mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-18 04:53:01 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixed bug #27362: crash at evaluation of IN predicate when one

Browse source 
of its argument happened to be a decimal expression returning
the NULL value.
The crash was due to the fact the function in_decimal::set did
not take into account that val_decimal() could return 0 if 
the decimal expression had been evaluated to NULL.
This commit is contained in:
igor@olga.mysql.com 2007-03-22 00:05:36 -07:00
parent e2c9c9cc20
commit 03ae298ec3
3 changed files with 18 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
mysql-test/r/func_in.result
View file

@ -470,4 +470,9 @@ a
Warnings:
Warning 1292 Incorrect date value: '19772-07-29' for column 'a' at row 1
DROP TABLE t1,t2,t3,t4;
CREATE TABLE t1 (id int not null);
INSERT INTO t1 VALUES (1),(2);
SELECT id FROM t1 WHERE id IN(4564, (SELECT IF(1=0,1,1/0)) );
id
DROP TABLE t1;
End of 5.0 tests

11
mysql-test/t/func_in.test
View file

@ -360,4 +360,15 @@ SELECT * FROM t4 WHERE a IN ('1972-02-06','19772-07-29');
DROP TABLE t1,t2,t3,t4;
#
# BUG#27362: IN with a decimal expression that may return NULL
#
CREATE TABLE t1 (id int not null);
INSERT INTO t1 VALUES (1),(2);
SELECT id FROM t1 WHERE id IN(4564, (SELECT IF(1=0,1,1/0)) );
DROP TABLE t1;
--echo End of 5.0 tests

3
sql/item_cmpfunc.cc
View file

@ -2423,7 +2423,8 @@ void in_decimal::set(uint pos, Item *item)
dec->len= DECIMAL_BUFF_LENGTH;
dec->fix_buffer_pointer();
my_decimal *res= item->val_decimal(dec);
if (res != dec)
/* if item->val_decimal() is evaluated to NULL then res == 0 */
if (!item->null_value && res != dec)
my_decimal2decimal(res, dec);
}