Fix BUG#2259: Crash after fetch from not-open cursor in stored procedure

Initialize and test properly when cleaning up, to avoid crash in some error cases.


mysql-test/r/sp-error.result:
  Test case for BUG#2259
mysql-test/t/sp-error.test:
  Test case for BUG#2259
sql/sp_rcontext.cc:
  Cleanup in a more controlled way to avoid crashes in some error cases.
  Remove unused variable.
sql/sp_rcontext.h:
  Initialize member var, for cleanup tests.

2 files changed, 8 insertions, 7 deletions

diff --git a/sql/sp_rcontext.cc b/sql/sp_rcontext.cc
index 41502618cda..225adc74a6b 100644
--- a/sql/sp_rcontext.cc
+++ b/sql/sp_rcontext.cc
@@ -176,10 +176,13 @@ sp_cursor::close(THD *thd)
 void
 sp_cursor::destroy()
 {
-  delete m_prot;
-  m_prot= NULL;
-  free_root(&m_mem_root, MYF(0));
-  bzero((char *)&m_mem_root, sizeof(m_mem_root));
+  if (m_prot)
+  {
+    delete m_prot;
+    m_prot= NULL;
+    free_root(&m_mem_root, MYF(0));
+    bzero((char *)&m_mem_root, sizeof(m_mem_root));
+  }
   m_isopen= FALSE;
 }
 
@@ -190,14 +193,12 @@ sp_cursor::fetch(THD *thd, List<struct sp_pvar> *vars)
   sp_pvar_t *pv;
   MYSQL_ROW row;
   uint fldcount;
-  MYSQL_FIELD *fields= m_prot->fields;
 
   if (! m_isopen)
   {
     send_error(thd, ER_SP_CURSOR_NOT_OPEN);
     return -1;
   }
-
   if (m_current_row == NULL)
   {
     send_error(thd, ER_SP_FETCH_NO_DATA);
diff --git a/sql/sp_rcontext.h b/sql/sp_rcontext.h
index 5d836998cb1..7a9271ed06a 100644
--- a/sql/sp_rcontext.h
+++ b/sql/sp_rcontext.h
@@ -205,7 +205,7 @@ class sp_cursor : public Sql_alloc
 public:
 
   sp_cursor(LEX *lex)
-    : m_lex(lex), m_isopen(0), m_current_row(NULL)
+    : m_lex(lex), m_prot(NULL), m_isopen(0), m_current_row(NULL)
   {
     /* Empty */
   }