[Commits] 77dfdf839c6: MDEV-25629: Crash in get_sort_by_table() in subquery with order by having outer ref

psergey sergey at mariadb.com
Fri May 14 20:43:21 EEST 2021


revision-id: 77dfdf839c61d84e913710da7b3647cd02e4ab58 (mariadb-10.2.31-950-g77dfdf839c6)
parent(s): e607f3398c69147299884d3814cf063d2e7516ce
author: Sergei Petrunia
committer: Sergei Petrunia
timestamp: 2021-05-14 20:43:21 +0300
message:

MDEV-25629: Crash in get_sort_by_table() in subquery with order by having outer ref

In Item_field::fix_fields(): when the item was resolved to an Item_field
in the SELECT's select_list, copy the Item_field's "depended_from" field.

Failure to do so caused the item to have incorrect attributes: it pointed
to a Field in an upper select but used_tables() didn't return
OUTER_REF_TABLE_BIT.

---
 mysql-test/r/subselect4.result | 10 ++++++++++
 mysql-test/t/subselect4.test   | 14 ++++++++++++++
 sql/item.cc                    |  1 +
 3 files changed, 25 insertions(+)

diff --git a/mysql-test/r/subselect4.result b/mysql-test/r/subselect4.result
index 4021f717964..2a691799be5 100644
--- a/mysql-test/r/subselect4.result
+++ b/mysql-test/r/subselect4.result
@@ -2783,3 +2783,13 @@ INSERT INTO t2 VALUES (3),(4);
 SELECT 1 IN (SELECT (SELECT a FROM t1) AS x FROM t2 GROUP BY x);
 ERROR 21000: Subquery returns more than 1 row
 drop table t1,t2;
+#
+# MDEV-25629: Crash in get_sort_by_table() in subquery with order by having outer ref
+#
+CREATE TABLE t1 (i1 int);
+insert into t1 values (1),(2);
+SELECT 1
+FROM (t1 JOIN t1 AS ref_t1 ON
+(t1.i1 > (SELECT ref_t1.i1 AS c0 FROM t1 b ORDER BY -c0)));
+ERROR 21000: Subquery returns more than 1 row
+DROP TABLE t1;
diff --git a/mysql-test/t/subselect4.test b/mysql-test/t/subselect4.test
index e218e3aab18..58aa7868815 100644
--- a/mysql-test/t/subselect4.test
+++ b/mysql-test/t/subselect4.test
@@ -2282,3 +2282,17 @@ INSERT INTO t2 VALUES (3),(4); # Optional, fails either way
 --error ER_SUBQUERY_NO_1_ROW
 SELECT 1 IN (SELECT (SELECT a FROM t1) AS x FROM t2 GROUP BY x);
 drop table t1,t2;
+
+--echo #
+--echo # MDEV-25629: Crash in get_sort_by_table() in subquery with order by having outer ref
+--echo #
+CREATE TABLE t1 (i1 int);
+insert into t1 values (1),(2);
+
+--error ER_SUBQUERY_NO_1_ROW
+SELECT 1
+FROM (t1 JOIN t1 AS ref_t1 ON
+	(t1.i1 > (SELECT ref_t1.i1 AS c0 FROM t1 b ORDER BY -c0)));
+
+DROP TABLE t1;
+
diff --git a/sql/item.cc b/sql/item.cc
index 42272fe0148..be64edca9a1 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -5513,6 +5513,7 @@ bool Item_field::fix_fields(THD *thd, Item **reference)
             */
             set_max_sum_func_level(thd, select);
             set_field(new_field);
+            depended_from= (*((Item_field**)res))->depended_from;
             return 0;
           }
           else


More information about the commits mailing list