diff options
| author | Ajo Robert <ajo.robert@oracle.com> | 2017-08-24 17:03:21 +0530 |
|---|---|---|
| committer | Ajo Robert <ajo.robert@oracle.com> | 2017-08-24 17:03:21 +0530 |
| commit | f7316aa0c9a3909fc7498e7b95d5d3af044a7e21 (patch) | |
| tree | e1583dcd5f25dc950b96790606bd50b20b156d18 /client/mysqltest.cc | |
| parent | f2f6025a445d9a799ccce27bc9124c3a63c28764 (diff) | |
| download | mariadb-git-f7316aa0c9a3909fc7498e7b95d5d3af044a7e21.tar.gz | |
Bug#26361149 MYSQL SERVER CRASHES AT: COL IN(IFNULL(CONST,
COL), NAME_CONST('NAME', NULL))
Backport of Bug#19143243 fix.
NAME_CONST item can return NULL_ITEM type in case of incorrect arguments.
NULL_ITEM has special processing in Item_func_in function.
In Item_func_in::fix_length_and_dec an array of possible comparators is
created. Since NAME_CONST function has NULL_ITEM type, corresponding
array element is empty. Then NAME_CONST is wrapped to ITEM_CACHE.
ITEM_CACHE can not return proper type(NULL_ITEM) in Item_func_in::val_int(),
so the NULL_ITEM is attempted compared with an empty comparator.
The fix is to disable the caching of Item_name_const item.
Diffstat (limited to 'client/mysqltest.cc')
0 files changed, 0 insertions, 0 deletions