• Chaithra Gopalareddy's avatar
    · 94346a8b
    Chaithra Gopalareddy authored
    Bug #16347343 : CRASH, GROUP_CONCAT, DERIVED TABLES
          
    Problem:
    A select query inside a group_concat function having an 
    outer reference results in a crash.
          
    Analysis:
    In function Item_group_concat::add, we do not check if 
    return value of get_tmp_table_field can be NULL for 
    a non-const item. This can happen for a query with a 
    outer reference.
    While resolving the outer reference in the query present
    inside group_concat function, we set the "const_item_cache" 
    to false. As a result in the call to const_item() from 
    Item_func_group_concat::add, it returns false and goes on 
    to check if this can be NULL resulting in the crash.
    get_tmp_table_field does not return NULL for Items of type 
    Item_field, Item_result_field and Item_ref. 
    For all other items, it returns NULL. 
         
    Solution:
    Check for the return value of get_tmp_table_field before we 
    access field contents.
    94346a8b
item_sum.cc 86 KB