diff options
| author | Igor Babaev <igor@askmonty.org> | 2020-11-17 14:28:30 -0800 |
|---|---|---|
| committer | Igor Babaev <igor@askmonty.org> | 2020-11-17 14:29:53 -0800 |
| commit | 6628435e94f11116909163f1e135f86a64f2b6cb (patch) | |
| tree | b999ca4a89b09ecd447f09aacf247d638dd240ee /sql/sql_union.cc | |
| parent | ceef26cf86689f3dd1db010dc6ca1b065e32e6a4 (diff) | |
| download | mariadb-git-6628435e94f11116909163f1e135f86a64f2b6cb.tar.gz | |
MDEV-24220 Server crash in base_list_iterator::next or
in TABLE_LIST::is_recursive_with_tables
After the patch for MDEV-23619 the code of st_select_lex::cleanup started
using the list st_select_lex::leaf_tables. This list is built for any
query with FROM clause in the function setup_tables(). If such query is
used in a stored procedure it must be ensured that the list is empty
before each new call of the procedure. Otherwise if the first call of
the procedure is successful while the second call reports an error before
the setup_tables() is invoked then list st_select_lex::leaf_tables would
point to a piece of memory that has been already freed.
Approved by Oleksandr Byelkin <sanja@mariadb.com>
Diffstat (limited to 'sql/sql_union.cc')
| -rw-r--r-- | sql/sql_union.cc | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sql/sql_union.cc b/sql/sql_union.cc index 9a16237042b..7716f792fdc 100644 --- a/sql/sql_union.cc +++ b/sql/sql_union.cc @@ -1568,6 +1568,7 @@ bool st_select_lex::cleanup() delete join; join= 0; } + leaf_tables.empty(); for (SELECT_LEX_UNIT *lex_unit= first_inner_unit(); lex_unit ; lex_unit= lex_unit->next_unit()) { |