Bug#25126: Reference to non-existant column in UPDATE...ORDER BY... crashes server

"update existingtable set anycolumn=nonexisting order by nonexisting" would crash
the server.

Though we would find the reference to a field, that doesn't mean we can then use
it to set some values.  It could be a reference to another field.  If it is NULL, 
don't try to use it to set values in the Item_field and instead return an error.

Over the previous patch, this signals an error at the location of the error, rather
than letting the subsequent deref signal it.


mysql-test/r/order_by.result:
  Verify that all permutations work.
mysql-test/t/order_by.test:
  Verify that all permutations work.
sql/item.cc:
  When the field is NULL, don't dereference it when we set_field().  
  Instead, raise an error.

1 files changed, 12 insertions, 1 deletions

diff --git a/sql/item.cc b/sql/item.cc
index 45d7856b2c1..3b7fa10902e 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -1771,7 +1771,18 @@ bool Item_field::fix_fields(THD *thd, TABLE_LIST *tables, Item **ref)
              use the field from the Item_field in the select list and leave
              the Item_field instance in place.
             */
-            set_field((*((Item_field**)res))->field);
+
+            Field *field= (*((Item_field**)res))->field;
+
+            if (field == NULL)
+            {
+              /* The column to which we link isn't valid. */
+              my_error(ER_BAD_FIELD_ERROR, MYF(0), (*res)->name, 
+                       current_thd->where);
+              return(1);
+            }
+
+            set_field(field);
             return 0;
           }
           else