MDEV-6868: MariaDB server crash ( select with union and order by with subquery )

Excluding ORDER BY condition should be done after preparation it (even to catch syntax errors).

1 files changed, 12 insertions, 12 deletions

diff --git a/sql/sql_union.cc b/sql/sql_union.cc
index 1bbd2eb6c29..6e2e6e06ff7 100644
--- a/sql/sql_union.cc
+++ b/sql/sql_union.cc
@@ -315,18 +315,6 @@ bool st_select_lex_unit::prepare(THD *thd_arg, select_result *sel_result,
 
     can_skip_order_by= is_union_select && !(sl->braces && sl->explicit_limit);
 
-    /*
-      Remove all references from the select_lex_units to the subqueries that
-      are inside the ORDER BY clause.
-    */
-    if (can_skip_order_by)
-    {
-      for (ORDER *ord= (ORDER *)sl->order_list.first; ord; ord= ord->next)
-      {
-        (*ord->item)->walk(&Item::eliminate_subselect_processor, FALSE, NULL);
-      }
-    }
-
     saved_error= join->prepare(&sl->ref_pointer_array,
                                sl->table_list.first,
                                sl->with_wild,
@@ -350,6 +338,18 @@ bool st_select_lex_unit::prepare(THD *thd_arg, select_result *sel_result,
     if (saved_error || (saved_error= thd_arg->is_fatal_error))
       goto err;
     /*
+      Remove all references from the select_lex_units to the subqueries that
+      are inside the ORDER BY clause.
+    */
+    if (can_skip_order_by)
+    {
+      for (ORDER *ord= (ORDER *)sl->order_list.first; ord; ord= ord->next)
+      {
+        (*ord->item)->walk(&Item::eliminate_subselect_processor, FALSE, NULL);
+      }
+    }
+
+    /*
       Use items list of underlaid select for derived tables to preserve
       information about fields lengths and exact types
     */