mariadb/mysql-test/main/prepare.result
Sergei Golubchik 6cb84346e1 MDEV-17869 AddressSanitizer: use-after-poison in Item_change_list::rollback_item_tree_changes
it's incorrect to use change_item_tree() to replace arguments
of top-level AND/OR, because they (arguments) are stored in a List,
so a pointer to an argument is in the list_node, and individual
list_node's of top-level AND/OR can be deleted in Item_cond::build_equal_items().
In that case rollback_item_tree_changes() will modify the deleted object.

Luckily, it's not needed to use change_item_tree() for top-level
AND/OR, because the whole top-level item is copied and preserved
in prep_where and prep_on, and restored from there.

So, just don't.

Additionally to the test case in the commit it fixes
* ASAN failure of main.opt_tvc --ps
* ASAN failure of main.having_cond_pushdown --ps
2023-01-09 18:06:06 +01:00

82 lines
1.9 KiB
Text

PREPARE stmt1 FROM "
SELECT table_name FROM information_schema.tables
WHERE table_name = 't1_first'
UNION ALL
SELECT table_name FROM information_schema.tables
WHERE table_name = 't1_second'";
execute stmt1;
table_name
execute stmt1;
table_name
create or replace table t1 (a int primary key, table_name char(40));
insert into t1 values(1,"t1_first");
insert into t1 values(2,"t1_second");
PREPARE stmt2 FROM "
SELECT table_name FROM t1
WHERE table_name = 't1_first'
UNION ALL
SELECT table_name FROM t1
WHERE table_name = 't1_second'";
execute stmt2;
table_name
t1_first
t1_second
execute stmt2;
table_name
t1_first
t1_second
flush tables;
execute stmt2;
table_name
t1_first
t1_second
alter table t1 add column b int;
execute stmt2;
table_name
t1_first
t1_second
execute stmt2;
table_name
t1_first
t1_second
drop table t1;
execute stmt2;
ERROR 42S02: Table 'test.t1' doesn't exist
create or replace table t1 (a int primary key, table_name char(40));
insert into t1 values(1,"t1_first");
execute stmt2;
table_name
t1_first
deallocate prepare stmt1;
deallocate prepare stmt2;
drop table t1;
#
# MDEV-25808 PREPARE/EXECUTE makes signed integer out of unsigned
#
prepare p1 from 'select concat(?)';
execute p1 using 17864960750176564435;
concat(?)
17864960750176564435
prepare p1 from 'select SQRT(?) is not null';
execute p1 using 17864960750176564435;
SQRT(?) is not null
1
#
# End of 10.3 tests
#
#
# MDEV-17869 AddressSanitizer: use-after-poison in Item_change_list::rollback_item_tree_changes
#
create table t1 (pk int, v1 varchar(1));
insert t1 values (1,'v'),(2,'v'),(3,'c');
create table t2 (pk int, v1 varchar(1));
insert t2 values (1,'x');
create table t3 (pk int, i1 int, v1 varchar(1));
insert t3 values (10,8,9);
execute immediate 'select straight_join 1 from (t1 join t2 on (t1.v1 = t2.v1))
where (3, 6) in (select tc.pk, t3.i1 from (t3 join t1 as tc on (tc.v1 = t3.v1)) having tc.pk > 1 );';
1
drop table t1, t2, t3;
#
# End of 10.4 tests
#