Skip to content

Commit 21b8743

Browse files
igorbabaevigorbabaev
committed
MDEV-21673 Calling stored procedure twice in the same session causes MariaDB to crash
This bug could happen only with a stored procedure containing queries with more than one reference to a CTE that used local variables / parameters. This bug was the result of an incomplete merge of the fix for the bug MDEV-17154. The merge covered usage of parameter markers occurred in a CTE that was referenced more than once, but missed coverage of local variables.
1 parent fbef428 commit 21b8743

File tree

3 files changed

+219
-4
lines changed

3 files changed

+219
-4
lines changed

‎mysql-test/main/cte_nonrecursive.result

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1691,3 +1691,113 @@ DROP TABLE test.t;
16911691
connection default;
16921692
disconnect con1;
16931693
# End of 10.2 tests
1694+
#
1695+
# MDEV-21673: several references to CTE that uses
1696+
# local variables / parameters of SP
1697+
#
1698+
CREATE TABLE t1 (col1 int);
1699+
CREATE TABLE t2 (col1 int, col2 date, col3 varchar(16), col4 int);
1700+
CREATE TABLE t3 (col1 int, col2 date);
1701+
CREATE TABLE t4 (col1 int, col2 date);
1702+
INSERT INTO t1 VALUES (3), (7), (9), (1);
1703+
INSERT INTO t2 VALUES
1704+
(3,'2019-09-01','AAA',2), (7,'2019-10-01','AAA',4), (3,'2019-10-01','AAA',8),
1705+
(1,'2019-10-01','BBB',9), (1,'2019-10-01','AAA',4), (1,'2019-10-01','AAA',6);
1706+
INSERT INTO t3 VALUES
1707+
(4,'2018-10-01'), (6,'2018-10-01'), (4,'2017-10-01'), (7,'2017-10-01');
1708+
INSERT INTO t4 VALUES
1709+
(5,'2018-10-01'), (8,'2017-10-01'), (4,'2017-10-01');
1710+
CREATE OR REPLACE PROCEDURE SP1()
1711+
BEGIN
1712+
DECLARE p_date date;
1713+
DECLARE p_var2 varchar(16);
1714+
SET p_date='2019-10-01';
1715+
SET p_var2='AAA';
1716+
WITH cte_first(col) AS
1717+
(
1718+
SELECT DISTINCT col4
1719+
FROM t1, t2
1720+
WHERE t2.col1 = t1.col1 AND t2.col2 = p_date AND t2.col3 = p_var2
1721+
),
1722+
cte2 AS
1723+
(
1724+
SELECT DISTINCT col2
1725+
FROM t3
1726+
WHERE col1 IN ( SELECT col FROM cte_first )
1727+
),
1728+
cte3 AS (
1729+
SELECT distinct t4.col1
1730+
FROM cte2, t4
1731+
WHERE t4.col2 = cte2.col2 AND t4.col1 IN ( SELECT col FROM cte_first )
1732+
)
1733+
SELECT * FROM cte3;
1734+
END|
1735+
CREATE PROCEDURE SP2(IN d date)
1736+
BEGIN
1737+
DECLARE p_var2 varchar(16);
1738+
SET p_var2='AAA';
1739+
WITH cte_first(col) AS
1740+
(
1741+
SELECT DISTINCT col4
1742+
FROM t1, t2
1743+
WHERE t2.col1 = t1.col1 AND t2.col2 = d AND t2.col3 = p_var2
1744+
),
1745+
cte2 AS
1746+
(
1747+
SELECT DISTINCT col2
1748+
FROM t3
1749+
WHERE col1 IN ( SELECT col FROM cte_first )
1750+
),
1751+
cte3 AS (
1752+
SELECT distinct t4.col1
1753+
FROM cte2, t4
1754+
WHERE t4.col2 = cte2.col2 AND t4.col1 IN ( SELECT col FROM cte_first )
1755+
)
1756+
SELECT * FROM cte3;
1757+
END|
1758+
CREATE TABLE t AS
1759+
SELECT col4 AS col
1760+
FROM t1, t2
1761+
WHERE t2.col1 = t1.col1 AND t2.col2 ='2019-10-01' AND t2.col3 = 'AAA';
1762+
SELECT * FROM t;
1763+
col
1764+
4
1765+
8
1766+
4
1767+
6
1768+
CREATE TABLE tt AS
1769+
SELECT col2
1770+
FROM t3
1771+
WHERE col1 IN ( SELECT col FROM t );
1772+
SELECT * FROM tt;
1773+
col2
1774+
2018-10-01
1775+
2018-10-01
1776+
2017-10-01
1777+
SELECT t4.col1
1778+
FROM tt, t4
1779+
WHERE t4.col2 = tt.col2 AND t4.col1 IN ( SELECT col FROM t );
1780+
col1
1781+
8
1782+
4
1783+
DROP TABLE t,tt;
1784+
CALL SP1();
1785+
col1
1786+
8
1787+
4
1788+
CALL SP1();
1789+
col1
1790+
8
1791+
4
1792+
CALL SP2('2019-10-01');
1793+
col1
1794+
8
1795+
4
1796+
CALL SP2('2019-10-01');
1797+
col1
1798+
8
1799+
4
1800+
DROP PROCEDURE SP1;
1801+
DROP PROCEDURE SP2;
1802+
DROP TABLE t1,t2,t3,t4;
1803+
# End of 10.3 tests

