diff options
| author | Igor Babaev <igor@askmonty.org> | 2023-01-25 11:46:28 -0800 |
|---|---|---|
| committer | Igor Babaev <igor@askmonty.org> | 2023-01-25 14:27:55 -0800 |
| commit | 4652260d656ea871fe1ff31176b6d85eeffde932 (patch) | |
| tree | b614fe36abb9e77f9fa78fac2d5a80bb380fb6e4 /sql | |
| parent | 2279dddad6bea00c5774a76f410c11fd56ad168f (diff) | |
| download | mariadb-git-4652260d656ea871fe1ff31176b6d85eeffde932.tar.gz | |
MDEV-28616 Crash when using derived table over union with order by clausebb-10.3-igor
This bug manifested itself when the server processed a query containing
a derived table over union whose ORDER BY clause included a subquery
with unresolvable column reference. For such a query the server crashed
when trying to resolve column references in the ORDER BY clause used by
union.
For any union with ORDER BY clause an extra SELECT_LEX structure is created
and it is attached to SELECT_LEX_UNIT structure of the union via the field
fake_select_lex. The outer context for fake_select_lex must be the same as
for other selects of the union. If the union is used in the FROM list of
a derived table then the outer context for fake_select_lex must be set to
NULL in line with other selects of the union. It was not done and it
caused a crash when searching for possible resolution of an unresolvable
column reference occurred in a subquery used in the ORDER BY clause.
Approved by Oleksandr Byelkin <sanja@mariadb.com>
Diffstat (limited to 'sql')
| -rw-r--r-- | sql/sql_derived.cc | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/sql/sql_derived.cc b/sql/sql_derived.cc index 93dc62828ac..8177ee27943 100644 --- a/sql/sql_derived.cc +++ b/sql/sql_derived.cc @@ -771,6 +771,9 @@ bool mysql_derived_prepare(THD *thd, LEX *lex, TABLE_LIST *derived) cursor->outer_join|= JOIN_TYPE_OUTER; } } + // Prevent it for possible ORDER BY clause + if (unit->fake_select_lex) + unit->fake_select_lex->context.outer_context= 0; /* Above cascade call of prepare is important for PS protocol, but after it |