diff options
| author | Sergey Glukhov <sergey.glukhov@oracle.com> | 2010-11-08 13:34:27 +0300 |
|---|---|---|
| committer | Sergey Glukhov <sergey.glukhov@oracle.com> | 2010-11-08 13:34:27 +0300 |
| commit | ff24facf810642a14b2171db20ed1c9004384a88 (patch) | |
| tree | 6c83355b855aadb0e6d45244fa323c06944373ff | |
| parent | db2564411623d6875b37dca4649995c60f901192 (diff) | |
| download | mariadb-git-ff24facf810642a14b2171db20ed1c9004384a88.tar.gz | |
Fix for bug #54575: crash when joining tables with unique set column(backport from 5.1)
Problem: a flaw (derefencing a NULL pointer) in the LIKE optimization
code may lead to a server crash in some rare cases.
Fix: check the pointer before its dereferencing.
| -rw-r--r-- | mysql-test/r/func_like.result | 14 | ||||
| -rw-r--r-- | mysql-test/t/func_like.test | 18 | ||||
| -rw-r--r-- | sql/item_cmpfunc.cc | 7 |
3 files changed, 34 insertions, 5 deletions
diff --git a/mysql-test/r/func_like.result b/mysql-test/r/func_like.result index 7e6fedb9403..f8743d6305f 100644 --- a/mysql-test/r/func_like.result +++ b/mysql-test/r/func_like.result @@ -165,3 +165,17 @@ select 'andre%' like 'andreÊ%' escape 'Ê'; select _cp1251'andre%' like convert('andreÊ%' using cp1251) escape 'Ê'; _cp1251'andre%' like convert('andreÊ%' using cp1251) escape 'Ê' 1 +End of 4.1 tests +# +# Bug #54575: crash when joining tables with unique set column +# +CREATE TABLE t1(a SET('a') NOT NULL, UNIQUE KEY(a)); +CREATE TABLE t2(b INT PRIMARY KEY); +INSERT INTO t1 VALUES (); +Warnings: +Warning 1364 Field 'a' doesn't have a default value +INSERT INTO t2 VALUES (1), (2), (3); +SELECT 1 FROM t2 JOIN t1 ON 1 LIKE a GROUP BY a; +1 +DROP TABLE t1, t2; +End of 5.1 tests diff --git a/mysql-test/t/func_like.test b/mysql-test/t/func_like.test index 4e1183afeff..50ebb2b2782 100644 --- a/mysql-test/t/func_like.test +++ b/mysql-test/t/func_like.test @@ -112,5 +112,19 @@ select 'andre%' like 'andreÊ%' escape 'Ê'; # select _cp1251'andre%' like convert('andreÊ%' using cp1251) escape 'Ê'; -# -# End of 4.1 tests + +--echo End of 4.1 tests + + +--echo # +--echo # Bug #54575: crash when joining tables with unique set column +--echo # +CREATE TABLE t1(a SET('a') NOT NULL, UNIQUE KEY(a)); +CREATE TABLE t2(b INT PRIMARY KEY); +INSERT INTO t1 VALUES (); +INSERT INTO t2 VALUES (1), (2), (3); +SELECT 1 FROM t2 JOIN t1 ON 1 LIKE a GROUP BY a; +DROP TABLE t1, t2; + + +--echo End of 5.1 tests diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc index 5c2fb9857d5..4ae381af683 100644 --- a/sql/item_cmpfunc.cc +++ b/sql/item_cmpfunc.cc @@ -4220,13 +4220,14 @@ Item_func::optimize_type Item_func_like::select_optimize() const if (args[1]->const_item()) { String* res2= args[1]->val_str((String *)&tmp_value2); + const char *ptr2; - if (!res2) + if (!res2 || !(ptr2= res2->ptr())) return OPTIMIZE_NONE; - if (*res2->ptr() != wild_many) + if (*ptr2 != wild_many) { - if (args[0]->result_type() != STRING_RESULT || *res2->ptr() != wild_one) + if (args[0]->result_type() != STRING_RESULT || *ptr2 != wild_one) return OPTIMIZE_OP; } } |