‎mysql-test/main/cte_nonrecursive.test

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1202,3 +1202,106 @@ DROP TABLE test.t;
12021202
--disconnect con1
12031203

12041204
--echo # End of 10.2 tests
1205+
1206+
--echo #
1207+
--echo # MDEV-21673: several references to CTE that uses
1208+
--echo # local variables / parameters of SP
1209+
--echo #
1210+
1211+
CREATE TABLE t1 (col1 int);
1212+
CREATE TABLE t2 (col1 int, col2 date, col3 varchar(16), col4 int);
1213+
CREATE TABLE t3 (col1 int, col2 date);
1214+
CREATE TABLE t4 (col1 int, col2 date);
1215+
INSERT INTO t1 VALUES (3), (7), (9), (1);
1216+
INSERT INTO t2 VALUES
1217+
(3,'2019-09-01','AAA',2), (7,'2019-10-01','AAA',4), (3,'2019-10-01','AAA',8),
1218+
(1,'2019-10-01','BBB',9), (1,'2019-10-01','AAA',4), (1,'2019-10-01','AAA',6);
1219+
INSERT INTO t3 VALUES
1220+
(4,'2018-10-01'), (6,'2018-10-01'), (4,'2017-10-01'), (7,'2017-10-01');
1221+
INSERT INTO t4 VALUES
1222+
(5,'2018-10-01'), (8,'2017-10-01'), (4,'2017-10-01');
1223+
1224+
DELIMITER |;
1225+
1226+
CREATE OR REPLACE PROCEDURE SP1()
1227+
BEGIN
1228+
DECLARE p_date date;
1229+
DECLARE p_var2 varchar(16);
1230+
SET p_date='2019-10-01';
1231+
SET p_var2='AAA';
1232+
WITH cte_first(col) AS
1233+
(
1234+
SELECT DISTINCT col4
1235+
FROM t1, t2
1236+
WHERE t2.col1 = t1.col1 AND t2.col2 = p_date AND t2.col3 = p_var2
1237+
),
1238+
cte2 AS
1239+
(
1240+
SELECT DISTINCT col2
1241+
FROM t3
1242+
WHERE col1 IN ( SELECT col FROM cte_first )
1243+
),
1244+
cte3 AS (
1245+
SELECT distinct t4.col1
1246+
FROM cte2, t4
1247+
WHERE t4.col2 = cte2.col2 AND t4.col1 IN ( SELECT col FROM cte_first )
1248+
)
1249+
SELECT * FROM cte3;
1250+
END|
1251+
1252+
CREATE PROCEDURE SP2(IN d date)
1253+
BEGIN
1254+
DECLARE p_var2 varchar(16);
1255+
SET p_var2='AAA';
1256+
WITH cte_first(col) AS
1257+
(
1258+
SELECT DISTINCT col4
1259+
FROM t1, t2
1260+
WHERE t2.col1 = t1.col1 AND t2.col2 = d AND t2.col3 = p_var2
1261+
),
1262+
cte2 AS
1263+
(
1264+
SELECT DISTINCT col2
1265+
FROM t3
1266+
WHERE col1 IN ( SELECT col FROM cte_first )
1267+
),
1268+
cte3 AS (
1269+
SELECT distinct t4.col1
1270+
FROM cte2, t4
1271+
WHERE t4.col2 = cte2.col2 AND t4.col1 IN ( SELECT col FROM cte_first )
1272+
)
1273+
SELECT * FROM cte3;
1274+
END|
1275+
1276+
DELIMITER ;|
1277+
1278+
1279+
CREATE TABLE t AS
1280+
SELECT col4 AS col
1281+
FROM t1, t2
1282+
WHERE t2.col1 = t1.col1 AND t2.col2 ='2019-10-01' AND t2.col3 = 'AAA';
1283+
SELECT * FROM t;
1284+
1285+
CREATE TABLE tt AS
1286+
SELECT col2
1287+
FROM t3
1288+
WHERE col1 IN ( SELECT col FROM t );
1289+
SELECT * FROM tt;
1290+
1291+
SELECT t4.col1
1292+
FROM tt, t4
1293+
WHERE t4.col2 = tt.col2 AND t4.col1 IN ( SELECT col FROM t );
1294+
1295+
DROP TABLE t,tt;
1296+
1297+
CALL SP1();
1298+
CALL SP1();
1299+
1300+
CALL SP2('2019-10-01');
1301+
CALL SP2('2019-10-01');
1302+
1303+
DROP PROCEDURE SP1;
1304+
DROP PROCEDURE SP2;
1305+
DROP TABLE t1,t2,t3,t4;
1306+
1307+
--echo # End of 10.3 tests

