diff options
| author | Nayuta Yanagisawa <nayuta.yanagisawa@hey.com> | 2022-01-04 13:21:14 +0900 |
|---|---|---|
| committer | Nayuta Yanagisawa <nayuta.yanagisawa@hey.com> | 2022-01-06 00:47:41 +0900 |
| commit | 94637a0c76f6fcf2169ecc7fb790aee139931d4e (patch) | |
| tree | 0829568d1586a51852416fcfd5a93d63dfd16fab /sql/sql_insert.cc | |
| parent | 49791cbc6f76c4f4c1bb436dbe26cec6177ee279 (diff) | |
| download | mariadb-git-bb-10.4-MDEV-26583.tar.gz | |
MDEV-26583 SIGSEGV's in spider_get_select_limit_from_select_lex when DELAYED INSERT is usedbb-10.4-MDEV-26583
Spider dereferences a freed select_lex and then results in SIGSEGV.
Diffstat (limited to 'sql/sql_insert.cc')
| -rw-r--r-- | sql/sql_insert.cc | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sql/sql_insert.cc b/sql/sql_insert.cc index 0f454e74a48..460fbba4ac5 100644 --- a/sql/sql_insert.cc +++ b/sql/sql_insert.cc @@ -2424,6 +2424,11 @@ bool delayed_get_table(THD *thd, MDL_request *grl_protection_request, di->table_list.alias.length= di->table_list.table_name.length= di->thd.query_length(); di->table_list.db= di->thd.db; /* + Nulify select_lex because, if the thread that spawned the current one + disconnects, the select_lex will point to freed memory. + */ + di->table_list.select_lex= NULL; + /* We need the tickets so that they can be cloned in handle_delayed_insert */ |