mirror of
https://github.com/MariaDB/server.git
synced 2025-01-30 02:30:06 +01:00
Fixed bug where we could reference a freed tmp_table->table_name variable for some
GROUP BY ... ORDER BY queries.
This commit is contained in:
parent
adf7809c04
commit
9b1d5b6f5f
2 changed files with 12 additions and 1 deletions
|
@ -46928,6 +46928,12 @@ not yet 100% confident in this code.
|
|||
|
||||
@node News-3.23.54, News-3.23.53, News-3.23.x, News-3.23.x
|
||||
@appendixsubsec Changes in release 3.23.54
|
||||
@itemize
|
||||
Fixed reference to freed memory when doing complicated @code{GROUP BY
|
||||
... ORDER BY} queries. Symptom was that @code{mysqld} died in function
|
||||
@code{send_fields}.
|
||||
queries.
|
||||
@end itemize
|
||||
|
||||
@node News-3.23.53, News-3.23.52, News-3.23.54, News-3.23.x
|
||||
@appendixsubsec Changes in release 3.23.53
|
||||
|
|
|
@ -3395,7 +3395,10 @@ create_tmp_table(THD *thd,TMP_TABLE_PARAM *param,List<Item> &fields,
|
|||
bzero((char*) from_field,sizeof(Field*)*field_count);
|
||||
table->field=reg_field;
|
||||
table->real_name=table->path=tmpname;
|
||||
table->table_name=base_name(tmpname);
|
||||
/*
|
||||
This must be "" as field may refer to it after tempory table is dropped
|
||||
*/
|
||||
table->table_name= (char*) "";
|
||||
table->reginfo.lock_type=TL_WRITE; /* Will be updated */
|
||||
table->db_stat=HA_OPEN_KEYFILE+HA_OPEN_RNDFILE;
|
||||
table->blob_ptr_size=mi_portable_sizeof_char_ptr;
|
||||
|
@ -3731,6 +3734,8 @@ create_tmp_table(THD *thd,TMP_TABLE_PARAM *param,List<Item> &fields,
|
|||
if (create_myisam_tmp_table(table,param,select_options))
|
||||
goto err;
|
||||
}
|
||||
/* Set table_name for easier debugging */
|
||||
table->table_name= base_name(tmpname);
|
||||
if (!open_tmp_table(table))
|
||||
DBUG_RETURN(table);
|
||||
|
||||
|
|
Loading…
Add table
Reference in a new issue