mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-16 03:52:35 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-32411 Item_sum arguments incorrectly reset to temp table fields which causes crash

Browse source 
The issue is caused by a logic error in Item_sum::get_tmp_table_item() method:
it resets arguments of the item to point to the result fields during
change_ref_to_tmp_fields() call. However, Item_sum arguments must not be modified.
It is enough for Item_sum objects to call ancestor's implementation
Item::get_tmp_table_item().

This fix is in accordance with MySQL commit 2e3dc09087c24798c90e05163ed3d931f6b93db3

Reviewer: Oleksandr Byelkin <sanja@mariadb.com>
This commit is contained in:
Oleg Smirnov 2024-12-26 17:30:11 +07:00
parent 3bbbeae792
commit 505b7127c9
4 changed files with 20 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
mysql-test/main/win_sum.result
View file

@ -105,3 +105,12 @@ EXISTS (SELECT 1 ORDER BY 1+sum(2) OVER ())
# #
# End of 10.4 tests # End of 10.4 tests
# #
#
# MDEV-32411 Item_sum arguments incorrectly reset to temp table fields which causes crash
#
CREATE TABLE t1 (a INT NOT NULL) ;
INSERT INTO t1 VALUES (EXISTS(SELECT avg(3) OVER (ORDER BY COUNT(DISTINCT a, HEX(a)))));
DROP TABLE t1;
#
# End of 10.5 tests
#

11
mysql-test/main/win_sum.test
View file

@ -57,3 +57,14 @@ SELECT EXISTS (SELECT 1 ORDER BY 1+sum(2) OVER ());
--echo # --echo #
--echo # End of 10.4 tests --echo # End of 10.4 tests
--echo # --echo #
--echo #
--echo # MDEV-32411 Item_sum arguments incorrectly reset to temp table fields which causes crash
--echo #
CREATE TABLE t1 (a INT NOT NULL) ;
INSERT INTO t1 VALUES (EXISTS(SELECT avg(3) OVER (ORDER BY COUNT(DISTINCT a, HEX(a)))));
DROP TABLE t1;
--echo #
--echo # End of 10.5 tests
--echo #

21
sql/item_sum.cc
View file

@ -527,27 +527,6 @@ void Item_sum::fix_num_length_and_dec()
max_length=float_length(decimals); max_length=float_length(decimals);
} }
Item *Item_sum::get_tmp_table_item(THD *thd)
{
Item_sum* sum_item= (Item_sum *) copy_or_same(thd);
if (sum_item && sum_item->result_field) // If not a const sum func
{
Field *result_field_tmp= sum_item->result_field;
for (uint i=0 ; i < sum_item->arg_count ; i++)
{
Item *arg= sum_item->args[i];
if (!arg->const_item())
{
if (arg->type() == Item::FIELD_ITEM)
((Item_field*) arg)->field= result_field_tmp++;
else
sum_item->args[i]= new (thd->mem_root) Item_temptable_field(thd, result_field_tmp++);
}
}
}
return sum_item;
}
void Item_sum::update_used_tables () void Item_sum::update_used_tables ()
{ {

1
sql/item_sum.h
View file

@ -521,7 +521,6 @@ public:
aggregator_clear(); aggregator_clear();
} }
virtual void make_unique() { force_copy_fields= TRUE; } virtual void make_unique() { force_copy_fields= TRUE; }
Item *get_tmp_table_item(THD *thd) override;
virtual Field *create_tmp_field(MEM_ROOT *root, bool group, TABLE *table); virtual Field *create_tmp_field(MEM_ROOT *root, bool group, TABLE *table);
Field *create_tmp_field_ex(MEM_ROOT *root, TABLE *table, Tmp_field_src *src, Field *create_tmp_field_ex(MEM_ROOT *root, TABLE *table, Tmp_field_src *src,
const Tmp_field_param *param) override const Tmp_field_param *param) override