Skip to content
/ server Public

Commit 71d4cae

Browse files
committed
MDEV-37503 UBSAN: downcast Item_func_plus to Item_field invalid in sql_prepare.cc:1516
use reinterpret_cast to silence UBSAN. add a debug check to make sure the wrong value is never used.
1 parent 7e14749 commit 71d4cae

File tree

1 file changed

+12
-1
lines changed

1 file changed

+12
-1
lines changed

sql/sql_prepare.cc

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1511,7 +1511,18 @@ static int mysql_test_update(Prepared_statement *stmt,
15111511
{
15121512
List_iterator_fast<Item> fs(select->item_list), vs(stmt->lex->value_list);
15131513
while (Item *f= fs++)
1514-
vs++->associate_with_target_field(thd, static_cast<Item_field*>(f));
1514+
{
1515+
/*
1516+
note that if `f` is a non-updatable view field, it may be not
1517+
inherited from Item_field, and the cast below will essentially
1518+
produce garbage. But ER_NONUPDATEABLE_COLUMN will happen before it's
1519+
ever dereferenced.
1520+
*/
1521+
#ifndef DBUG_OFF
1522+
if (!dynamic_cast<Item_field*>(f)) f= (Item_field*)0x01; // let it crash
1523+
#endif
1524+
vs++->associate_with_target_field(thd, reinterpret_cast<Item_field*>(f));
1525+
}
15151526
}
15161527
/* TODO: here we should send types of placeholders to the client. */
15171528
DBUG_RETURN(0);

0 commit comments

Comments
 (0)