MDEV-31466 column count issue with union in derived table

In specifying a derived table with a union, for example

CREATE TABLE t (c1 INT KEY,c2 INT,c3 INT) ENGINE=MyISAM;
SELECT * FROM (SELECT * FROM t UNION SELECT * FROM t) AS d (d1,d2);

we bypass an earlier check for the correct number of specified column
names, causing a crash.

Fixed by adding a check for the correct number of supplied arguments
in st_select_lex_unit::rename_types_list()

mysql-test/main/derived.result

@@ -3315,6 +3315,10 @@ select * from ( select c1, c2, c3 from t1 ) as d1 (a1, a2, a3) where c1 = 1;
 ERROR 42S22: Unknown column 'c1' in 'where clause'
 select * from ( select c1, c2, c3 from t1 ) as d1 (a1, a2) where c1 = 1;
 ERROR HY000: Incorrect column name count for derived table
+select * from ( select c1, c2 from t1 union select c1, c2 from t1) as d1 (a1);
+ERROR HY000: Incorrect column name count for derived table
+select * from ( select * from t1 union select * from t1) as d1 (a1, a2);
+ERROR HY000: Incorrect column name count for derived table
 select * from ( select c1, c2, c3 from t1 ) as d1 () where c1 = 1;
 ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ') where c1 = 1' at line 1
 select * from ( select c1, c2, c3 from t1 ) as d1 (a1, a2, a3)

mysql-test/main/derived.test

@@ -1882,6 +1882,12 @@ select * from ( select c1, c2, c3 from t1 ) as d1 (a1, a2, a3) where c1 = 1;
 --error ER_INCORRECT_COLUMN_NAME_COUNT
 select * from ( select c1, c2, c3 from t1 ) as d1 (a1, a2) where c1 = 1;
 
+--error ER_INCORRECT_COLUMN_NAME_COUNT
+select * from ( select c1, c2 from t1 union select c1, c2 from t1) as d1 (a1);
+
+--error ER_INCORRECT_COLUMN_NAME_COUNT
+select * from ( select * from t1 union select * from t1) as d1 (a1, a2);
+
 --error ER_PARSE_ERROR
 select * from ( select c1, c2, c3 from t1 ) as d1 () where c1 = 1;
 

sql/sql_lex.h

@@ -804,7 +804,7 @@ class st_select_lex_unit: public st_select_lex_node {
   bool describe:1; /* union exec() called for EXPLAIN */
   bool columns_are_renamed:1;
   inline bool rename_item_list(TABLE_LIST *derived_arg);
-  inline void rename_types_list(List<Lex_ident_sys> *new_names);
+  inline bool rename_types_list(List<Lex_ident_sys> *new_names);
 
 protected:
   /* This is bool, not bit, as it's used and set in many places */

sql/sql_union.cc

@@ -1378,14 +1378,22 @@ inline bool st_select_lex_unit::rename_item_list(TABLE_LIST *derived_arg)
 }
 
 
-inline void st_select_lex_unit::rename_types_list(List<Lex_ident_sys> *newnames)
+inline bool st_select_lex_unit::rename_types_list(List<Lex_ident_sys> *newnames)
 {
+  if (item_list.elements != newnames->elements)
+  {
+    my_error(ER_INCORRECT_COLUMN_NAME_COUNT, MYF(0));
+    return true;
+  }
+
   List_iterator<Lex_ident_sys> it(*newnames);
   List_iterator_fast<Item> li(types);
   Item *item;
 
   while ((item= li++))
     lex_string_set( &item->name, (it++)->str);
+
+  return false;
 }
 
 
@@ -1973,7 +1981,10 @@ bool st_select_lex_unit::prepare(TABLE_LIST *derived_arg,
       Rename types used in result table for union.
     */
     if (derived_arg && derived_arg->column_names)
-      rename_types_list(derived_arg->column_names);
+    {
+      if (rename_types_list(derived_arg->column_names))
+        goto err;
+    }
 
     if (!thd->lex->is_view_context_analysis())
       pushdown_unit= find_unit_handler(thd, this);