Fixed bug mdev-5105.

The bug caused a memory overwrite in the function update_ref_and_keys()
It happened due to a wrong value of SELECT_LEX::cond_count. This value
historically was calculated by the fix_fields method. Now the logic of
calling this method became too complicated and, as a result, this value
is calculated not always correctly.
The patch changes the way how and when  the values of SELECT_LEX::cond_count
and of SELECT_LEX::between_count are calculated. The new code does it just at
the beginning of update_ref_and_keys().
 

1 files changed, 11 insertions, 0 deletions

diff --git a/mysql-test/r/derived_view.result b/mysql-test/r/derived_view.result
index eb2200c7720..0278c36b557 100644
--- a/mysql-test/r/derived_view.result
+++ b/mysql-test/r/derived_view.result
@@ -2223,6 +2223,17 @@ a	(SELECT SUM(a + c) FROM (SELECT b as c FROM t2) AS v1)
 DROP VIEW v;
 DROP TABLE t1,t2;
 #
+# mdev-5105: memory overwrite in multi-table update 
+#            using natuaral join with a view
+#
+create table t1(a int,b tinyint,c tinyint)engine=myisam;
+create table t2(a tinyint,b float,c int, d int, e int, f int, key (b), key(c), key(d), key(e), key(f))engine=myisam;
+create table t3(a int,b int,c int, d int, e int, f int, key(a), key(b), key(c), key(d), key(e), key(f))engine=myisam;
+create view v1 as select t2.b a, t1.b b, t2.c c, t2.d d, t2.e e, t2.f f from t1,t2 where t1.a=t2.a;
+update t3 natural join v1 set a:=1;
+drop view v1;
+drop table t1,t2,t3;
+#
 # end of 5.3 tests
 #
 set optimizer_switch=@exit_optimizer_switch;