diff options
| author | Georgi Kodinov <joro@sun.com> | 2009-07-10 15:00:34 +0300 |
|---|---|---|
| committer | Georgi Kodinov <joro@sun.com> | 2009-07-10 15:00:34 +0300 |
| commit | 5a6809590c02a0bf851c8e6b89fd3fcabfecbca1 (patch) | |
| tree | 3033d4ebf823a0f3acbf53be3952670e3ab4c4de /sql/item_sum.cc | |
| parent | 74f76a439a8d4b59bde88c100dffa0fb0a9b31b8 (diff) | |
| download | mariadb-git-5a6809590c02a0bf851c8e6b89fd3fcabfecbca1.tar.gz | |
Bug #46080: group_concat(... order by) crashes server when
sort_buffer_size cannot allocate
The NULL return from tree_insert() (on low memory) was not
checked for in Item_func_group_concat::add(). As a result
on low memory conditions a crash happens.
Fixed by properly checking the return code.
Diffstat (limited to 'sql/item_sum.cc')
| -rw-r--r-- | sql/item_sum.cc | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sql/item_sum.cc b/sql/item_sum.cc index a381361e8a2..dde8fe29e5a 100644 --- a/sql/item_sum.cc +++ b/sql/item_sum.cc @@ -3291,8 +3291,13 @@ bool Item_func_group_concat::add() TREE_ELEMENT *el= 0; // Only for safety if (row_eligible && tree) + { el= tree_insert(tree, table->record[0] + table->s->null_bytes, 0, tree->custom_arg); + /* check if there was enough memory to insert the row */ + if (!el) + return 1; + } /* If the row is not a duplicate (el->count == 1) we can dump the row here in case of GROUP_CONCAT(DISTINCT...) |