Commit d56ac2f3 authored by sergefp@mysql.com's avatar sergefp@mysql.com
Browse files

BUG#33794 "MySQL crashes executing specific query": 

The problem occurred when one had a subquery that had an equality X=Y where 
Y referred to a named select list expression from the parent select. MySQL 
crashed when trying to use the X=Y equality for ref-based access. 

Fixed by allowing non-Item_field items in the described case.
parent 8eb74b1f

mysql-test/r/subselect.result

+48 −0
Original line number Diff line number Diff line
@@ -4392,4 +4392,52 @@ select count(*) from t1 where f12 = 
count(*)

3

drop table t1,t2;

CREATE TABLE t4 (

f7 varchar(32) collate utf8_bin NOT NULL default '',

f10 varchar(32) collate utf8_bin default NULL,

PRIMARY KEY  (f7)

);

INSERT INTO t4 VALUES(1,1), (2,null);

CREATE TABLE t2 (

f4 varchar(32) collate utf8_bin NOT NULL default '',

f2 varchar(50) collate utf8_bin default NULL,

f3 varchar(10) collate utf8_bin default NULL,

PRIMARY KEY  (f4),

UNIQUE KEY uk1 (f2)

);

INSERT INTO t2 VALUES(1,1,null), (2,2,null);

CREATE TABLE t1 (

f8 varchar(32) collate utf8_bin NOT NULL default '',

f1 varchar(10) collate utf8_bin default NULL,

f9 varchar(32) collate utf8_bin default NULL,

PRIMARY KEY  (f8)

);

INSERT INTO t1 VALUES (1,'P',1), (2,'P',1), (3,'R',2);

CREATE TABLE t3 (

f6 varchar(32) collate utf8_bin NOT NULL default '',

f5 varchar(50) collate utf8_bin default NULL,

PRIMARY KEY (f6)

);

INSERT INTO t3 VALUES (1,null), (2,null);

SELECT

IF(t1.f1 = 'R', a1.f2, t2.f2) AS a4,

IF(t1.f1 = 'R', a1.f3, t2.f3) AS f3,

SUM(

IF(

(SELECT VPC.f2

FROM t2 VPC, t4 a2, t2 a3

WHERE

VPC.f4 = a2.f10 AND a3.f2 = a4

LIMIT 1) IS NULL, 

0, 

t3.f5

)

) AS a6

FROM 

t2, t3, t1 JOIN t2 a1 ON t1.f9 = a1.f4

GROUP BY a4;

a4	f3	a6

1	NULL	NULL

2	NULL	NULL

DROP TABLE t1, t2;

End of 5.0 tests.

mysql-test/t/subselect.test

+55 −0
Original line number Diff line number Diff line
@@ -3252,4 +3252,59 @@ select count(*) from t1 where f12 = 
(select f22 from t2 where f22 = f12 order by f21 desc, f22, f23 limit 1);



drop table t1,t2;



#

# BUG#33794 "MySQL crashes executing specific query on specific dump"

#

CREATE TABLE t4 (

  f7 varchar(32) collate utf8_bin NOT NULL default '',

  f10 varchar(32) collate utf8_bin default NULL,

  PRIMARY KEY  (f7)

);

INSERT INTO t4 VALUES(1,1), (2,null);



CREATE TABLE t2 (

  f4 varchar(32) collate utf8_bin NOT NULL default '',

  f2 varchar(50) collate utf8_bin default NULL,

  f3 varchar(10) collate utf8_bin default NULL,

  PRIMARY KEY  (f4),

  UNIQUE KEY uk1 (f2)

);

INSERT INTO t2 VALUES(1,1,null), (2,2,null);



CREATE TABLE t1 (

  f8 varchar(32) collate utf8_bin NOT NULL default '',

  f1 varchar(10) collate utf8_bin default NULL,

  f9 varchar(32) collate utf8_bin default NULL,

  PRIMARY KEY  (f8)

);

INSERT INTO t1 VALUES (1,'P',1), (2,'P',1), (3,'R',2);



CREATE TABLE t3 (

  f6 varchar(32) collate utf8_bin NOT NULL default '',

  f5 varchar(50) collate utf8_bin default NULL,

  PRIMARY KEY (f6)

);

INSERT INTO t3 VALUES (1,null), (2,null);



SELECT

  IF(t1.f1 = 'R', a1.f2, t2.f2) AS a4,

  IF(t1.f1 = 'R', a1.f3, t2.f3) AS f3,

  SUM(

    IF(

      (SELECT VPC.f2

       FROM t2 VPC, t4 a2, t2 a3

       WHERE

         VPC.f4 = a2.f10 AND a3.f2 = a4

       LIMIT 1) IS NULL, 

       0, 

       t3.f5

    )

  ) AS a6

FROM 

  t2, t3, t1 JOIN t2 a1 ON t1.f9 = a1.f4

GROUP BY a4;



DROP TABLE t1, t2;

--echo End of 5.0 tests.

sql/sql_select.cc

+2 −1
Original line number Diff line number Diff line
@@ -5379,7 +5379,8 @@ get_store_key(THD *thd, KEYUSE *keyuse, table_map used_tables, 
           (keyuse->val->type() == Item::REF_ITEM &&

            ((Item_ref*)keyuse->val)->ref_type() == Item_ref::OUTER_REF &&

            (*(Item_ref**)((Item_ref*)keyuse->val)->ref)->ref_type() ==

             Item_ref::DIRECT_REF) )

             Item_ref::DIRECT_REF && 

            keyuse->val->real_item()->type() == Item::FIELD_ITEM))

    return new store_key_field(thd,

			       key_part->field,

			       key_buff + maybe_null,