MDEV-25484 Crash when parsing query using derived table containing TVC

This patch fixes parsing problems concerning derived tables that use table
value constructors (TVC) with LIMIT and ORDER BY clauses of the form
  ((VALUES ... LIMIT ...) ORDER BY ...) as dt
The fix has to be applied only to 10.3 as 10.4 that employs a different
grammar rules has no such problems. The test cases should be merged
upstream.

Approved by Oleksandr Byelkin <sanja@mariadb.com>

1 files changed, 8 insertions, 1 deletions

diff --git a/sql/sql_lex.cc b/sql/sql_lex.cc
index 2a337b0f842..8de645a7197 100644
--- a/sql/sql_lex.cc
+++ b/sql/sql_lex.cc
@@ -8396,8 +8396,15 @@ bool LEX::tvc_finalize_derived()
     thd->parse_error();
     return true;
   }
+  if (unlikely(!(current_select->tvc=
+               new (thd->mem_root)
+               table_value_constr(many_values,
+                                  current_select,
+                                  current_select->options))))
+    return true;
+  restore_values_list_state();
   current_select->linkage= DERIVED_TABLE_TYPE;
-  return tvc_finalize();
+  return false;
 }