mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-29 10:14:19 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

BUG#36737 - having + full text operator crashes mysql

Browse source 
MATCH() function accepts column list as an argument. It was possible to override
this requirement with aliased non-column select expression. Which results in
server crash.

With this fix aliased non-column select expressions are not accepted by MATCH()
function, returning an error.

mysql-test/r/fulltext.result:
  A test case for BUG#36737.
mysql-test/t/fulltext.test:
  A test case for BUG#36737.
sql/item_func.cc:
  Only accept fields as arguments to MATCH().
This commit is contained in:
Sergey Vojtovich 2009-02-12 13:49:44 +04:00
parent 7df0e72c7f
commit 5803e10628
3 changed files with 16 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
mysql-test/r/fulltext.result
View file

@ -506,3 +506,7 @@ SELECT MATCH(a) AGAINST('aaa1* aaa14 aaa15 aaa16' IN BOOLEAN MODE) FROM t1;
MATCH(a) AGAINST('aaa1* aaa14 aaa15 aaa16' IN BOOLEAN MODE)
2
DROP TABLE t1;
CREATE TABLE t1(a TEXT);
SELECT GROUP_CONCAT(a) AS st FROM t1 HAVING MATCH(st) AGAINST('test' IN BOOLEAN MODE);
ERROR HY000: Incorrect arguments to AGAINST
DROP TABLE t1;

8
mysql-test/t/fulltext.test
View file

@ -432,3 +432,11 @@ INSERT INTO t1 VALUES('aaa15');
SELECT MATCH(a) AGAINST('aaa1* aaa14 aaa16' IN BOOLEAN MODE) FROM t1;
SELECT MATCH(a) AGAINST('aaa1* aaa14 aaa15 aaa16' IN BOOLEAN MODE) FROM t1;
DROP TABLE t1;
#
# BUG#36737 - having + full text operator crashes mysql
#
CREATE TABLE t1(a TEXT);
--error ER_WRONG_ARGUMENTS
SELECT GROUP_CONCAT(a) AS st FROM t1 HAVING MATCH(st) AGAINST('test' IN BOOLEAN MODE);
DROP TABLE t1;

5
sql/item_func.cc
View file

@ -4961,7 +4961,10 @@ bool Item_func_match::fix_fields(THD *thd, Item **ref)
if (item->type() == Item::REF_ITEM)
args[i]= item= *((Item_ref *)item)->ref;
if (item->type() != Item::FIELD_ITEM)
key=NO_SUCH_KEY;
{
my_error(ER_WRONG_ARGUMENTS, MYF(0), "AGAINST");
return TRUE;
}
}
/*
Check that all columns come from the same table.