database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-18 17:42:20 +03:00
Code Activity

MDEV-7826 Server crashes in Item_subselect::enumerate_field_refs_processor

Browse Source 
upper->item can be NULL if we're referring to an aggregate function
This commit is contained in:
Sergei Golubchik
2017-07-12 12:49:29 +02:00
parent c5975eaea1
commit be55bbc2b2
3 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
mysql-test/r/group_by.result
View File

@@ -2531,3 +2531,17 @@ select a from t1 group by a having a > 1;
a
drop table t1;
set sql_mode= @save_sql_mode;
create table t1 (f1 int);
insert into t1 values (5),(9);
create table t2 (f2 int);
insert into t2 values (0),(6);
create table t3 (f3 int);
insert into t3 values (6),(3);
create table t4 (f4 int);
insert into t4 values (1),(0);
select
(select min(f1) from t1 where f1 in (select min(f4) from t2)) as field7,
(select count(*) from t3 where f3 in (select max(f4) from t2 group by field7))
from t4;
ERROR 42S22: Reference 'field7' not supported (reference to group function)
drop table t1, t2, t3, t4;

19
mysql-test/t/group_by.test
View File

@@ -1703,6 +1703,25 @@ select a as x from t1 group by x having x > 1;
select a from t1 group by a having a > 1;
drop table t1;
set sql_mode= @save_sql_mode;
#
# MDEV-7826 Server crashes in Item_subselect::enumerate_field_refs_processor
#
create table t1 (f1 int);
insert into t1 values (5),(9);
create table t2 (f2 int);
insert into t2 values (0),(6);
create table t3 (f3 int);
insert into t3 values (6),(3);
create table t4 (f4 int);
insert into t4 values (1),(0);
--error ER_ILLEGAL_REFERENCE
select
(select min(f1) from t1 where f1 in (select min(f4) from t2)) as field7,
(select count(*) from t3 where f3 in (select max(f4) from t2 group by field7))
from t4;
drop table t1, t2, t3, t4;
#
# End of MariaDB 5.5 tests
#

3
sql/item_subselect.cc
View File

@@ -316,7 +316,8 @@ bool Item_subselect::enumerate_field_refs_processor(uchar *arg)
while ((upper= it++))
{
if (upper->item->walk(&Item::enumerate_field_refs_processor, FALSE, arg))
if (upper->item &&
upper->item->walk(&Item::enumerate_field_refs_processor, FALSE, arg))
return TRUE;
}
return FALSE;