diff options
| author | Sergey Glukhov <sergey.glukhov@oracle.com> | 2010-12-13 13:39:26 +0300 |
|---|---|---|
| committer | Sergey Glukhov <sergey.glukhov@oracle.com> | 2010-12-13 13:39:26 +0300 |
| commit | 4096f35a395cee270218ae220b921af567ae26da (patch) | |
| tree | 4822858ad1a61e4d3bfb88cd05ddac8dfc8daa8a /sql/item_sum.cc | |
| parent | 6a84582c671e9ddcb35016a29c576f73b00b562e (diff) | |
| download | mariadb-git-4096f35a395cee270218ae220b921af567ae26da.tar.gz | |
Bug#58396 group_concat and explain extended are still crashy
Explain fails at fix_fields stage and some items are left unfixed,
particulary Item_group_concat. Item_group_concat::orig_args field
is uninitialized in this case and Item_group_concat::print call
leads to crash.
The fix:
move the initialization of Item_group_concat::orig_args
into constructor.
Diffstat (limited to 'sql/item_sum.cc')
| -rw-r--r-- | sql/item_sum.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sql/item_sum.cc b/sql/item_sum.cc index 65f8222d38b..a60a6b3ef95 100644 --- a/sql/item_sum.cc +++ b/sql/item_sum.cc @@ -3003,6 +3003,7 @@ Item_func_group_concat(Name_resolution_context *context_arg, order_item->item= arg_ptr++; } } + memcpy(orig_args, args, sizeof(Item*) * arg_count); } @@ -3233,7 +3234,6 @@ Item_func_group_concat::fix_fields(THD *thd, Item **ref) if (check_sum_func(thd, ref)) return TRUE; - memcpy (orig_args, args, sizeof (Item *) * arg_count); fixed= 1; return FALSE; } |