diff options
| author | Gleb Shchepa <gleb.shchepa@oracle.com> | 2010-11-23 00:29:47 +0300 |
|---|---|---|
| committer | Gleb Shchepa <gleb.shchepa@oracle.com> | 2010-11-23 00:29:47 +0300 |
| commit | 3586f7727f43275aa7e696d62f0e3bd444de2d24 (patch) | |
| tree | cb79999eeac8931541a7d309a485b4657ffb4cd8 /heap/hp_rfirst.c | |
| parent | b31888294997ea450552127e6440ea970892f81e (diff) | |
| download | mariadb-git-3586f7727f43275aa7e696d62f0e3bd444de2d24.tar.gz | |
backport: Bug #55568 from 5.1-security to 5.0-security
> revision-id: alexey.kopytov@sun.com-20100824103548-ikm79qlfrvggyj9h
> parent: sunny.bains@oracle.com-20100816001222-xqc447tr6jwh8c53
> committer: Alexey Kopytov <Alexey.Kopytov@Sun.com>
> branch nick: 5.1-security
> timestamp: Tue 2010-08-24 14:35:48 +0400
> message:
> Bug #55568: user variable assignments crash server when used
> within query
>
> The server could crash after materializing a derived table
> which requires a temporary table for grouping.
>
> When destroying the temporary table used to execute a query for
> a derived table, JOIN::destroy() did not clean up Item_fields
> pointing to fields in the temporary table. This led to
> dereferencing a dangling pointer when printing out the items
> tree later in the outer SELECT.
>
> The solution is an addendum to the patch for bug37362: in
> addition to cleaning up items in tmp_all_fields3, do the same
> for items in tmp_all_fields1, since now we have an example
> where this is necessary.
Diffstat (limited to 'heap/hp_rfirst.c')
0 files changed, 0 insertions, 0 deletions