diff options
author | Monty <monty@mariadb.org> | 2020-12-03 15:46:59 +0200 |
---|---|---|
committer | Monty <monty@mariadb.org> | 2020-12-03 15:58:19 +0200 |
commit | 6033cc8587651a73e07324a733ac3332246b81e0 (patch) | |
tree | a4c2133f26e214cf1d5b20f7a129bf49e790c9a6 /sql/item_cmpfunc.h | |
parent | f146969fb3a1e8ed508f55ee38faaffd5cff2021 (diff) | |
download | mariadb-git-6033cc8587651a73e07324a733ac3332246b81e0.tar.gz |
Fixed usage of not initialized memory in LIKE ... ESCAPE
This was noticed wben running "mtr --valgrind main.precedence"
The problem was that Item_func_like::escape could be left unitialized
when used with views combined with UNIONS like in:
create or replace view v1 as select 2 LIKE 1 ESCAPE 3 IN (SELECT 0 UNION SELECT 1), 2 LIKE 1 ESCAPE (3 IN (SELECT 0 UNION SELECT 1)), (2 LIKE 1 ESCAPE 3) IN (SELECT 0 UNION SELECT 1);
The above query causes in fix_escape_item()
escape_item->const_during_execution() to be true
and
escape_item->const_item() to be false
in which case 'escape' is never calculated.
The fix is to make the main logic of fix_escape_item() out to a
separate function and call that function once in Item.
Other things:
- Reorganized fields in Item_func_like class to make it more compact
Diffstat (limited to 'sql/item_cmpfunc.h')
-rw-r--r-- | sql/item_cmpfunc.h | 37 |
1 files changed, 20 insertions, 17 deletions
diff --git a/sql/item_cmpfunc.h b/sql/item_cmpfunc.h index fa715badfc7..1808884647e 100644 --- a/sql/item_cmpfunc.h +++ b/sql/item_cmpfunc.h @@ -2672,14 +2672,24 @@ public: class Item_func_like :public Item_bool_func2 { - // Turbo Boyer-Moore data - bool canDoTurboBM; // pattern is '%abcd%' case const char* pattern; - int pattern_len; + Item *escape_item; + DTCollation cmp_collation; + String cmp_value1, cmp_value2; + // Turbo Boyer-Moore data // TurboBM buffers, *this is owner - int* bmGs; // good suffix shift table, size is pattern_len + 1 - int* bmBc; // bad character shift table, size is alphabet_size + int *bmGs; // good suffix shift table, size is pattern_len + 1 + int *bmBc; // bad character shift table, size is alphabet_size + int pattern_len; +public: + int escape; + bool negated; +private: + bool canDoTurboBM; // pattern is '%abcd%' case + bool escape_item_evaluated; + bool escape_used_in_parsing; + bool use_sampling; void turboBM_compute_suffixes(int* suff); void turboBM_compute_good_suffix_shifts(int* suff); @@ -2687,13 +2697,6 @@ class Item_func_like :public Item_bool_func2 bool turboBM_matches(const char* text, int text_len) const; enum { alphabet_size = 256 }; - Item *escape_item; - - bool escape_used_in_parsing; - bool use_sampling; - - DTCollation cmp_collation; - String cmp_value1, cmp_value2; bool with_sargable_pattern() const; protected: SEL_TREE *get_func_mm_tree(RANGE_OPT_PARAM *param, @@ -2706,13 +2709,13 @@ protected: KEY_PART *key_part, Item_func::Functype type, Item *value); public: - int escape; - bool negated; Item_func_like(THD *thd, Item *a, Item *b, Item *escape_arg, bool escape_used): - Item_bool_func2(thd, a, b), canDoTurboBM(FALSE), pattern(0), pattern_len(0), - bmGs(0), bmBc(0), escape_item(escape_arg), - escape_used_in_parsing(escape_used), use_sampling(0), negated(0) {} + Item_bool_func2(thd, a, b), pattern(0), escape_item(escape_arg), + bmGs(0), bmBc(0), pattern_len(0), negated(0), canDoTurboBM(FALSE), + escape_item_evaluated(0), escape_used_in_parsing(escape_used), + use_sampling(0) + {} bool get_negated() const { return negated; } // Used by ColumnStore |