MDEV-25242 Server crashes in check_grant upon invoking function with …

…userstat enabled use check_grant(..., number_of_tables=1, ...) if you only need to check privileges for one table
MariaDB · Mar 24, 2021 · 5a79807 · 5a79807
1 parent cdb86fa
commit 5a79807
Show file tree

Hide file tree

Showing 3 changed files with 27 additions and 8 deletions.
diff --git a/mysql-test/r/userstat.result b/mysql-test/r/userstat.result
@@ -1,4 +1,3 @@
-DROP TABLE IF EXISTS t1;
 select variable_value from information_schema.global_status where variable_name="handler_read_key" into @global_read_key;
 show columns from information_schema.client_statistics;
 Field	Type	Null	Key	Default	Extra
@@ -234,3 +233,15 @@ select @@in_transaction;
 0
 drop table t1;
 set @@global.general_log=@save_general_log;
+#
+# MDEV-25242 Server crashes in check_grant upon invoking function with userstat enabled
+#
+create function f() returns int return (select 1 from performance_schema.threads);
+set global userstat= 1;
+select f() from information_schema.table_statistics;
+ERROR 21000: Subquery returns more than 1 row
+set global userstat= 0;
+drop function f;
+#
+# End of 10.2 tests
+#
diff --git a/mysql-test/t/userstat.test b/mysql-test/t/userstat.test
@@ -6,10 +6,6 @@
 -- source include/have_innodb.inc
 -- source include/have_log_bin.inc
 
---disable_warnings
-DROP TABLE IF EXISTS t1;
---enable_warnings
-
 select variable_value from information_schema.global_status where variable_name="handler_read_key" into @global_read_key;
 show columns from information_schema.client_statistics;
 show columns from information_schema.user_statistics;
@@ -115,5 +111,18 @@ set @@autocommit=1;
 select @@in_transaction;
 drop table t1;
 
-# Cleanup
 set @@global.general_log=@save_general_log;
+
+--echo #
+--echo # MDEV-25242 Server crashes in check_grant upon invoking function with userstat enabled
+--echo #
+create function f() returns int return (select 1 from performance_schema.threads);
+set global userstat= 1;
+--error ER_SUBQUERY_NO_1_ROW
+select f() from information_schema.table_statistics;
+set global userstat= 0;
+drop function f;
+
+--echo #
+--echo # End of 10.2 tests
+--echo #
diff --git a/plugin/userstat/table_stats.cc b/plugin/userstat/table_stats.cc
@@ -31,8 +31,7 @@ static int table_stats_fill(THD *thd, TABLE_LIST *tables, COND *cond)
     tmp_table.grant.privilege= 0;
     if (check_access(thd, SELECT_ACL, tmp_table.db,
                      &tmp_table.grant.privilege, NULL, 0, 1) ||
-        check_grant(thd, SELECT_ACL, &tmp_table, 1, UINT_MAX,
-                    1))
+        check_grant(thd, SELECT_ACL, &tmp_table, 1, 1, 1))
       continue;
 
     table->field[0]->store(table_stats->table, schema_length,