diff options
| author | Igor Babaev <igor@askmonty.org> | 2022-01-06 00:31:42 -0800 |
|---|---|---|
| committer | Igor Babaev <igor@askmonty.org> | 2022-01-10 09:12:17 -0800 |
| commit | 7692cec5b0811c09f09b1f6215fc07163ad0db3a (patch) | |
| tree | 072652c67be400f9b6ec31ce5167db1232d90f06 /sql/item.cc | |
| parent | 6dec0332fbdb6ca58c46284c7139735f137e2a81 (diff) | |
| download | mariadb-git-7692cec5b0811c09f09b1f6215fc07163ad0db3a.tar.gz | |
MDEV-25631 Crash executing query with VIEW, aggregate and subquery
This bug could cause a crash of the server for queries with a derived table
whose specification contained the set function using a subquery over a view
as its only argument. The crash could happen if the specification of the
view contained an outer reference. In this case the aggregation select
could be determined incorrectly.
The crash also could be observed if a CTE is used instead of the view, but
only for queries having at least two references to the CTE.
Diffstat (limited to 'sql/item.cc')
| -rw-r--r-- | sql/item.cc | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sql/item.cc b/sql/item.cc index 32bcd282401..6e5d2ee45a2 100644 --- a/sql/item.cc +++ b/sql/item.cc @@ -5266,6 +5266,7 @@ Item_field::fix_outer_field(THD *thd, Field **from_field, Item **reference) max_arg_level for the function if it's needed. */ if (thd->lex->in_sum_func && + thd->lex == context->select_lex->parent_lex && thd->lex->in_sum_func->nest_level >= select->nest_level) { Item::Type ref_type= (*reference)->type(); @@ -5291,6 +5292,7 @@ Item_field::fix_outer_field(THD *thd, Field **from_field, Item **reference) (Item_ident*) (*reference) : 0), false); if (thd->lex->in_sum_func && + thd->lex == context->select_lex->parent_lex && thd->lex->in_sum_func->nest_level >= select->nest_level) { set_if_bigger(thd->lex->in_sum_func->max_arg_level, @@ -5619,6 +5621,7 @@ bool Item_field::fix_fields(THD *thd, Item **reference) if (!thd->lex->current_select->no_wrap_view_item && thd->lex->in_sum_func && + thd->lex == select->parent_lex && thd->lex->in_sum_func->nest_level == select->nest_level) set_if_bigger(thd->lex->in_sum_func->max_arg_level, @@ -7704,6 +7707,7 @@ bool Item_ref::fix_fields(THD *thd, Item **reference) max_arg_level for the function if it's needed. */ if (thd->lex->in_sum_func && + thd->lex == context->select_lex->parent_lex && thd->lex->in_sum_func->nest_level >= last_checked_context->select_lex->nest_level) set_if_bigger(thd->lex->in_sum_func->max_arg_level, @@ -7727,6 +7731,7 @@ bool Item_ref::fix_fields(THD *thd, Item **reference) max_arg_level for the function if it's needed. */ if (thd->lex->in_sum_func && + thd->lex == context->select_lex->parent_lex && thd->lex->in_sum_func->nest_level >= last_checked_context->select_lex->nest_level) set_if_bigger(thd->lex->in_sum_func->max_arg_level, |