• Sergey Glukhov's avatar
    Bug#43612 crash with explain extended, union, order by · fc57b4cf
    Sergey Glukhov authored
    In UNION if we use last SELECT without braces and this
    SELECT have ORDER BY clause, such clause belongs to
    global UNION. It is parsed like last SELECT
    part and used further as 'unit->global_parameters->order_list' value.
    During DESCRIBE EXTENDED we call select_lex->print_order() for
    last SELECT where order fields refer to tmp table 
    which already freed. It leads to crash.
    The fix is clean up global_parameters->order_list
    instead of fake_select_lex->order_list.
    
    
    mysql-test/r/union.result:
      test result
    mysql-test/t/union.test:
      test case
    sql/sql_union.cc:
      In UNION if we use last SELECT without braces and this
      SELECT have ORDER BY clause, such clause belongs to
      global UNION. It is parsed like last SELECT
      part and used further as 'unit->global_parameters->order_list' value.
      During DESCRIBE EXTENDED we call select_lex->print_order() for
      last SELECT where order fields refer to tmp table 
      which already freed. It leads to crash.
      The fix is clean up global_parameters->order_list
      instead of fake_select_lex->order_list.
    fc57b4cf
sql_union.cc 22.6 KB