database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-21 21:22:27 +03:00
Code Activity

Bug#26361149 MYSQL SERVER CRASHES AT: COL IN(IFNULL(CONST,

Browse Source 
COL), NAME_CONST('NAME', NULL))

Backport of Bug#19143243 fix.

NAME_CONST item can return NULL_ITEM type in case of incorrect arguments.
NULL_ITEM has special processing in Item_func_in function.
In Item_func_in::fix_length_and_dec an array of possible comparators is
created. Since NAME_CONST function has NULL_ITEM type, corresponding
array element is empty. Then NAME_CONST is wrapped to ITEM_CACHE.
ITEM_CACHE can not return proper type(NULL_ITEM) in Item_func_in::val_int(),
so the NULL_ITEM is attempted compared with an empty comparator.
The fix is to disable the caching of Item_name_const item.
This commit is contained in:
Ajo Robert
2017-08-24 17:03:21 +05:30
parent f2f6025a44
commit f7316aa0c9
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
sql/item.h
View File

@ -1,7 +1,7 @@
#ifndef ITEM_INCLUDED #ifndef ITEM_INCLUDED
#define ITEM_INCLUDED #define ITEM_INCLUDED
/* Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved. /* Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by it under the terms of the GNU General Public License as published by
@ -1552,6 +1552,12 @@ public:
return TRUE; return TRUE;
} }
virtual bool cache_const_expr_analyzer(uchar **arg)
{
// Item_name_const always wraps a literal, so there is no need to cache it.
return false;
}
int save_in_field(Field *field, bool no_conversions) int save_in_field(Field *field, bool no_conversions)
{ {
return value_item->save_in_field(field, no_conversions); return value_item->save_in_field(field, no_conversions);