mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-04-28 19:25:32 +02:00
Code Issues Projects Releases Packages Wiki Activity

MDEV-7821 - Server crashes in Item_func_group_concat::fix_fields on 2nd

Browse source 
execution of PS

GROUP_CONCAT() with ORDER BY column position may crash server on PS reexecution.

The problem was that arguments array of GROUP_CONCAT() was adjusted to point to
temporary elements (resolved ORDER BY fields) during first execution.

This patch expands rev. 08763096cb to restore original arguments array as well.
This commit is contained in:
Sergey Vojtovich 2015-07-30 18:51:44 +04:00
commit 1ad294e064
3 changed files with 30 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
sql/item_sum.cc
View file

@ -3300,6 +3300,8 @@ void Item_func_group_concat::cleanup()
from Item_func_group_concat::setup() to point to runtime
created objects, we need to reset them back to the original
arguments of the function.
The very same applies to args array.
*/
ORDER **order_ptr= order;
for (uint i= 0; i < arg_count_order; i++)
@ -3307,6 +3309,7 @@ void Item_func_group_concat::cleanup()
(*order_ptr)->item= &args[arg_count_field + i];
order_ptr++;
}
memcpy(args, orig_args, sizeof(Item *) * arg_count);
DBUG_VOID_RETURN;
}