[MDEV-4290] crash in st_select_lex::mark_as_dependent Created: 2013-03-17  Updated: 2013-05-14  Resolved: 2013-05-14

Status: Closed
Project: MariaDB Server
Component/s: None
Affects Version/s: 10.0.1, 5.5.30, 5.3.12
Fix Version/s: 10.0.3, 5.5.31, 5.3.13

Type: Bug Priority: Major
Reporter: sbester1 Assignee: Oleksandr Byelkin
Resolution: Fixed Votes: 0
Labels: None
Environment:

Linux x64, Win x64



 Description   

Version: '10.0.1-MariaDB'  Source distribution
 Invalid write of size 1
at: st_select_lex::mark_as_dependent (sql_lex.cc:2189)
by: Item_sum::register_sum_func (item_sum.cc:366)
by: Item_sum::check_sum_func (item_sum.cc:164)
by: Item_sum_num::fix_fields (item_sum.cc:1156)
by: setup_conds (sql_base.cc:8901)
by: JOIN::prepare (sql_select.cc:613)
by: st_select_lex_unit::prepare (sql_union.cc:329)
by: mysql_derived_prepare (sql_derived.cc:623)
by: mysql_handle_single_derived (sql_derived.cc:179)
by: st_select_lex::handle_derived (sql_lex.cc:3543)
by: JOIN::prepare (sql_select.cc:672)
by: subselect_single_select_engine::prepare (item_subselect.cc:2999)
by: Item_subselect::fix_fields (item_subselect.cc:245)
by: find_order_in_list (sql_select.cc:19833)
by: setup_order (sql_select.cc:19859)
by: JOIN::prepare (sql_select.cc:620)
by: mysql_select (sql_select.cc:3172)
by: handle_select (sql_select.cc:363)
by: execute_sqlcom_select (sql_parse.cc:5004)
by: mysql_execute_command (sql_parse.cc:2472)
by: mysql_parse (sql_parse.cc:6124)
by: dispatch_command (sql_parse.cc:1266)
by: do_handle_one_connection (sql_connect.cc:1267)
by: handle_one_connection (sql_connect.cc:1181)
by: start_thread (pthread_create.c:309)
by: clone (clone.S:115)
  Address 0x102 is not stack'd, malloc'd or (recently) free'd

drop table if exists `v`;
create table `v`(`a` int)engine=innodb;
select 1 from `v` order by
(
	select 1 from 
	(
		select 1 from `v` `v1` right join `v` on count(*)
	) `v`   
);



 Comments   
Comment by Oleksandr Byelkin [ 2013-05-03 ]

fix committed for review.

Comment by Oleksandr Byelkin [ 2013-05-14 ]

pushed to 5.3

Generated at Thu Feb 08 06:55:16 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.