diff options
| author | Igor Babaev <igor@askmonty.org> | 2021-07-20 00:07:31 -0700 |
|---|---|---|
| committer | Igor Babaev <igor@askmonty.org> | 2021-07-20 10:37:37 -0700 |
| commit | 872422dcbbe3681a794935fb2cae422d9d5f4108 (patch) | |
| tree | 7ac4a1cbe4f8adba860b9034d9fa19bc4d2ffbc4 /sql/sql_cte.cc | |
| parent | 7da1cfb07a0dfec08b861688640bbbb7779549f6 (diff) | |
| download | mariadb-git-872422dcbbe3681a794935fb2cae422d9d5f4108.tar.gz | |
MDEV-26025 Server crashes while executing query with CTE in PS/SP
This bug appeared after the patch for bug MDEV-23886. Due to this bug
execution of queries with CTEs used the same CTE at least twice via
prepared statements or with stored procedures caused crashes of the server.
It happened because the select created for any of not the first usage of
a CTE erroneously was not included into all_selects_list.
This patch corrects the patch applied to fix the bug MDEV-26108.
Approved by Oleksandr Byelkin <sanja@mariadb.com>
Diffstat (limited to 'sql/sql_cte.cc')
| -rw-r--r-- | sql/sql_cte.cc | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/sql/sql_cte.cc b/sql/sql_cte.cc index 702db8f96d9..b720eac2317 100644 --- a/sql/sql_cte.cc +++ b/sql/sql_cte.cc @@ -1012,6 +1012,7 @@ st_select_lex_unit *With_element::clone_parsed_spec(LEX *old_lex, bool parse_status= false; st_select_lex *with_select; + st_select_lex *last_clone_select; char save_end= unparsed_spec.str[unparsed_spec.length]; unparsed_spec.str[unparsed_spec.length]= '\0'; @@ -1099,11 +1100,6 @@ st_select_lex_unit *With_element::clone_parsed_spec(LEX *old_lex, lex->unit.include_down(with_table->select_lex); lex->unit.set_slave(with_select); lex->unit.cloned_from= spec; - old_lex->all_selects_list= - (st_select_lex*) (lex->all_selects_list-> - insert_chain_before( - (st_select_lex_node **) &(old_lex->all_selects_list), - with_select)); /* Now all references to the CTE defined outside of the cloned specification @@ -1119,6 +1115,15 @@ st_select_lex_unit *With_element::clone_parsed_spec(LEX *old_lex, goto err; } + last_clone_select= lex->all_selects_list; + while (last_clone_select->next_select_in_list()) + last_clone_select= last_clone_select->next_select_in_list(); + old_lex->all_selects_list= + (st_select_lex*) (lex->all_selects_list-> + insert_chain_before( + (st_select_lex_node **) &(old_lex->all_selects_list), + last_clone_select)); + lex->sphead= NULL; // in order not to delete lex->sphead lex_end(lex); err: |