mariadb/mysql-test/t/explain.test
unknown 1c1dd1f25c Fix for bug #32241: memory corruption due to large index map in 'Range
checked for each record'

The problem was in incorrectly calculated length of the buffer used to
store a hexadecimal representation of an index map in
select_describe(). This could result in buffer overrun and stack
corruption under some circumstances.

Fixed by correcting the calculation.


mysql-test/r/explain.result:
  Added a test case for bug #32241.
mysql-test/t/explain.test:
  Added a test case for bug #32241.
sql/sql_select.cc:
  Corrected the buffer length calculation. Count one hex digit as 4 bits,
  not 8.
2007-11-16 13:58:09 +03:00

97 lines
2.6 KiB
Text

#
# Test of different EXPLAIN's
--disable_warnings
drop table if exists t1;
--enable_warnings
create table t1 (id int not null, str char(10), unique(str));
explain select * from t1;
insert into t1 values (1, null),(2, null),(3, "foo"),(4, "bar");
select * from t1 where str is null;
select * from t1 where str="foo";
explain select * from t1 where str is null;
explain select * from t1 where str="foo";
explain select * from t1 ignore key (str) where str="foo";
explain select * from t1 use key (str,str) where str="foo";
#The following should give errors
--error 1176
explain select * from t1 use key (str,str,foo) where str="foo";
--error 1176
explain select * from t1 ignore key (str,str,foo) where str="foo";
drop table t1;
explain select 1;
create table t1 (a int not null);
explain select count(*) from t1;
insert into t1 values(1);
explain select count(*) from t1;
insert into t1 values(1);
explain select count(*) from t1;
drop table t1;
#
# Bug #3403 Wrong encoding in EXPLAIN SELECT output
#
set names koi8r;
create table ÔÁÂ (ËÏÌ0 int, ËÏÌ1 int, key ÉÎÄ0 (ËÏÌ0), key ÉÎÄ01 (ËÏÌ0,ËÏÌ1));
insert into ÔÁÂ (ËÏÌ0) values (1);
insert into ÔÁÂ (ËÏÌ0) values (2);
explain select ËÏÌ0 from ÔÁÂ where ËÏÌ0=1;
drop table ÔÁÂ;
set names latin1;
# End of 4.1 tests
#
# Bug#15463: EXPLAIN SELECT..INTO hangs the client (QB, command line)
#
select 3 into @v1;
explain select 3 into @v1;
#
# Bug#22331: Wrong WHERE in EXPLAIN EXTENDED when all expressions were
# optimized away.
#
create table t1(f1 int, f2 int);
insert into t1 values (1,1);
create view v1 as select * from t1 where f1=1;
explain extended select * from v1 where f2=1;
explain extended select * from t1 where 0;
explain extended select * from t1 where 1;
explain extended select * from t1 having 0;
explain extended select * from t1 having 1;
drop view v1;
drop table t1;
#
# Bug #32241: memory corruption due to large index map in 'Range checked for
# each record'
#
CREATE TABLE t1(c INT);
INSERT INTO t1 VALUES (),();
CREATE TABLE t2 (b INT,
KEY(b),KEY(b),KEY(b),KEY(b),KEY(b),
KEY(b),KEY(b),KEY(b),KEY(b),KEY(b),
KEY(b),KEY(b),KEY(b),KEY(b),KEY(b),
KEY(b),KEY(b),KEY(b),KEY(b),KEY(b),
KEY(b),KEY(b),KEY(b),KEY(b),KEY(b),
KEY(b),KEY(b),KEY(b),KEY(b),KEY(b),
KEY(b),KEY(b),KEY(b),KEY(b),KEY(b),
KEY(b),KEY(b),KEY(b),KEY(b),KEY(b));
INSERT INTO t2 VALUES (),(),();
# We only need to make sure that there is no buffer overrun and the index map
# is displayed correctly
--replace_column 1 X 2 X 3 X 4 X 5 X 6 X 7 X 8 X 9 X
EXPLAIN SELECT 1 FROM
(SELECT 1 FROM t2,t1 WHERE b < c GROUP BY 1 LIMIT 1) AS d2;
DROP TABLE t2;
DROP TABLE t1;
# End of 5.0 tests.