diff options
| author | Georgi Kodinov <joro@sun.com> | 2009-07-10 15:00:34 +0300 |
|---|---|---|
| committer | Georgi Kodinov <joro@sun.com> | 2009-07-10 15:00:34 +0300 |
| commit | 5beae1f8dcf6417315aec0940fadd8b32c218afe (patch) | |
| tree | 3033d4ebf823a0f3acbf53be3952670e3ab4c4de /mysql-test | |
| parent | 55f514ad0505182cb3a7f3f955a16baadb2493ba (diff) | |
| download | mariadb-git-5beae1f8dcf6417315aec0940fadd8b32c218afe.tar.gz | |
Bug #46080: group_concat(... order by) crashes server when
sort_buffer_size cannot allocate
The NULL return from tree_insert() (on low memory) was not
checked for in Item_func_group_concat::add(). As a result
on low memory conditions a crash happens.
Fixed by properly checking the return code.
Diffstat (limited to 'mysql-test')
| -rw-r--r-- | mysql-test/r/bug46080.result | 14 | ||||
| -rw-r--r-- | mysql-test/t/bug46080-master.opt | 1 | ||||
| -rw-r--r-- | mysql-test/t/bug46080.test | 19 |
3 files changed, 34 insertions, 0 deletions
diff --git a/mysql-test/r/bug46080.result b/mysql-test/r/bug46080.result new file mode 100644 index 00000000000..9ae4b55d8ea --- /dev/null +++ b/mysql-test/r/bug46080.result @@ -0,0 +1,14 @@ +# +# Bug #46080: group_concat(... order by) crashes server when +# sort_buffer_size cannot allocate +# +CREATE TABLE t1(a CHAR(255)); +INSERT INTO t1 VALUES ('a'); +SET @@SESSION.sort_buffer_size=5*16*1000000; +SET @@SESSION.max_heap_table_size=5*1000000; +# Must not crash. +SELECT GROUP_CONCAT(a ORDER BY a) FROM t1 GROUP BY a +DROP TABLE t1; +SET @@SESSION.sort_buffer_size=default; +SET @@SESSION.max_heap_table_size=default; +End of 5.0 tests diff --git a/mysql-test/t/bug46080-master.opt b/mysql-test/t/bug46080-master.opt new file mode 100644 index 00000000000..f59740afe60 --- /dev/null +++ b/mysql-test/t/bug46080-master.opt @@ -0,0 +1 @@ +--skip-grant-tables --skip-name-resolve --safemalloc-mem-limit=4000000 diff --git a/mysql-test/t/bug46080.test b/mysql-test/t/bug46080.test new file mode 100644 index 00000000000..9e6cc69b958 --- /dev/null +++ b/mysql-test/t/bug46080.test @@ -0,0 +1,19 @@ +--echo # +--echo # Bug #46080: group_concat(... order by) crashes server when +--echo # sort_buffer_size cannot allocate +--echo # + +CREATE TABLE t1(a CHAR(255)); +INSERT INTO t1 VALUES ('a'); + +SET @@SESSION.sort_buffer_size=5*16*1000000; +SET @@SESSION.max_heap_table_size=5*1000000; + +echo # Must not crash. +SELECT GROUP_CONCAT(a ORDER BY a) FROM t1 GROUP BY a; + +DROP TABLE t1; +SET @@SESSION.sort_buffer_size=default; +SET @@SESSION.max_heap_table_size=default; + +--echo End of 5.0 tests |