Bug#16234 XML: Crash if ExtractValue()

  Also fixes 16314: XML: extractvalue() crash if vertical bar
xml.result, xml.test:
  Adding test case
item_xmlfunc.cc:
  Using root element as a context node,
  instead of NULL, with relative paths.


sql/item_xmlfunc.cc:
  Bug#16234 XML: Crash if ExtractValue()
  Also fixes 16314: XML: extractvalue() crash if vertical bar
  Use root element as a context node,
  instead of NULL, with relative paths.
mysql-test/t/xml.test:
  Adding test case
mysql-test/r/xml.result:
  Adding test case

mysql-test/r/xml.result

@@ -520,3 +520,25 @@ UpdateXML(@xml, '/a/b/@bb2', '')
 select UpdateXML(@xml, '/a/b/@bb2', 'bb3="bb3"');
 UpdateXML(@xml, '/a/b/@bb2', 'bb3="bb3"')
 <a aa1="aa1" aa2="aa2"><b bb1="bb1" bb3="bb3">bb</b></a>
+SET @xml= '<order><clerk>lesser wombat</clerk></order>';
+select extractvalue(@xml,'order/clerk');
+extractvalue(@xml,'order/clerk')
+lesser wombat
+select extractvalue(@xml,'/order/clerk');
+extractvalue(@xml,'/order/clerk')
+lesser wombat
+select extractvalue('<a><b>B</b></a>','/a|/b');
+extractvalue('<a><b>B</b></a>','/a|/b')
+
+select extractvalue('<a><b>B</b></a>','/a|b');
+extractvalue('<a><b>B</b></a>','/a|b')
+
+select extractvalue('<a>a<b>B</b></a>','/a|/b');
+extractvalue('<a>a<b>B</b></a>','/a|/b')
+a
+select extractvalue('<a>a<b>B</b></a>','/a|b');
+extractvalue('<a>a<b>B</b></a>','/a|b')
+a
+select extractvalue('<a>a<b>B</b></a>','a|/b');
+extractvalue('<a>a<b>B</b></a>','a|/b')
+a

mysql-test/t/xml.test

@@ -215,3 +215,19 @@ select UpdateXML(@xml, '/a/b/@bb1', '');
 select UpdateXML(@xml, '/a/b/@bb1', 'bb3="bb3"');
 select UpdateXML(@xml, '/a/b/@bb2', '');
 select UpdateXML(@xml, '/a/b/@bb2', 'bb3="bb3"');
+
+#
+#  Bug#16234 XML: Crash if ExtractValue()
+#
+SET @xml= '<order><clerk>lesser wombat</clerk></order>';
+select extractvalue(@xml,'order/clerk');
+select extractvalue(@xml,'/order/clerk');
+
+#
+# Bug#16314 XML: extractvalue() crash if vertical bar
+#
+select extractvalue('<a><b>B</b></a>','/a|/b');
+select extractvalue('<a><b>B</b></a>','/a|b');
+select extractvalue('<a>a<b>B</b></a>','/a|/b');
+select extractvalue('<a>a<b>B</b></a>','/a|b');
+select extractvalue('<a>a<b>B</b></a>','a|/b');

sql/item_xmlfunc.cc

@@ -101,6 +101,7 @@ typedef struct my_xpath_st
   MY_XPATH_FUNC *func;   /* last scanned function creator             */
   Item *item;            /* current expression                        */
   Item *context;         /* last scanned context                      */
+  Item *rootelement;     /* The root element                          */
   String *context_cache; /* last context provider                     */
   String *pxml;          /* Parsed XML, an array of MY_XML_NODE       */
   CHARSET_INFO *cs;      /* character set/collation string comparison */
@@ -1464,6 +1465,8 @@ static int my_xpath_parse_LocationPath(MY_XPATH *xpath)
 {
   Item *context= xpath->context;
 
+  if (!xpath->context)
+    xpath->context= xpath->rootelement;
   int rc= my_xpath_parse_RelativeLocationPath(xpath) || 
           my_xpath_parse_AbsoluteLocationPath(xpath);
 
@@ -1496,7 +1499,7 @@ static int my_xpath_parse_AbsoluteLocationPath(MY_XPATH *xpath)
   if (!my_xpath_parse_term(xpath, MY_XPATH_LEX_SLASH))
     return 0;
 
-  xpath->context= new Item_nodeset_func_rootelement(xpath->pxml);
+  xpath->context= xpath->rootelement;
 
   if (my_xpath_parse_term(xpath, MY_XPATH_LEX_SLASH))
   {
@@ -2292,6 +2295,8 @@ my_xpath_parse(MY_XPATH *xpath, const char *str, const char *strend)
   my_xpath_lex_init(&xpath->prevtok, str, strend);
   my_xpath_lex_scan(xpath, &xpath->lasttok, str, strend);
 
+  xpath->rootelement= new Item_nodeset_func_rootelement(xpath->pxml);
+
   return
      my_xpath_parse_Expr(xpath) &&
      my_xpath_parse_term(xpath, MY_XPATH_LEX_EOF);