diff options
| author | Monty <monty@mariadb.org> | 2021-02-21 20:38:32 +0200 |
|---|---|---|
| committer | Monty <monty@mariadb.org> | 2021-02-21 20:43:28 +0200 |
| commit | 8db5274dce7f8710b25ca954559843c9cd812ac5 (patch) | |
| tree | f5fadaa88ffd964c3fa322166406b587d000a72e /mysql-test/main/default.result | |
| parent | da88e1ec12b0ba39552bf54367c1bb3b89eac4a8 (diff) | |
| download | mariadb-git-8db5274dce7f8710b25ca954559843c9cd812ac5.tar.gz | |
MDEV-22703 DEFAULT() on a BLOB column can overwrite the default record
This can cause crashes when accessing already released memory
The issue was the Item_default created a internal field, pointing to
share->default_values, to be used with the DEFAULT() function.
This does not work for BLOB fields as these are freed at end of query.
Fixed by storing BLOB field data inside and area allocated by
Item_default_value, like we do for nondeterministic default values.
Diffstat (limited to 'mysql-test/main/default.result')
| -rw-r--r-- | mysql-test/main/default.result | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/mysql-test/main/default.result b/mysql-test/main/default.result index cf0788b2fb2..f5ee1474b94 100644 --- a/mysql-test/main/default.result +++ b/mysql-test/main/default.result @@ -3390,3 +3390,18 @@ ALTER TABLE t1 ADD b CHAR(255) DEFAULT `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ERROR 42S22: Unknown column 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' in 'DEFAULT' DROP TABLE t1; # end of 10.2 test +# +# MDEV-22703 DEFAULT() on a BLOB column can overwrite the default +# record, which can cause crashes when accessing already released +# memory. +# +CREATE TEMPORARY TABLE t1 (h POINT DEFAULT ST_GEOMFROMTEXT('Point(1 1)')) ENGINE=InnoDB; +INSERT INTO t1 () VALUES (),(); +ALTER TABLE t1 FORCE; +SELECT DEFAULT(h) FROM t1; +SELECT length(DEFAULT(h)) FROM t1; +length(DEFAULT(h)) +25 +25 +INSERT INTO t1 () VALUES (); +drop table t1; |