A fix (bug #6441: Aggregate UDF in multi-table query crashes MySQL when returning multiple rows).

sql/item_func.cc:
  A fix (bug #6441: Aggregate UDF in multi-table query crashes MySQL when returning multiple rows).
  Do nothing in the udf_handler destructor if not_original flag is set.
sql/item_sum.h:
  A fix (bug #6441: Aggregate UDF in multi-table query crashes MySQL when returning multiple rows).
  Set udf.not_original flag if we create an Item from the existent one.
sql/sql_udf.h:
  A fix (bug #6441: Aggregate UDF in multi-table query crashes MySQL when returning multiple rows).
  not_original flag added.

3 files changed, 14 insertions, 10 deletions

diff --git a/sql/item_func.cc b/sql/item_func.cc
index 09d7e50eaa3..32708ecb4ca 100644
--- a/sql/item_func.cc
+++ b/sql/item_func.cc
@@ -1602,18 +1602,21 @@ longlong Item_func_bit_count::val_int()
 
 udf_handler::~udf_handler()
 {
-  if (initialized)
+  if (!not_original)
   {
-    if (u_d->func_deinit != NULL)
+    if (initialized)
     {
-      void (*deinit)(UDF_INIT *) = (void (*)(UDF_INIT*))
-	u_d->func_deinit;
-      (*deinit)(&initid);
+      if (u_d->func_deinit != NULL)
+      {
+        void (*deinit)(UDF_INIT *) = (void (*)(UDF_INIT*))
+        u_d->func_deinit;
+        (*deinit)(&initid);
+      }
+      free_udf(u_d);
     }
-    free_udf(u_d);
+    if (buffers)				// Because of bug in ecc
+      delete [] buffers;
   }
-  if (buffers)					// Because of bug in ecc
-    delete [] buffers;
 }
 
 
diff --git a/sql/item_sum.h b/sql/item_sum.h
index 5aa0d37190b..74c28765f8d 100644
--- a/sql/item_sum.h
+++ b/sql/item_sum.h
@@ -532,7 +532,7 @@ public:
     :Item_sum( list ), udf(udf_arg)
   { quick_group=0;}
   Item_udf_sum(THD *thd, Item_udf_sum *item)
-    :Item_sum(thd, item), udf(item->udf) {}
+    :Item_sum(thd, item), udf(item->udf) { udf.not_original= TRUE; }
   const char *func_name() const { return udf.name(); }
   bool fix_fields(THD *thd, TABLE_LIST *tables, Item **ref)
   {
diff --git a/sql/sql_udf.h b/sql/sql_udf.h
index 7b10b80f148..d1f99a6d232 100644
--- a/sql/sql_udf.h
+++ b/sql/sql_udf.h
@@ -56,8 +56,9 @@ class udf_handler :public Sql_alloc
  public:
   table_map used_tables_cache;
   bool const_item_cache;
+  bool not_original;
   udf_handler(udf_func *udf_arg) :u_d(udf_arg), buffers(0), error(0),
-    is_null(0), initialized(0)
+    is_null(0), initialized(0), not_original(0)
   {}
   ~udf_handler();
   const char *name() const { return u_d ? u_d->name.str : "?"; }