Commit graph

6 commits

Author SHA1 Message Date
Georgi Kodinov
489ad44ab5 Bug #32124: crash if prepared statements refer to variables in the where clause
The code to get read the value of a system variable was extracting its value 
on PREPARE stage and was substituting the value (as a constant) into the parse tree.
Note that this must be a reversible transformation, i.e. it must be reversed before
each re-execution.
Unfortunately this cannot be reliably done using the current code, because there are
other non-reversible source tree transformations that can interfere with this
reversible transformation.
Fixed by not resolving the value at PREPARE, but at EXECUTE (as the rest of the 
functions operate). Added a cache of the value (so that it's constant throughout
the execution of the query). Note that the cache also caches NULL values.
Updated an obsolete related test suite (variables-big) and the code to test the 
result type of system variables (as per bug 74).
2008-10-08 14:23:53 +03:00
cmiller@zippy.cornsilk.net
66659796ff Bug#19356: Assert on undefined @uservar in prepared statement execute
The executing code had a safety assertion so that it refused to free Items
that it didn't create.  However, there is a case, undefined user variables,
which would put Items into the list to be freed.

Instead, do something that is more risky in expectation that the code will 
be refactored soon, as Kostja wants to do:  Remove the assertions from 
prepare() and execute().  Put one assertion at a higher level, before 
stmt->set_params_from_vars(), which may then create new to-be-freed Items .
2006-10-04 11:19:23 -04:00
gkodinov@lsmy3.wdf.sap.corp
ca79343359 BUG#18492: mysqld reports ER_ILLEGAL_REFERENCE in --ps-protocol
In the code that converts IN predicates to EXISTS predicates it is changing
the select list elements to constant 1. Example :
SELECT ... FROM ...  WHERE a IN (SELECT c FROM ...)
is transformed to :
SELECT ... FROM ... WHERE EXISTS (SELECT 1 FROM ...  HAVING a = c)
However there can be no FROM clause in the IN subquery and it may not be
a simple select : SELECT ... FROM ... WHERE a IN (SELECT f(..) AS
c UNION SELECT ...) This query is transformed to : SELECT ... FROM ...
WHERE EXISTS (SELECT 1 FROM (SELECT f(..) AS c UNION SELECT ...)
x HAVING a = c) In the above query c in the HAVING clause is made to be
an Item_null_helper (a subclass of Item_ref) pointing to the real
Item_field (which is not referenced anywhere else in the query anymore).
This is done because Item_ref_null_helper collects information whether
there are NULL values in the result.  This is OK for directly executed
statements, because the Item_field pointed by the Item_null_helper is
already fixed when the transformation is done.  But when executed as
a prepared statement all the Item instances are "un-fixed" before the
recompilation of the prepared statement. So when the Item_null_helper
gets fixed it discovers that the Item_field it points to is not fixed
and issues an error.  The remedy is to keep the original select list
references when there are no tables in the FROM clause. So the above
becomes : SELECT ... FROM ...  WHERE EXISTS (SELECT c FROM (SELECT f(..)
AS c UNION SELECT ...) x HAVING a = c) In this way c is referenced
directly in the select list as well as by reference in the HAVING
clause. So it gets correctly fixed even with prepared statements.  And
since the Item_null_helper subclass of Item_ref_null_helper is not used
anywhere else it's taken out.
2006-04-28 11:23:31 +02:00
joerg@mysql.com
1354b1bd5d New tests for bug#1644 and bug#1676,
test for bug#1180 changed to table naming scheme 't#'.
2004-10-15 12:56:57 +02:00
joerg@mysql.com
0290e159fb There were no tests for bug#1644 and bug#1676, added them now. 2004-10-14 13:22:25 +02:00
joerg@mysql.com
ae8800d8d3 New tests for prepared statements:
- 'ps_10nestset' uses a "nested set" approach for an employee 
  hierarchy, then does arithmetic on the "salary" field;
  (soon) to be extended by inserts / deletes which imply
  mass updates on the "l"/"r" fields showing the set inclusion,
- 'ps_11bugs' will get (some of ?) those bug DB entries which
  refer to prepared statements, but whose number does not appear
  in a test file comment - so it will also be extended.
2004-10-12 16:00:50 +02:00