diff options
| author | Alexey Kopytov <Alexey.Kopytov@Sun.com> | 2010-08-24 14:35:48 +0400 |
|---|---|---|
| committer | Alexey Kopytov <Alexey.Kopytov@Sun.com> | 2010-08-24 14:35:48 +0400 |
| commit | 0e74ac50285b15fae7fda70a809c9b42027e88c2 (patch) | |
| tree | e632c3ba6d403157c6e6c9a0fb13660b8dcd7183 /sql/field.cc | |
| parent | 62aa8943b8b0603fe4a01a4248f5fa89a133cf9f (diff) | |
| download | mariadb-git-0e74ac50285b15fae7fda70a809c9b42027e88c2.tar.gz | |
Bug #55568: user variable assignments crash server when used
within query
The server could crash after materializing a derived table
which requires a temporary table for grouping.
When destroying the temporary table used to execute a query for
a derived table, JOIN::destroy() did not clean up Item_fields
pointing to fields in the temporary table. This led to
dereferencing a dangling pointer when printing out the items
tree later in the outer SELECT.
The solution is an addendum to the patch for bug37362: in
addition to cleaning up items in tmp_all_fields3, do the same
for items in tmp_all_fields1, since now we have an example
where this is necessary.
Diffstat (limited to 'sql/field.cc')
| -rw-r--r-- | sql/field.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sql/field.cc b/sql/field.cc index c887a5f1c9b..619e6a780da 100644 --- a/sql/field.cc +++ b/sql/field.cc @@ -1535,7 +1535,7 @@ void Field::make_field(Send_field *field) } else field->org_table_name= field->db_name= ""; - if (orig_table) + if (orig_table && orig_table->alias) { field->table_name= orig_table->alias; field->org_col_name= field_name; |