From d9cb536a55f4fd83e66fb7d87c62924b714432f8 Mon Sep 17 00:00:00 2001 From: unknown Date: Fri, 30 Jun 2006 09:26:36 +0200 Subject: BUG#20769: Dangling pointer in ctype_recoding test case. In some functions dealing with strings and character sets, the wrong pointers were saved for restoration in THD::rollback_item_tree_changes(). This could potentially cause random corruption or crashes. Fixed by passing the original Item ** locations, not local stack copies. Also remove unnecessary use of default arguments. sql/item.cc: Function agg_item_charsets() now handles non-consequtive Item *'s. sql/item.h: Remove use of default argument. sql/item_cmpfunc.cc: Remove use of default argument. sql/item_func.cc: Remove use of default argument. sql/item_func.h: Function agg_item_charsets() now handles non-consequtive Item *'s. sql/item_strfunc.cc: Pass original Item **'s to agg_arg_charsets(), not local copies, to ensure proper restoration in THD::rollback_item_tree_changes(). sql/item_sum.cc: Remove use of default argument. --- sql/item_func.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'sql/item_func.h') diff --git a/sql/item_func.h b/sql/item_func.h index 1d8a1bd5e22..2ca4be9f3f2 100644 --- a/sql/item_func.h +++ b/sql/item_func.h @@ -166,21 +166,21 @@ public: my_decimal *val_decimal(my_decimal *); bool agg_arg_collations(DTCollation &c, Item **items, uint nitems, - uint flags= 0) + uint flags) { - return agg_item_collations(c, func_name(), items, nitems, flags); + return agg_item_collations(c, func_name(), items, nitems, flags, 1); } bool agg_arg_collations_for_comparison(DTCollation &c, Item **items, uint nitems, - uint flags= 0) + uint flags) { return agg_item_collations_for_comparison(c, func_name(), items, nitems, flags); } bool agg_arg_charsets(DTCollation &c, Item **items, uint nitems, - uint flags= 0) + uint flags, int item_sep) { - return agg_item_charsets(c, func_name(), items, nitems, flags); + return agg_item_charsets(c, func_name(), items, nitems, flags, item_sep); } bool walk(Item_processor processor, byte *arg); Item *transform(Item_transformer transformer, byte *arg); -- cgit v1.2.1