A fix and a test case for Bug#34166 Server crash in SHOW OPEN TABLES and

pre-locking.

The crash was caused by an implicit assumption in check_table_access() that
table_list parameter is always a part of lex->query_tables.

When iterating over the passed list of tables, check_table_access() used
to stop only when lex->query_tables_last_not_own was reached. 
In case of pre-locking, lex->query_tables_last_own is not NULL and points
to some element of lex->query_tables. When the parameter
of check_table_access() was not part of lex->query_tables, loop invariant
could never be violated and a crash would happen when the current table
pointer would point beyond the end of the provided list.

The fix is to change the signature of check_table_access() to also accept
a numeric limit of loop iterations, similarly to check_grant(), and 
supply this limit in all places when we want to check access of tables
that are outside lex->query_tables, or just want to check access to one table.

1 files changed, 22 insertions, 0 deletions

diff --git a/mysql-test/t/information_schema.test b/mysql-test/t/information_schema.test
index 2a9319fe010..6e76a043645 100644
--- a/mysql-test/t/information_schema.test
+++ b/mysql-test/t/information_schema.test
@@ -1248,4 +1248,26 @@ show events from information_schema;
 show events where Db= 'information_schema';
 use test;
 
+--echo #
+--echo # Bug#34166: Server crash in SHOW OPEN TABLES and prelocking
+--echo #
+--disable_warnings
+drop table if exists t1;
+drop function if exists f1;
+--enable_warnings
+create table t1 (a int);
+delimiter |;
+create function f1() returns int
+begin
+  insert into t1 (a) values (1);
+  return 0;
+end|
+delimiter ;|
+--disable_result_log
+show open tables where f1()=0;
+show open tables where f1()=0;
+--enable_result_log
+drop table t1;
+drop function f1;
+
 --echo End of 5.1 tests.