outer_context;
}
else
{
/* No upper context (merging Derived/VIEW where context chain ends) */
ctx->outer_context= NULL;
}
ctx->table_list= context->first_name_resolution_table;
ctx->select_lex= new_parent;
if (context->select_lex == NULL)
ctx->select_lex= NULL;
ctx->first_name_resolution_table= context->first_name_resolution_table;
ctx->last_name_resolution_table= context->last_name_resolution_table;
ctx->error_processor= context->error_processor;