mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-29 02:05:57 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-18339: ASAN heap-buffer-overflow in Item_exists_subselect::is_top_level_item

Browse source 
Right argument of Item_in_optimizer can not be cast to Item_in_subselect in invisible mode.
This commit is contained in:
Oleksandr Byelkin 2019-03-06 15:31:50 +01:00
parent 2b711d231a
commit a36ac52f93
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
sql/item_cmpfunc.cc
View file

@ -1182,6 +1182,8 @@ longlong Item_func_truth::val_int()
bool Item_in_optimizer::is_top_level_item()
{
if (invisible_mode())
return FALSE;
return ((Item_in_subselect *)args[1])->is_top_level_item();
}
@ -1237,8 +1239,7 @@ void Item_in_optimizer::print(String *str, enum_query_type query_type)
void Item_in_optimizer::restore_first_argument()
{
if (args[1]->type() == Item::SUBSELECT_ITEM &&
((Item_subselect *)args[1])->is_in_predicate())
if (!invisible_mode())
{
args[0]= ((Item_in_subselect *)args[1])->left_expr;
}
@ -1255,8 +1256,7 @@ bool Item_in_optimizer::fix_left(THD *thd)
it is args[0].
*/
Item **ref0= args;
if (args[1]->type() == Item::SUBSELECT_ITEM &&
((Item_subselect *)args[1])->is_in_predicate())
if (!invisible_mode())
{
/*
left_expr->fix_fields() may cause left_expr to be substituted for