MDEV-24840 Crash caused by query with IN subquery containing union

           of two table value costructors

This bug affected queries with a [NOT] IN/ANY/ALL subquery whose top level
unit contained several table value constructors.
The problem appeared because the code of the function
Item_subselect::fix_fields() that was responsible for wrapping table
value constructors encountered at the top level unit of a [NOT] IN/ANY/ALL
subquery did not take into account that the chain of the select objects
comprising the unit were not immutable.

Approved by Oleksandr Byelkin <sanja@mariadb.com>

1 files changed, 6 insertions, 5 deletions

diff --git a/sql/sql_tvc.cc b/sql/sql_tvc.cc
index 1f91539ff45..78607b61e6d 100644
--- a/sql/sql_tvc.cc
+++ b/sql/sql_tvc.cc
@@ -779,11 +779,12 @@ st_select_lex *wrap_tvc_with_tail(THD *thd, st_select_lex *tvc_sl)
     SELECT * FROM (VALUES (v1), ... (vn)) tvc_x
     and replaces the subselect with the result of the transformation.
 
-  @retval false if successfull
-          true  otherwise
+  @retval wrapping select if successful
+          0  otherwise
 */
 
-bool Item_subselect::wrap_tvc_into_select(THD *thd, st_select_lex *tvc_sl)
+st_select_lex *
+Item_subselect::wrap_tvc_into_select(THD *thd, st_select_lex *tvc_sl)
 {
   LEX *lex= thd->lex;
   /* SELECT_LEX object where the transformation is performed */
@@ -794,12 +795,12 @@ bool Item_subselect::wrap_tvc_into_select(THD *thd, st_select_lex *tvc_sl)
     if (engine->engine_type() == subselect_engine::SINGLE_SELECT_ENGINE)
       ((subselect_single_select_engine *) engine)->change_select(wrapper_sl);
     lex->current_select= wrapper_sl;
-    return false;
+    return wrapper_sl;
   }
   else
   {
     lex->current_select= parent_select;
-    return true;
+    return 0;
   }
 }