diff options
| author | Monty <monty@mariadb.org> | 2023-03-01 19:59:42 +0200 |
|---|---|---|
| committer | Monty <monty@mariadb.org> | 2023-03-02 13:11:54 +0200 |
| commit | ae0509771462c02149e294f8f8593d6ff10755f7 (patch) | |
| tree | 401534c7241f30fa04b91a12d2bfd7982ed124a6 /sql/debug.cc | |
| parent | bc3596fe129dc12977522243f92202609e06fdab (diff) | |
| download | mariadb-git-ae0509771462c02149e294f8f8593d6ff10755f7.tar.gz | |
Fixed crashing bug in recursive SQL if write to tmp table would fail
This error was discovered while working on
MDEV-30540 Wrong result with IN list length reaching
IN_PREDICATE_CONVERSION_THRESHOLD
If there is read error from handler::ha_rnd_next() during a recursive
query, st_select_lex_unit::exec_recursive() will crash as it will try to
get the error code from a structure that was deleted by the callee.
The code was using the construct:
sl->join->exec();
saved_error=sl->join->error;
This does not work as sl->join was freed by the exec() and sl->join would
be set to 0.
Fixed by having JOIN::exec() return the error code.
The included test case simulates the error in ha_rnd_next(), which causes
a crash without the patch.
scovered whle working on
MDEV-30540 Wrong result with IN list length reaching
IN_PREDICATE_CONVERSION_THRESHOLD
If there is read error from handler::ha_rnd_next() during a recursive
query, st_select_lex_unit::exec_recursive() will crash as it will try to
get the error code from a structure that was deleted by the callee.
The code was using the construct:
sl->join->exec();
saved_error=sl->join->error;
This does not work as sl->join was freed by the exec() and sl->join was
set to 0.
Fixed by having JOIN::exec() return the error code.
The included test case simulates the error in ha_rnd_next(), which causes
a crash without the patch.
Diffstat (limited to 'sql/debug.cc')
| -rw-r--r-- | sql/debug.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sql/debug.cc b/sql/debug.cc index a0e2340e254..a24cc4e407e 100644 --- a/sql/debug.cc +++ b/sql/debug.cc @@ -35,7 +35,7 @@ static const LEX_CSTRING debug_crash_counter= static const LEX_CSTRING debug_error_counter= { STRING_WITH_LEN("debug_error_counter") }; -static bool debug_decrement_counter(const LEX_CSTRING *name) +bool debug_decrement_counter(const LEX_CSTRING *name) { THD *thd= current_thd; user_var_entry *entry= (user_var_entry*) |