From dae4fb0acb373e653f826f0ec7bdaf2485ef0b93 Mon Sep 17 00:00:00 2001 From: Alexander Barkov Date: Tue, 30 Jan 2018 11:07:35 +0400 Subject: MDEV-15118 ExtractValue(xml,something_complex) does not work Item_xml_str_func::fix_fields() used a local "String tmp" as a buffer for args[1]->val_str(). "tmp" was freed at the end of fix_fields(), while Items created during my_xpath_parse() still pointed to its fragments. Adding a new member Item_xml_str_func::m_xpath_query and store the result of args[1]->val_str() into it. --- sql/item_xmlfunc.cc | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'sql/item_xmlfunc.cc') diff --git a/sql/item_xmlfunc.cc b/sql/item_xmlfunc.cc index c7fd923b0ae..c12f5fd3e87 100644 --- a/sql/item_xmlfunc.cc +++ b/sql/item_xmlfunc.cc @@ -2634,7 +2634,7 @@ void Item_xml_str_func::fix_length_and_dec() bool Item_xml_str_func::fix_fields(THD *thd, Item **ref) { - String *xp, tmp; + String *xp; MY_XPATH xpath; int rc; @@ -2662,7 +2662,13 @@ bool Item_xml_str_func::fix_fields(THD *thd, Item **ref) return true; } - if (!(xp= args[1]->val_str(&tmp))) + /* + Get the XPath query text from args[1] and cache it in m_xpath_query. + Its fragments will be referenced by items created during my_xpath_parse(), + e.g. by Item_nodeset_func_axisbyname::node_name. + */ + if (!(xp= args[1]->val_str(&m_xpath_query)) || + (xp != &m_xpath_query && m_xpath_query.copy(*xp))) return false; // Will return NULL my_xpath_init(&xpath); xpath.cs= collation.collation; -- cgit v1.2.1