diff options
| author | Igor Babaev <igor@askmonty.org> | 2023-04-21 13:46:14 -0700 |
|---|---|---|
| committer | Igor Babaev <igor@askmonty.org> | 2023-04-24 07:39:19 -0700 |
| commit | 5dc9a6b4558d50298882b3d76b3249e9419e3682 (patch) | |
| tree | e02e86325713b391b7a769675785e112a8a0720a /sql | |
| parent | d3e394b3b1ff1e2c4e160972aad1f78a13fbb62e (diff) | |
| download | mariadb-git-5dc9a6b4558d50298882b3d76b3249e9419e3682.tar.gz | |
MDEV-31102 Crash when pushing condition into view defined as union
This bug could manifest itself at the first execution of prepared statement
created for queries using a materialized view defined as union. A crash
could happen for sure if the query contained a condition pushable into
the view and this condition was over the column defined via a complex string
expression requiring implicit conversion from one charset to another for
some of its sub-expressions. The bug could cause crashes when executing
PS for some other queries whose optimization needed building clones for
such expressions.
This bug was introduced in the patch for MDEV-29988 where the class
Item_direct_ref_to_item was added. The implementations of the virtual
methods get_copy() and build_clone() were invalid for the class and this
could cause crashes after the method build_clone() was called for
expressions containing objects of the Item_direct_ref_to_item type.
Approved by Sergei Golubchik <serg@mariadb.com>
Diffstat (limited to 'sql')
| -rw-r--r-- | sql/item.h | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/sql/item.h b/sql/item.h index 31568aafc8c..1e0caaa7c83 100644 --- a/sql/item.h +++ b/sql/item.h @@ -7647,7 +7647,7 @@ public: Item *get_tmp_table_item(THD *thd) { return m_item->get_tmp_table_item(thd); } Item *get_copy(THD *thd) - { return m_item->get_copy(thd); } + { return get_item_copy<Item_direct_ref_to_item>(thd, this); } COND *build_equal_items(THD *thd, COND_EQUAL *inherited, bool link_item_fields, COND_EQUAL **cond_equal_ref) @@ -7715,7 +7715,20 @@ public: bool excl_dep_on_grouping_fields(st_select_lex *sel) { return m_item->excl_dep_on_grouping_fields(sel); } bool is_expensive() { return m_item->is_expensive(); } - Item* build_clone(THD *thd) { return get_copy(thd); } + void set_item(Item *item) { m_item= item; } + Item *build_clone(THD *thd) + { + Item *clone_item= m_item->build_clone(thd); + if (clone_item) + { + Item_direct_ref_to_item *copy= (Item_direct_ref_to_item *) get_copy(thd); + if (!copy) + return 0; + copy->set_item(clone_item); + return copy; + } + return 0; + } void split_sum_func(THD *thd, Ref_ptr_array ref_pointer_array, List<Item> &fields, uint flags) |