From 1b5bd18dc6b34d3dc50b7495bae8c05e5125c0dc Mon Sep 17 00:00:00 2001 From: unknown Date: Wed, 20 Sep 2006 08:08:57 -0700 Subject: Fixed bug #22015: crash with GROUP_CONCAT over a derived table that returns the results of aggregation by GROUP_CONCAT. The crash was due to an overflow happened for the field sortoder->length. The fix prevents this overflow exploiting the fact that the value of sortoder->length cannot be greater than the value of thd->variables.max_sort_length. mysql-test/r/func_gconcat.result: Added a test case for bug #22015. mysql-test/t/func_gconcat.test: Added a test case for bug #22015. --- mysql-test/t/func_gconcat.test | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'mysql-test/t/func_gconcat.test') diff --git a/mysql-test/t/func_gconcat.test b/mysql-test/t/func_gconcat.test index 98c21986aa9..b5c468e1638 100644 --- a/mysql-test/t/func_gconcat.test +++ b/mysql-test/t/func_gconcat.test @@ -447,3 +447,18 @@ SELECT a, CHAR_LENGTH(b) FROM t1; SELECT CHAR_LENGTH( GROUP_CONCAT(b) ) FROM t1; SET GROUP_CONCAT_MAX_LEN = 1024; DROP TABLE t1; + +# +# Bug #22015: crash with GROUP_CONCAT over a derived table that +# returns the results of aggregation by GROUP_CONCAT +# + +CREATE TABLE t1 (a int, b int); + +INSERT INTO t1 VALUES (2,1), (1,2), (2,2), (1,3); + +SELECT GROUP_CONCAT(a), x + FROM (SELECT a, GROUP_CONCAT(b) x FROM t1 GROUP BY a) AS s + GROUP BY x; + +DROP TABLE t1; -- cgit v1.2.1