database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-01-06 05:22:24 +03:00
Code Activity

Bug#13013970 MORE CRASHES IN FIELD_BLOB::GET_KEY_IMAGE

Browse Source 
The predicate is re-written from
((`test`.`g1`.`a` = geometryfromtext('')) or ...
to
((`test`.`g1`.`a` = <cache>(geometryfromtext(''))) or ...

The range optimizer calls save_in_field_no_warnings, in order to fetch keys.
save_in_field_no_warnings returns 0 because of the cache wrapper,
and get_mm_leaf() proceeded to call Field_blob::get_key_image() 
which accesses un-initialized data.
This commit is contained in:
Tor Didriksen
2011-12-05 15:42:45 +01:00
parent c188f94373
commit f337ef3dcf
3 changed files with 22 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
mysql-test/r/gis.result
View File

@@ -1091,4 +1091,13 @@ FORCE INDEX(i) WHERE a = date_sub(now(), interval 2808.4 year_month)
Warnings:
Warning 1441 Datetime function: datetime field overflow
DROP TABLE g1;
#
# Bug#13013970 MORE CRASHES IN FIELD_BLOB::GET_KEY_IMAGE
#
CREATE TABLE g1(a TEXT NOT NULL, KEY(a(255)));
INSERT INTO g1 VALUES ('a'),('a');
SELECT 1 FROM g1 WHERE a >= ANY
(SELECT 1 FROM g1 WHERE a = geomfromtext('') OR a) ;
1
DROP TABLE g1;
End of 5.5 tests

11
mysql-test/t/gis.test
View File

@@ -838,5 +838,16 @@ FORCE INDEX(i) WHERE a = date_sub(now(), interval 2808.4 year_month)
DROP TABLE g1;
--echo #
--echo # Bug#13013970 MORE CRASHES IN FIELD_BLOB::GET_KEY_IMAGE
--echo #
CREATE TABLE g1(a TEXT NOT NULL, KEY(a(255)));
INSERT INTO g1 VALUES ('a'),('a');
SELECT 1 FROM g1 WHERE a >= ANY
(SELECT 1 FROM g1 WHERE a = geomfromtext('') OR a) ;
DROP TABLE g1;
--echo End of 5.5 tests

4
sql/item.cc
View File

@@ -7924,8 +7924,8 @@ my_decimal *Item_cache_str::val_decimal(my_decimal *decimal_val)
int Item_cache_str::save_in_field(Field *field, bool no_conversions)
{
if (!has_value())
return 0;
if (!value_cached && !cache_value())
return -1; // Fatal: couldn't cache the value
int res= Item_cache::save_in_field(field, no_conversions);
return (is_varbinary && field->type() == MYSQL_TYPE_STRING &&
value->length() < field->field_length) ? 1 : res;