mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-30 10:31:54 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-15947 ASAN heap-use-after-free in Item_ident::print or in my_strcasecmp_utf8 or unexpected ER_BAD_FIELD_ERROR upon call of stored procedure reading from versioned table

Browse source 
Closes #728
This commit is contained in:
Eugene Kosov 2018-04-26 09:37:59 +03:00 • committed by Sergei Golubchik
parent 133cfe39f1
commit b5184c7efb
4 changed files with 30 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
mysql-test/suite/versioning/r/select.result
View file

@ -557,6 +557,18 @@ i
call p(3); call p(3);
i i
1 1
#
# MDEV-15947 ASAN heap-use-after-free in Item_ident::print or in my_strcasecmp_utf8 or unexpected ER_BAD_FIELD_ERROR upon call of stored procedure reading from versioned table
#
create or replace table t1 (i int) with system versioning;
create or replace procedure p() select * from t1;
call p;
i
flush tables;
call p;
i
call p;
i
drop procedure p; drop procedure p;
drop table t1; drop table t1;
call verify_trt_dummy(34); call verify_trt_dummy(34);

10
mysql-test/suite/versioning/t/select.test
View file

@ -363,6 +363,16 @@ call p(1);
alter table t1 add system versioning; alter table t1 add system versioning;
call p(2); call p(2);
call p(3); call p(3);
--echo #
--echo # MDEV-15947 ASAN heap-use-after-free in Item_ident::print or in my_strcasecmp_utf8 or unexpected ER_BAD_FIELD_ERROR upon call of stored procedure reading from versioned table
--echo #
create or replace table t1 (i int) with system versioning;
create or replace procedure p() select * from t1;
call p;
flush tables;
call p;
call p;
drop procedure p; drop procedure p;
drop table t1; drop table t1;

4
sql/sql_class.h
View file

@ -3669,6 +3669,10 @@ public:
lex_str->length= length; lex_str->length= length;
return lex_str; return lex_str;
} }
LEX_CSTRING *make_clex_string(const LEX_CSTRING from)
{
return make_clex_string(from.str, from.length);
}
// Allocate LEX_STRING for character set conversion // Allocate LEX_STRING for character set conversion
bool alloc_lex_string(LEX_STRING *dst, size_t length) bool alloc_lex_string(LEX_STRING *dst, size_t length)

6
sql/sql_select.cc
View file

@ -822,8 +822,10 @@ int SELECT_LEX::vers_setup_conds(THD *thd, TABLE_LIST *tables)
lock_type= TL_READ; // ignore TL_WRITE, history is immutable anyway lock_type= TL_READ; // ignore TL_WRITE, history is immutable anyway
} }
const LEX_CSTRING *fstart= &table->table->vers_start_field()->field_name; const LEX_CSTRING *fstart=
const LEX_CSTRING *fend= &table->table->vers_end_field()->field_name; thd->make_clex_string(table->table->vers_start_field()->field_name);
const LEX_CSTRING *fend=
thd->make_clex_string(table->table->vers_end_field()->field_name);
Item *row_start= Item *row_start=
newx Item_field(thd, &this->context, table->db.str, table->alias.str, fstart); newx Item_field(thd, &this->context, table->db.str, table->alias.str, fstart);