diff options
| author | Gleb Shchepa <gleb.shchepa@oracle.com> | 2010-11-23 00:29:47 +0300 |
|---|---|---|
| committer | Gleb Shchepa <gleb.shchepa@oracle.com> | 2010-11-23 00:29:47 +0300 |
| commit | 3586f7727f43275aa7e696d62f0e3bd444de2d24 (patch) | |
| tree | cb79999eeac8931541a7d309a485b4657ffb4cd8 /sql/field.cc | |
| parent | b31888294997ea450552127e6440ea970892f81e (diff) | |
| download | mariadb-git-3586f7727f43275aa7e696d62f0e3bd444de2d24.tar.gz | |
backport: Bug #55568 from 5.1-security to 5.0-security
> revision-id: alexey.kopytov@sun.com-20100824103548-ikm79qlfrvggyj9h
> parent: sunny.bains@oracle.com-20100816001222-xqc447tr6jwh8c53
> committer: Alexey Kopytov <Alexey.Kopytov@Sun.com>
> branch nick: 5.1-security
> timestamp: Tue 2010-08-24 14:35:48 +0400
> message:
> Bug #55568: user variable assignments crash server when used
> within query
>
> The server could crash after materializing a derived table
> which requires a temporary table for grouping.
>
> When destroying the temporary table used to execute a query for
> a derived table, JOIN::destroy() did not clean up Item_fields
> pointing to fields in the temporary table. This led to
> dereferencing a dangling pointer when printing out the items
> tree later in the outer SELECT.
>
> The solution is an addendum to the patch for bug37362: in
> addition to cleaning up items in tmp_all_fields3, do the same
> for items in tmp_all_fields1, since now we have an example
> where this is necessary.
Diffstat (limited to 'sql/field.cc')
| -rw-r--r-- | sql/field.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sql/field.cc b/sql/field.cc index b61e5fd2d79..3efd6111dcb 100644 --- a/sql/field.cc +++ b/sql/field.cc @@ -1365,7 +1365,7 @@ void Field::make_field(Send_field *field) } else field->org_table_name= field->db_name= ""; - if (orig_table) + if (orig_table && orig_table->alias) { field->table_name= orig_table->alias; field->org_col_name= field_name; |