MDEV-24840 Crash caused by query with IN subquery containing union

           of two table value costructors

This bug affected queries with a [NOT] IN/ANY/ALL subquery whose top level
unit contained several table value constructors.
The problem appeared because the code of the function
Item_subselect::fix_fields() that was responsible for wrapping table
value constructors encountered at the top level unit of a [NOT] IN/ANY/ALL
subquery did not take into account that the chain of the select objects
comprising the unit were not immutable.

Approved by Oleksandr Byelkin <sanja@mariadb.com>

3 files changed, 12 insertions, 7 deletions

diff --git a/sql/item_subselect.cc b/sql/item_subselect.cc
index d882918de5c..6a30012cda4 100644
--- a/sql/item_subselect.cc
+++ b/sql/item_subselect.cc
@@ -269,7 +269,11 @@ bool Item_subselect::fix_fields(THD *thd_param, Item **ref)
   {
     if (sl->tvc)
     {
-      wrap_tvc_into_select(thd, sl);
+      if (!(sl= wrap_tvc_into_select(thd, sl)))
+      {
+        res= TRUE;
+        goto end;
+      }
     }
   }
   
diff --git a/sql/item_subselect.h b/sql/item_subselect.h
index fdc39f1f05e..4e0a9639187 100644
--- a/sql/item_subselect.h
+++ b/sql/item_subselect.h
@@ -271,7 +271,7 @@ public:
   Item* build_clone(THD *thd) { return 0; }
   Item* get_copy(THD *thd) { return 0; }
 
-  bool wrap_tvc_into_select(THD *thd, st_select_lex *tvc_sl);
+  st_select_lex *wrap_tvc_into_select(THD *thd, st_select_lex *tvc_sl);
 
   friend class select_result_interceptor;
   friend class Item_in_optimizer;
diff --git a/sql/sql_tvc.cc b/sql/sql_tvc.cc
index 1f91539ff45..78607b61e6d 100644
--- a/sql/sql_tvc.cc
+++ b/sql/sql_tvc.cc
@@ -779,11 +779,12 @@ st_select_lex *wrap_tvc_with_tail(THD *thd, st_select_lex *tvc_sl)
     SELECT * FROM (VALUES (v1), ... (vn)) tvc_x
     and replaces the subselect with the result of the transformation.
 
-  @retval false if successfull
-          true  otherwise
+  @retval wrapping select if successful
+          0  otherwise
 */
 
-bool Item_subselect::wrap_tvc_into_select(THD *thd, st_select_lex *tvc_sl)
+st_select_lex *
+Item_subselect::wrap_tvc_into_select(THD *thd, st_select_lex *tvc_sl)
 {
   LEX *lex= thd->lex;
   /* SELECT_LEX object where the transformation is performed */
@@ -794,12 +795,12 @@ bool Item_subselect::wrap_tvc_into_select(THD *thd, st_select_lex *tvc_sl)
     if (engine->engine_type() == subselect_engine::SINGLE_SELECT_ENGINE)
       ((subselect_single_select_engine *) engine)->change_select(wrapper_sl);
     lex->current_select= wrapper_sl;
-    return false;
+    return wrapper_sl;
   }
   else
   {
     lex->current_select= parent_select;
-    return true;
+    return 0;
   }
 }