Bug #57130 crash in Item_field::print during SHOW CREATE TABLE or VIEW

This crash could happen if SHOW CREATE VIEW indirectly failed to open a
view due to failures to open underlying tables (or functions). Several
such errors were hidden and converted to ER_VIEW_INVALID warnings to
prevent exposing details of underlying tables for which the user have
no privileges.

However, with the changes introduced by the patch for Bug#52044,
failing to open a view will cause opened tables, views and functions
to be closed. Since the errors causing these failures were converted
to warnings, SHOW CREATE VIEW would try to continue. This made it
possible to try to access memory that had been freed, causing a crash.

This patch fixes the problem by not closing opened tables, views and
functions in these cases. This allows SHOW CREATE VIEW to continue
and also prevents it from accessing freed memory.

Test case added to lock_sync.test.

1 files changed, 59 insertions, 0 deletions

diff --git a/mysql-test/t/lock_sync.test b/mysql-test/t/lock_sync.test
index 7131e2cde31..d5ad7becd7d 100644
--- a/mysql-test/t/lock_sync.test
+++ b/mysql-test/t/lock_sync.test
@@ -1078,6 +1078,65 @@ DROP TABLE t1;
 SET DEBUG_SYNC= 'RESET';
 
 
+--echo #
+--echo # Bug#57130 crash in Item_field::print during SHOW CREATE TABLE or VIEW
+--echo #
+
+--disable_warnings
+DROP TABLE IF EXISTS t1;
+DROP VIEW IF EXISTS v1;
+DROP FUNCTION IF EXISTS f1;
+--enable_warnings
+
+CREATE TABLE t1(a INT);
+CREATE FUNCTION f1() RETURNS INTEGER RETURN 1;
+CREATE VIEW v1 AS SELECT * FROM t1 WHERE f1() = 1;
+DROP FUNCTION f1;
+connect(con2, localhost, root);
+
+--echo # Connection con1
+connect (con1, localhost, root);
+# Need to trigger this sync point at least twice in order to
+# get valgrind test failures without the patch
+SET DEBUG_SYNC= 'open_tables_after_open_and_process_table SIGNAL opened WAIT_FOR dropped EXECUTE 2';
+--echo # Sending:
+--send SHOW CREATE VIEW v1
+
+--echo # Connection con2
+connection con2;
+SET DEBUG_SYNC= 'now WAIT_FOR opened';
+SET DEBUG_SYNC= 'now SIGNAL dropped';
+SET DEBUG_SYNC= 'now WAIT_FOR opened';
+--echo # Sending:
+--send FLUSH TABLES
+
+--echo # Connection default
+connection default;
+--echo # Waiting for FLUSH TABLES to be blocked.
+let $wait_condition= SELECT COUNT(*)=1 FROM information_schema.processlist
+  WHERE state= 'Waiting for table flush' AND info= 'FLUSH TABLES';
+--source include/wait_condition.inc
+SET DEBUG_SYNC= 'now SIGNAL dropped';
+
+--echo # Connection con1
+connection con1;
+--echo # Reaping: SHOW CREATE VIEW v1
+--reap
+
+--echo # Connection con2
+connection con2;
+--echo # Reaping: FLUSH TABLES
+--reap
+
+--echo # Connection default
+connection default;
+SET DEBUG_SYNC= 'RESET';
+DROP VIEW v1;
+DROP TABLE t1;
+disconnect con1;
+disconnect con2;
+
+
 # Check that all connections opened by test cases in this file are really
 # gone so execution of other tests won't be affected by their presence.
 --source include/wait_until_count_sessions.inc