• Alexey Kopytov's avatar
    Bug #55568: user variable assignments crash server when used · 0e74ac50
    Alexey Kopytov authored
                within query
    
    The server could crash after materializing a derived table
    which requires a temporary table for grouping.
    
    When destroying the temporary table used to execute a query for
    a derived table, JOIN::destroy() did not clean up Item_fields
    pointing to fields in the temporary table. This led to
    dereferencing a dangling pointer when printing out the items
    tree later in the outer SELECT.
    
    The solution is an addendum to the patch for bug37362: in
    addition to cleaning up items in tmp_all_fields3, do the same
    for items in tmp_all_fields1, since now we have an example
    where this is necessary.
    0e74ac50
sql_select.h 27.1 KB