• Gleb Shchepa's avatar
    Bug#42188: crash and/or memory corruption with user variables · 33a09cdc
    Gleb Shchepa authored
               in trigger
    
    Interchangeable calls to the mysql_change_user client function
    and invocations of a trigger changing some user variable caused
    a memory corruption and a crash.
    
    The mysql_change_user API call forces TDH::cleanup() on a server
    that frees user variable entries.
    However it didn't reset Item_func_set_user_var::entry to NULL
    because Item_func_set_user_var::cleanup() was not overloaded.
    So, Item_func_set_user_var::entry held a pointer to freed memory,
    that caused a crash.
    
    The Item_func_set_user_var::cleanup method has been overloaded
    to cleanup the Item_func_set_user_var::entry field.
    33a09cdc
item_func.h 47.7 KB