mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-29 02:05:57 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix for bug #54575: crash when joining tables with unique set column(backport from 5.1)

Browse source 
Problem: a flaw (derefencing a NULL pointer) in the LIKE optimization
code may lead to a server crash in some rare cases.

Fix: check the pointer before its dereferencing.


mysql-test/r/func_like.result:
  Fix for bug #54575: crash when joining tables with unique set column
    - test result.
mysql-test/t/func_like.test:
  Fix for bug #54575: crash when joining tables with unique set column
    - test case.
sql/item_cmpfunc.cc:
  Fix for bug #54575: crash when joining tables with unique set column
  - check res2 buffer pointer before its dereferencing 
    as it may be NULL in some cases.
This commit is contained in:
Sergey Glukhov 2010-11-08 13:34:27 +03:00
parent 33ec6f801b
commit 0a29baba4b
3 changed files with 34 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
mysql-test/r/func_like.result
View file

@ -165,3 +165,17 @@ select 'andre%' like 'andre
select _cp1251'andre%' like convert('andreÊ%' using cp1251) escape 'Ê';
_cp1251'andre%' like convert('andreÊ%' using cp1251) escape 'Ê'
1
End of 4.1 tests
#
# Bug #54575: crash when joining tables with unique set column
#
CREATE TABLE t1(a SET('a') NOT NULL, UNIQUE KEY(a));
CREATE TABLE t2(b INT PRIMARY KEY);
INSERT INTO t1 VALUES ();
Warnings:
Warning 1364 Field 'a' doesn't have a default value
INSERT INTO t2 VALUES (1), (2), (3);
SELECT 1 FROM t2 JOIN t1 ON 1 LIKE a GROUP BY a;
1
DROP TABLE t1, t2;
End of 5.1 tests

18
mysql-test/t/func_like.test
View file

@ -112,5 +112,19 @@ select 'andre%' like 'andre
#
select _cp1251'andre%' like convert('andreÊ%' using cp1251) escape 'Ê';
#
# End of 4.1 tests
--echo End of 4.1 tests
--echo #
--echo # Bug #54575: crash when joining tables with unique set column
--echo #
CREATE TABLE t1(a SET('a') NOT NULL, UNIQUE KEY(a));
CREATE TABLE t2(b INT PRIMARY KEY);
INSERT INTO t1 VALUES ();
INSERT INTO t2 VALUES (1), (2), (3);
SELECT 1 FROM t2 JOIN t1 ON 1 LIKE a GROUP BY a;
DROP TABLE t1, t2;
--echo End of 5.1 tests

7
sql/item_cmpfunc.cc
View file

@ -4220,13 +4220,14 @@ Item_func::optimize_type Item_func_like::select_optimize() const
if (args[1]->const_item())
{
String* res2= args[1]->val_str((String *)&tmp_value2);
const char *ptr2;
if (!res2)
if (!res2 || !(ptr2= res2->ptr()))
return OPTIMIZE_NONE;
if (*res2->ptr() != wild_many)
if (*ptr2 != wild_many)
{
if (args[0]->result_type() != STRING_RESULT || *res2->ptr() != wild_one)
if (args[0]->result_type() != STRING_RESULT || *ptr2 != wild_one)
return OPTIMIZE_OP;
}
}