database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-30 16:24:05 +03:00
Code Activity

Bug#34587 Creating a view inside a stored procedure leads to a server crash

Browse Source 
The problem is that when a stored procedure is being parsed for
the first execution, the body is copied to a temporary buffer
which is disregarded sometime after the statement is parsed.
And during this parsing phase, the rule for CREATE VIEW was
holding a reference to the string being parsed for use during
the execution of the CREATE VIEW statement, leading to invalid
memory access later.

The solution is to allocate and copy the SELECT of a CREATE
VIEW statement using the thread memory root, which is set to
the permanent arena of the stored procedure.
This commit is contained in:
davi@mysql.com/endora.local
2008-02-20 17:26:50 -03:00
parent 6bf1306b13
commit b9c6b9eced
5 changed files with 40 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
sql/sql_view.cc
View File

@ -237,7 +237,7 @@ bool mysql_create_view(THD *thd, TABLE_LIST *views,
/* This is ensured in the parser. */
DBUG_ASSERT(!lex->proc_list.first && !lex->result &&
!lex->param_list.elements && !lex->derived_tables);
!lex->param_list.elements);
if (mode != VIEW_CREATE_NEW)
{
@ -718,11 +718,7 @@ static int mysql_register_view(THD *thd, TABLE_LIST *view,
/* fill structure */
view->select_stmt.str= view_query.c_ptr_safe();
view->select_stmt.length= view_query.length();
view->source.str= (char*) thd->lex->create_view_select_start;
view->source.length= (thd->lex->create_view_select_end
- thd->lex->create_view_select_start);
trim_whitespace(thd->charset(), & view->source);
view->source= thd->lex->create_view_select;
view->file_version= 1;
view->calc_md5(md5);