From a80dbe068ca650ef1f4daee2263f0bc6e7aeb0e1 Mon Sep 17 00:00:00 2001 From: Alexander Barkov Date: Mon, 20 Jun 2016 14:11:01 +0400 Subject: MDEV-10020 InnoDB NOT IN Query Crash When One Item Is NULL The problem was that the loop in get_func_mm_tree() accessed improperly initialized instances of String, which resided in the bzero'ed part of the in_vector::base array. Strings in in_vector::base are originally initialized in Item_func_in::fix_length_and_dec(), in in_vector::in_vector() using sql_calloc, rather than using a String constructor, so their str_charset members are originally equal to NULL. Strings in in_vector::base are later initialized to good values in Item_func_in::fix_length_and_dec(), using array->set(), in this code: uint j=0; for (uint i=1 ; i < arg_count ; i++) { array->set(j,args[i]); if (!args[i]->null_value) // Skip NULL values j++; else have_null= 1; } if ((array->used_count= j)) array->sort(); NULLs are not taken into account, so at the end array->used_count can be smaller than array->count. This patch fixes the loop in opt_range.cc, in get_func_mm_tree(), to access only properly initialized elements in in_vector::base, preventing access to its bzero'ed non-initialized tail. --- mysql-test/r/func_in.result | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'mysql-test/r/func_in.result') diff --git a/mysql-test/r/func_in.result b/mysql-test/r/func_in.result index fc56660ac62..210b0a9ef91 100644 --- a/mysql-test/r/func_in.result +++ b/mysql-test/r/func_in.result @@ -812,3 +812,22 @@ EXECUTE s; 1 DROP TABLE t1; # End of 5.3 tests +# +# Start of 10.0 tests +# +# +# MDEV-10020 InnoDB NOT IN Query Crash When One Item Is NULL +# +CREATE TABLE t1 +( +a INT(11), +b VARCHAR(10), +KEY (b) +); +INSERT INTO t1 VALUES (1,'x'),(2,'y'),(3,'z'); +SELECT * FROM t1 WHERE b NOT IN (NULL, '', 'A'); +a b +DROP TABLE t1; +# +# End of 10.0 tests +# -- cgit v1.2.1