diff options
| author | Martin Hansson <martin.hansson@oracle.com> | 2011-01-12 09:55:31 +0100 |
|---|---|---|
| committer | Martin Hansson <martin.hansson@oracle.com> | 2011-01-12 09:55:31 +0100 |
| commit | 73d88e8002952b7833421e67de7ef54b6e6ca7ec (patch) | |
| tree | 06930793ac389b84570ac6701c4ee37b3c58c77d | |
| parent | 5148eda6fc38ac477be46fa9603c2426a26d6e82 (diff) | |
| download | mariadb-git-73d88e8002952b7833421e67de7ef54b6e6ca7ec.tar.gz | |
Bug#58207: invalid memory reads when using default column value and
tmptable needed
The function DEFAULT() works by modifying the the data buffer pointers (often
referred to as 'record' or 'table record') of its argument. This modification
is done during name resolution (fix_fields().) Unfortunately, the same
modification is done when creating a temporary table, because default values
need to propagate to the new table.
Fixed by skipping the pointer modification for fields that are arguments to
the DEFAULT function.
| -rw-r--r-- | mysql-test/r/subselect4.result | 11 | ||||
| -rw-r--r-- | mysql-test/t/subselect4.test | 10 | ||||
| -rw-r--r-- | sql/sql_select.cc | 7 |
3 files changed, 27 insertions, 1 deletions
diff --git a/mysql-test/r/subselect4.result b/mysql-test/r/subselect4.result index 63265970c4b..47157a61731 100644 --- a/mysql-test/r/subselect4.result +++ b/mysql-test/r/subselect4.result @@ -164,5 +164,16 @@ a b 2 NULL DROP TABLE t1, t2, t3, t4, t5; # +# Bug#58207: invalid memory reads when using default column value and +# tmptable needed +# +CREATE TABLE t(a VARCHAR(245) DEFAULT +'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'); +INSERT INTO t VALUES (''),(''),(''),(''),(''),(''),(''),(''),(''),(''),(''); +SELECT * FROM (SELECT default(a) FROM t GROUP BY a) d; +default(a) +aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa +DROP TABLE t; +# # End of 5.1 tests. # diff --git a/mysql-test/t/subselect4.test b/mysql-test/t/subselect4.test index eb8baf9bac8..b8ab655da42 100644 --- a/mysql-test/t/subselect4.test +++ b/mysql-test/t/subselect4.test @@ -136,6 +136,16 @@ SELECT * FROM t1 WHERE NULL NOT IN ( SELECT c FROM t2 WHERE c = 1 AND c <> 1 ); DROP TABLE t1, t2, t3, t4, t5; +--echo # +--echo # Bug#58207: invalid memory reads when using default column value and +--echo # tmptable needed +--echo # +CREATE TABLE t(a VARCHAR(245) DEFAULT +'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'); +INSERT INTO t VALUES (''),(''),(''),(''),(''),(''),(''),(''),(''),(''),(''); +SELECT * FROM (SELECT default(a) FROM t GROUP BY a) d; +DROP TABLE t; + --echo # --echo # End of 5.1 tests. diff --git a/sql/sql_select.cc b/sql/sql_select.cc index 067f3cfc95d..8cc2ec6a0f8 100644 --- a/sql/sql_select.cc +++ b/sql/sql_select.cc @@ -9816,7 +9816,12 @@ Field *create_tmp_field(THD *thd, TABLE *table,Item *item, Item::Type type, convert_blob_length); if (orig_type == Item::REF_ITEM && orig_modify) ((Item_ref*)orig_item)->set_result_field(result); - if (field->field->eq_def(result)) + /* + Fields that are used as arguments to the DEFAULT() function already have + their data pointers set to the default value during name resulotion. See + Item_default_value::fix_fields. + */ + if (orig_type != Item::DEFAULT_VALUE_ITEM && field->field->eq_def(result)) *default_field= field->field; return result; } |