Commit f1bff761 authored by evgen@moonbone.local's avatar evgen@moonbone.local

Bug#32482: Crash for a query with ORDER BY a user variable.

The Item_func_set_user_var::register_field_in_read_map() did not check 
that the result_field was null.This caused server crashes for queries that
required order by such a field and were executed without using a temporary
table.

The Item_func_set_user_var::register_field_in_read_map() now checks the
result_field to be not null.
parent d349effe
...@@ -353,3 +353,10 @@ select @a:=f4, count(f4) from t1 group by 1 desc; ...@@ -353,3 +353,10 @@ select @a:=f4, count(f4) from t1 group by 1 desc;
2.6 1 2.6 1
1.6 4 1.6 4
drop table t1; drop table t1;
create table t1 (f1 int);
insert into t1 values (2), (1);
select @i := f1 as j from t1 order by 1;
j
1
2
drop table t1;
...@@ -237,3 +237,11 @@ select @a:=f2, count(f2) from t1 group by 1 desc; ...@@ -237,3 +237,11 @@ select @a:=f2, count(f2) from t1 group by 1 desc;
select @a:=f3, count(f3) from t1 group by 1 desc; select @a:=f3, count(f3) from t1 group by 1 desc;
select @a:=f4, count(f4) from t1 group by 1 desc; select @a:=f4, count(f4) from t1 group by 1 desc;
drop table t1; drop table t1;
#
# Bug#32482: Crash for a query with ORDER BY a user variable.
#
create table t1 (f1 int);
insert into t1 values (2), (1);
select @i := f1 as j from t1 order by 1;
drop table t1;
...@@ -3848,9 +3848,12 @@ Item_func_set_user_var::fix_length_and_dec() ...@@ -3848,9 +3848,12 @@ Item_func_set_user_var::fix_length_and_dec()
bool Item_func_set_user_var::register_field_in_read_map(uchar *arg) bool Item_func_set_user_var::register_field_in_read_map(uchar *arg)
{ {
TABLE *table= (TABLE *) arg; if (result_field)
if (result_field->table == table || !table) {
bitmap_set_bit(result_field->table->read_set, result_field->field_index); TABLE *table= (TABLE *) arg;
if (result_field->table == table || !table)
bitmap_set_bit(result_field->table->read_set, result_field->field_index);
}
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment