From d88dfd873232dafd480c2d0382b4ff3add9c936d Mon Sep 17 00:00:00 2001
From: Sergei Golubchik <serg@mariadb.org>
Date: Sat, 27 Apr 2019 19:38:39 +0200
Subject: MDEV-19350 Server crashes in delete_tree_element / ... /
 Item_func_group_concat::repack_tree

Item_func_group_concat stores values in `tree`, which is often, but not
always the same as `&tree_base`.
---
 sql/item_sum.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'sql')

diff --git a/sql/item_sum.cc b/sql/item_sum.cc
index 281b3af5a4d..71f07706d22 100644
--- a/sql/item_sum.cc
+++ b/sql/item_sum.cc
@@ -3345,8 +3345,8 @@ bool Item_func_group_concat::repack_tree(THD *thd)
     delete_tree(&st.tree);
     return 1;
   }
-  delete_tree(&tree_base);
-  tree_base= st.tree;
+  delete_tree(tree);
+  *tree= st.tree;
   tree_len= st.len;
   return 0;
 }
-- 
cgit v1.2.1