Oleg Smirnov d051e8663a MDEV-32326 Recursive CTE reference in a scalar subquery must be rejected ...

A recursive reference to a WITH RECURSIVE table that is reachable only
through a scalar subquery (in particular through a WITH clause nested
inside such a subquery) was not recognized as a subquery reference. As a
result the recursive CTE was wrongly accepted as standard-compliant instead
of being rejected with ER_NOT_STANDARD_COMPLIANT_RECURSIVE, and execution
later dereferenced an uninitialized join_tab for that reference in
st_select_lex_unit::exec_recursive(), crashing the server.

The cause was in With_element::check_dependencies_in_unit(). The flag
marking that we are inside a subquery (in_subq) was updated only after the
unit's own WITH clause had already been analyzed. Hence dependencies
discovered while descending into a WITH clause attached to a scalar
subquery were recorded in top_level_dep_map instead of sq_dep_map, so
contains_sq_with_recursive_reference() failed to report the violation.

The fix: set in_subq from unit->item before processing the unit's WITH
clause, so that dependencies found in nested WITH clauses of a scalar
subquery are correctly attributed to the subquery context.

The expected error for the MDEV-32299 cases in cte_recursive.test changes
accordingly from ER_BAD_FIELD_ERROR to ER_NOT_STANDARD_COMPLIANT_RECURSIVE:
the query is now rejected at dependency analysis for its non-compliant
recursive reference rather than failing later during name resolution. The
test still verifies that no crash occurs.

2026-06-22 22:26:08 +07:00

56 KiB

Raw Permalink Blame History

View Raw