diff options
| author | Gleb Shchepa <gshchepa@mysql.com> | 2010-01-13 08:16:36 +0400 |
|---|---|---|
| committer | Gleb Shchepa <gshchepa@mysql.com> | 2010-01-13 08:16:36 +0400 |
| commit | 71fd38e488d1d10210c9c5370f56d682d9884814 (patch) | |
| tree | 58a509d3bb942aa20b969bd71f60c829dfbba7f3 /sql/item_strfunc.cc | |
| parent | 3c9322e73f5b994b7ec13ed73e99ce4bc94694b8 (diff) | |
| download | mariadb-git-71fd38e488d1d10210c9c5370f56d682d9884814.tar.gz | |
Bug #50096: CONCAT_WS inside procedure returning wrong data
Selecting of the CONCAT_WS(...<PS parameter>...) result into
a user variable may return wrong data.
Item_func_concat_ws::val_str contains a number of memory
allocation-saving optimization tricks. After the fix
for bug 46815 the control flow has been changed to a
branch that is commented as "This is quite uncommon!":
one of places where we are trying to concatenate
strings inplace. However, that "uncommon" place
didn't care about PS parameters, that have another
trick in Item_sp_variable::val_str(): they use the
intermediate Item_sp_variable::str_value field,
where they may store a reference to an external
argument's buffer.
The Item_func_concat_ws::val_str function has been
modified to take into account val_str functions
(such as Item_sp_variable::val_str) that return a
pointer to an internal Item member variable that
may reference to a buffer provided.
mysql-test/r/func_concat.result:
Added test case for bug #50096.
mysql-test/t/func_concat.test:
Added test case for bug #50096.
sql/item_strfunc.cc:
Bug #50096: CONCAT_WS inside procedure returning wrong data
The Item_func_concat_ws::val_str function has been
modified to take into account val_str functions
(such as Item_sp_variable::val_str) that return a
pointer to an internal Item member variable that
may reference to a buffer provided.
Diffstat (limited to 'sql/item_strfunc.cc')
| -rw-r--r-- | sql/item_strfunc.cc | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc index b6d3f45f4c2..ecd839d8378 100644 --- a/sql/item_strfunc.cc +++ b/sql/item_strfunc.cc @@ -677,8 +677,8 @@ String *Item_func_concat_ws::val_str(String *str) res->length() + sep_str->length() + res2->length()) { /* We have room in str; We can't get any errors here */ - if (str == res2) - { // This is quote uncommon! + if (str->ptr() == res2->ptr()) + { // This is quite uncommon! str->replace(0,0,*sep_str); str->replace(0,0,*res); } |