Fixed bug#20503: Server crash due to the ORDER clause not taken into account

while space allocation

Under some circumstances DISTINCT clause can be converted to grouping.
In such cases grouping is performed by all items in the select list.
If an ORDER clause is present then items from it is prepended to group list.
But the case with ORDER wasn't taken into account when allocating the
array for sum functions. This leads to memory corruption and crash.

The JOIN::alloc_func_list() function now allocates additional space if there
is an ORDER by clause is specified and DISTINCT -> GROUP BY optimization is
possible.


mysql-test/t/select.test:
  Added the test case for bug#20503: Server crash due to the ORDER clause not taken into account while space allocation
mysql-test/r/select.result:
  Added the test case for bug#20503: Server crash due to the ORDER clause not taken into account while space allocation
sql/sql_select.cc:
  Fixed bug#20503: Server crash due to the ORDER clause not taken into account
  while space allocation
  The JOIN::alloc_func_list() function now allocates additional space if there
  is an ORDER by clause is specified and DISTINCT -> GROUP BY optimization is
  possible.

3 files changed, 28 insertions, 1 deletions

diff --git a/mysql-test/r/select.result b/mysql-test/r/select.result
index 0c62d3f570f..350a05a13c8 100644
--- a/mysql-test/r/select.result
+++ b/mysql-test/r/select.result
@@ -3517,3 +3517,9 @@ id	a	b	c	d	e
 2	NULL	NULL	NULL	2	40
 2	NULL	NULL	NULL	2	50
 DROP TABLE t1,t2,t3;
+create table t1 (c1 varchar(1), c2 int, c3 int, c4 int, c5 int, c6 int,
+c7 int, c8 int, c9 int, fulltext key (`c1`));
+select distinct match (`c1`) against ('z') , c2, c3, c4,c5, c6,c7, c8 
+from t1 where c9=1 order by c2, c2;
+match (`c1`) against ('z')	c2	c3	c4	c5	c6	c7	c8
+drop table t1;
diff --git a/mysql-test/t/select.test b/mysql-test/t/select.test
index 36b3749b4d7..0686f670edf 100644
--- a/mysql-test/t/select.test
+++ b/mysql-test/t/select.test
@@ -2996,5 +2996,14 @@ SELECT * FROM t1 LEFT JOIN t2 ON t2.b=t1.a INNER JOIN t3 ON t3.d=t1.id
 SELECT * FROM t1 LEFT JOIN t2 ON t2.b=t1.a INNER JOIN t3 ON t3.d=t1.id
   WHERE t1.id=2;
 
-
 DROP TABLE t1,t2,t3;
+
+#
+# Bug#20503: Server crash due to the ORDER clause isn't taken into account
+#            while space allocation
+#
+create table t1 (c1 varchar(1), c2 int, c3 int, c4 int, c5 int, c6 int,
+c7 int, c8 int, c9 int, fulltext key (`c1`));
+select distinct match (`c1`) against ('z') , c2, c3, c4,c5, c6,c7, c8 
+  from t1 where c9=1 order by c2, c2;
+drop table t1;
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index ac4b404ce8e..a412df8cdeb 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -13515,7 +13515,19 @@ bool JOIN::alloc_func_list()
     disctinct->group_by optimization
   */
   if (select_distinct)
+  {
     group_parts+= fields_list.elements;
+    /*
+      If the ORDER clause is specified then it's possible that
+      it also will be optimized, so reserve space for it too
+    */
+    if (order)
+    {
+      ORDER *ord;
+      for (ord= order; ord; ord= ord->next)
+        group_parts++;
+    }
+  }
 
   /* This must use calloc() as rollup_make_fields depends on this */
   sum_funcs= (Item_sum**) thd->calloc(sizeof(Item_sum**) * (func_count+1) +