diff options
| author | Oleg Smirnov <olernov@gmail.com> | 2022-03-11 21:18:34 +0700 |
|---|---|---|
| committer | Oleg Smirnov <olernov@gmail.com> | 2022-04-06 15:12:07 +0300 |
| commit | 85192553ae2c3cb5fb26ace4cd85377525ac7845 (patch) | |
| tree | 227addca022a70e2b37eb70b42b1c2e43166c7b8 /sql/sql_select.cc | |
| parent | 75b9014fedd8bb85d15501a2281fbade6b56fe78 (diff) | |
| download | mariadb-git-85192553ae2c3cb5fb26ace4cd85377525ac7845.tar.gz | |
MDEV-24560 SIGSEGV in st_join_table::cleanup
If JOIN::create_postjoin_aggr_table encounters errors during execution
then free_tmp_table() is then called twice for JOIN_TAB::aggr.
The solution is to initialize JOIN_TAB::aggr only on successful completion
of JOIN::create_postjoin_aggr_table
Diffstat (limited to 'sql/sql_select.cc')
| -rw-r--r-- | sql/sql_select.cc | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/sql/sql_select.cc b/sql/sql_select.cc index 22d3597de16..8d2a4929401 100644 --- a/sql/sql_select.cc +++ b/sql/sql_select.cc @@ -2989,14 +2989,11 @@ JOIN::create_postjoin_aggr_table(JOIN_TAB *tab, List<Item> *table_fields, tmp_table_param.using_outer_summary_function= tab->tmp_table_param->using_outer_summary_function; tab->join= this; - DBUG_ASSERT(tab > tab->join->join_tab || !top_join_tab_count || !tables_list); + DBUG_ASSERT(tab > tab->join->join_tab || !top_join_tab_count || + !tables_list); + tab->table= table; if (tab > join_tab) (tab - 1)->next_select= sub_select_postjoin_aggr; - tab->aggr= new (thd->mem_root) AGGR_OP(tab); - if (!tab->aggr) - goto err; - tab->table= table; - table->reginfo.join_tab= tab; /* if group or order on first table, sort first */ if ((group_list && simple_group) || @@ -3047,12 +3044,15 @@ JOIN::create_postjoin_aggr_table(JOIN_TAB *tab, List<Item> *table_fields, order= NULL; } } - + if (!(tab->aggr= new (thd->mem_root) AGGR_OP(tab))) + goto err; + table->reginfo.join_tab= tab; DBUG_RETURN(false); err: if (table != NULL) free_tmp_table(thd, table); + tab->table= NULL; DBUG_RETURN(true); } |