Fixed bug where we could reference a freed tmp_table->table_name variable for some

GROUP BY ... ORDER BY queries.


Docs/manual.texi:
  ChangeLog

2 files changed, 12 insertions, 1 deletions

diff --git a/Docs/manual.texi b/Docs/manual.texi
index e8b9d89e1a2..21bab5ea6e4 100644
--- a/Docs/manual.texi
+++ b/Docs/manual.texi
@@ -46928,6 +46928,12 @@ not yet 100% confident in this code.
 
 @node News-3.23.54, News-3.23.53, News-3.23.x, News-3.23.x
 @appendixsubsec Changes in release 3.23.54
+@itemize
+Fixed reference to freed memory when doing complicated @code{GROUP BY
+... ORDER BY} queries.  Symptom was that @code{mysqld} died in function
+@code{send_fields}.
+queries.
+@end itemize
 
 @node News-3.23.53, News-3.23.52, News-3.23.54, News-3.23.x
 @appendixsubsec Changes in release 3.23.53
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 04368c016d1..e2cf2fd72df 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -3395,7 +3395,10 @@ create_tmp_table(THD *thd,TMP_TABLE_PARAM *param,List<Item> &fields,
   bzero((char*) from_field,sizeof(Field*)*field_count);
   table->field=reg_field;
   table->real_name=table->path=tmpname;
-  table->table_name=base_name(tmpname);
+  /*
+    This must be "" as field may refer to it after tempory table is dropped
+  */
+  table->table_name= (char*) "";
   table->reginfo.lock_type=TL_WRITE;	/* Will be updated */
   table->db_stat=HA_OPEN_KEYFILE+HA_OPEN_RNDFILE;
   table->blob_ptr_size=mi_portable_sizeof_char_ptr;
@@ -3731,6 +3734,8 @@ create_tmp_table(THD *thd,TMP_TABLE_PARAM *param,List<Item> &fields,
     if (create_myisam_tmp_table(table,param,select_options))
       goto err;
   }
+  /* Set table_name for easier debugging */
+  table->table_name= base_name(tmpname);
   if (!open_tmp_table(table))
     DBUG_RETURN(table);