diff options
| author | gluh@eagle.intranet.mysql.r18.ru <> | 2006-03-20 13:42:02 +0400 |
|---|---|---|
| committer | gluh@eagle.intranet.mysql.r18.ru <> | 2006-03-20 13:42:02 +0400 |
| commit | a184a00eae2a785ab5489904c369322e5d3874be (patch) | |
| tree | e4c13d8202ca3ebd5f08aa1baf69085349038b32 /sql/sql_show.cc | |
| parent | 36da0963242b03f3a65e62529510ffdd4c5ccdf0 (diff) | |
| download | mariadb-git-a184a00eae2a785ab5489904c369322e5d3874be.tar.gz | |
Fix for bug #18113 "SELECT * FROM information_schema.xxx crashes server"
Crash happened when one selected data from one of INFORMATION_SCHEMA
tables and in order to build its contents server had to open view which
used stored function and table or view on which one had not global or
database-level privileges (e.g. had only table-level or had no
privileges at all).
The crash was caused by usage of check_grant() function, which assumes
that either number of tables to be inspected by it is limited explicitly
or table list used and thd->lex->query_tables_own_last value correspond
to each other (the latter should be either 0 or point to next_global
member of one of elements of this table list), in conditions when
above assumptions were not true. This fix just explicitly limits
number of tables to be inspected. Other negative effects which are
caused by the fact that thd->lex->query_tables_own_last might not
be set properly during processing of I_S tables are less disastrous
and will be reported and fixed separetely.
Diffstat (limited to 'sql/sql_show.cc')
| -rw-r--r-- | sql/sql_show.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sql/sql_show.cc b/sql/sql_show.cc index 403781b330d..4b5b4d0dc0e 100644 --- a/sql/sql_show.cc +++ b/sql/sql_show.cc @@ -328,7 +328,7 @@ mysql_find_files(THD *thd,List<char> *files, const char *db,const char *path, table_list.table_name= file->name; table_list.table_name_length= strlen(file->name); table_list.grant.privilege=col_access; - if (check_grant(thd, TABLE_ACLS, &table_list, 1, UINT_MAX, 1)) + if (check_grant(thd, TABLE_ACLS, &table_list, 1, 1, 1)) continue; } #endif |