diff options
| author | timour@askmonty.org <timour@askmonty.org> | 2013-10-29 12:39:03 +0200 |
|---|---|---|
| committer | timour@askmonty.org <timour@askmonty.org> | 2013-10-29 12:39:03 +0200 |
| commit | 883af99e7dac91e3f258135a2053e6b8e3c05fc3 (patch) | |
| tree | 1881d9d2b897cfb3e086ed5a29a3a6bba6e0a410 /sql/sql_union.cc | |
| parent | 94ad392fd86b53f798c7de9489afe901e1f3a9b6 (diff) | |
| download | mariadb-git-883af99e7dac91e3f258135a2053e6b8e3c05fc3.tar.gz | |
MDEV-5104 crash in Item_field::used_tables with broken order by
Analysis:
st_select_lex_unit::prepare() computes can_skip_order_by as TRUE.
As a result join->prepare() gets called with order == NULL, and
doesn't do name resolution for the inner ORDER clause. Due to this
the prepare phase doesn't detect that the query references non-exiting
function and field.
Later join->optimize() calls update_used_tables() for a non-resolved
Item_field, which understandably has no Field object. This call results
in a crash.
Solution:
Resolve unnecessary ORDER BY clauses to detect if they reference non-exising
objects. Then remove such clauses from the JOIN object.
Diffstat (limited to 'sql/sql_union.cc')
| -rw-r--r-- | sql/sql_union.cc | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sql/sql_union.cc b/sql/sql_union.cc index 942392c4c98..5c4a9a8db5f 100644 --- a/sql/sql_union.cc +++ b/sql/sql_union.cc @@ -318,6 +318,7 @@ bool st_select_lex_unit::prepare(THD *thd_arg, select_result *sel_result, sl->group_list.elements, can_skip_order_by ? NULL : sl->order_list.first, + can_skip_order_by, sl->group_list.first, sl->having, (is_union_select ? NULL : @@ -501,7 +502,7 @@ bool st_select_lex_unit::prepare(THD *thd_arg, select_result *sel_result, 0, 0, global_parameters->order_list.elements, // og_num global_parameters->order_list.first, // order - NULL, NULL, NULL, + false, NULL, NULL, NULL, fake_select_lex, this); fake_select_lex->table_list.empty(); } |