1
0
mirror of https://github.com/MariaDB/server.git synced 2026-10-23 18:49:29 +03:00
Files
Khaled Riyad 9e1744908f MDEV-38004 Double free on re-execution of prepared aggregate function
Between two executions of a prepared statement, Item_sp::cleanup() freed
the stored function's memory root but left the arena's free list pointing
into it. That list is filled when the function call returns and the active
arena is restored.

On the next execution Item_sum_sp::clear() walked the stale list and
destroyed already freed items.

Free the items before the memory they live in.  The sequence is now
in Item_sp::free_call_ctx(), so the three places that repeat it
cannot drift apart again.
2026-10-05 14:27:02 +03:00
..
…
2026-07-23 11:12:27 +02:00
2026-07-23 11:12:27 +02:00
…
2025-09-04 18:08:39 +03:00
2024-01-17 13:35:05 +02:00
…
…
…
2024-11-29 13:43:17 +02:00
2024-11-29 12:37:46 +02:00
2024-10-29 15:24:38 +01:00
…
2025-09-04 18:08:39 +03:00
2023-12-17 11:20:43 +01:00
…
…
…
2026-07-23 11:12:27 +02:00
2025-02-27 04:02:33 +01:00
2025-09-04 18:08:39 +03:00
2024-11-29 13:43:17 +02:00
…
…
2024-11-29 13:43:17 +02:00
2024-12-05 10:11:58 +01:00
2026-08-19 08:13:54 +02:00
2026-01-28 14:22:20 +01:00
2026-01-28 14:22:20 +01:00
2026-01-28 14:22:20 +01:00
2026-01-28 14:22:20 +01:00
2026-07-23 11:12:27 +02:00
2026-01-28 14:22:20 +01:00
2024-11-29 13:43:17 +02:00
2023-11-08 16:23:30 +01:00
…
2024-06-27 10:26:09 +03:00
2024-06-24 13:09:47 +03:00
…
…
2025-09-04 18:08:39 +03:00
…
2023-11-08 16:23:30 +01:00
2026-08-19 08:13:54 +02:00
2023-10-14 13:36:11 +03:00
2026-01-28 14:22:20 +01:00
2025-09-04 18:08:39 +03:00
2025-09-04 18:08:39 +03:00
2026-04-20 11:07:30 +03:00
2023-12-18 11:19:04 +01:00
2024-11-29 12:37:46 +02:00
…
2024-06-24 13:09:47 +03:00
2025-09-04 18:08:39 +03:00
2025-09-04 18:08:39 +03:00
2025-09-04 18:08:39 +03:00
2024-07-22 15:14:50 +02:00
2026-06-15 10:43:23 +02:00
2026-06-15 10:43:23 +02:00
2025-10-28 17:49:51 +01:00
2025-10-28 17:49:51 +01:00
2026-07-23 11:12:27 +02:00
2024-11-29 12:37:46 +02:00
2026-08-19 08:13:54 +02:00
2025-09-04 18:08:39 +03:00
2025-01-10 13:14:42 +01:00
2024-06-24 13:09:47 +03:00
2025-01-30 11:55:13 +01:00
2025-01-30 11:55:13 +01:00
2023-07-10 11:22:21 +03:00
2024-11-29 13:43:17 +02:00
2024-11-29 13:43:17 +02:00
2026-08-19 08:13:54 +02:00
2025-09-04 18:08:39 +03:00
2024-01-18 19:22:23 +02:00
2025-09-04 18:08:39 +03:00
2024-11-23 08:14:22 -07:00
2026-01-02 11:06:05 +02:00
2026-07-23 11:12:27 +02:00
2026-07-23 11:12:27 +02:00
2026-03-17 18:57:42 +01:00
2026-01-28 14:22:20 +01:00
…
2024-08-20 10:00:39 +02:00
2025-09-04 18:08:39 +03:00
2024-06-27 10:26:09 +03:00
2024-12-17 11:06:09 +11:00
2024-11-29 12:37:46 +02:00
…
2025-09-19 12:31:14 +03:00
2025-09-04 18:08:39 +03:00
2025-09-04 18:08:39 +03:00
2023-05-23 12:25:39 +03:00
2024-06-11 12:50:10 +03:00
2024-04-15 18:54:30 +02:00
2026-01-28 14:22:20 +01:00
2024-07-03 12:45:30 +02:00
2023-08-04 08:01:06 +02:00
2026-07-23 11:12:27 +02:00
2023-12-17 11:20:43 +01:00
2026-07-23 11:12:27 +02:00
2023-12-02 01:02:50 +01:00
2025-09-04 18:08:39 +03:00
2025-09-04 18:08:39 +03:00
2026-03-17 11:05:34 +02:00
2024-03-27 15:00:56 +02:00
2025-09-04 18:08:39 +03:00
2026-07-23 11:12:27 +02:00
2025-01-20 09:57:37 +02:00
2025-03-27 08:01:47 +02:00
2023-09-25 13:06:57 +10:00
2024-01-18 19:22:23 +02:00
2023-08-01 15:08:52 +02:00
2024-11-23 08:14:22 -07:00
2024-11-23 08:14:23 -07:00
2026-08-19 08:13:54 +02:00
2026-07-23 11:12:27 +02:00
2026-07-23 11:12:27 +02:00
2024-01-10 18:01:46 +11:00
2025-09-04 18:08:39 +03:00
2025-09-04 18:08:39 +03:00
2024-06-24 13:09:47 +03:00
…
2025-09-04 18:08:39 +03:00
…
2024-11-29 13:43:17 +02:00
2024-01-02 17:37:58 +02:00
2024-06-27 10:26:09 +03:00
2026-06-21 15:32:20 +02:00
2024-01-03 15:37:57 +02:00
2024-10-03 10:55:08 +03:00
2026-07-23 11:12:27 +02:00
2026-07-23 11:12:27 +02:00
2026-06-21 15:32:20 +02:00