‎sql/sql_lex.cc

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7066,7 +7066,8 @@ Item *LEX::create_item_limit(THD *thd, const Lex_ident_cli_st *ca)
70667066
if (unlikely(!(item= new (thd->mem_root)
70677067
Item_splocal(thd, rh, &sa,
70687068
spv->offset, spv->type_handler(),
7069-
pos.pos(), pos.length()))))
7069+
clone_spec_offset ? 0 : pos.pos(),
7070+
clone_spec_offset ? 0 : pos.length()))))
70707071
return NULL;
70717072
#ifdef DBUG_ASSERT_EXISTS
70727073
item->m_sp= sphead;
@@ -7165,14 +7166,15 @@ Item *LEX::create_item_ident_sp(THD *thd, Lex_ident_sys_st *name,
71657166
}
71667167

71677168
Query_fragment pos(thd, sphead, start, end);
7169+
uint f_pos= clone_spec_offset ? 0 : pos.pos();
7170+
uint f_length= clone_spec_offset ? 0 : pos.length();
71687171
Item_splocal *splocal= spv->field_def.is_column_type_ref() ?
71697172
new (thd->mem_root) Item_splocal_with_delayed_data_type(thd, rh, name,
71707173
spv->offset,
7171-
pos.pos(),
7172-
pos.length()) :
7174+
f_pos, f_length) :
71737175
new (thd->mem_root) Item_splocal(thd, rh, name,
71747176
spv->offset, spv->type_handler(),
7175-
pos.pos(), pos.length());
7177+
f_pos, f_length);
71767178
if (unlikely(splocal == NULL))
71777179
return NULL;
71787180
#ifdef DBUG_ASSERT_EXISTS

0 commit comments

Comments
 (0)