Skip to content

Commit a2bb9d2

Browse files
committed
MDEV-7505 - Too large scale in DECIMAL dynamic column getter crashes mysqld
Server may crash if sanity checks of COLUMN_GET() fail. COLUMN_GET() description generator expects parent CAST item, which may not have been created due to failure of sanity checks. Then further attempt to report an error may crash the server. Fixed COLUMN_GET() description generator to handle such case.
1 parent b611ac0 commit a2bb9d2

File tree

3 files changed

+22
-0
lines changed

3 files changed

+22
-0
lines changed

mysql-test/r/dyncol.result

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1444,3 +1444,9 @@ column_get(column_create(1, "18446744073709552001" as char), 1 as int)
14441444
Warnings:
14451445
Warning 1918 Encountered illegal value '18446744073709552001' when converting to INT
14461446
Note 1105 Cast to signed converted positive out-of-range integer to it's negative complement
1447+
#
1448+
# MDEV-7505 - Too large scale in DECIMAL dynamic column getter crashes
1449+
# mysqld
1450+
#
1451+
SELECT COLUMN_GET(`x`, 'y' AS DECIMAL(5,34));
1452+
ERROR 42000: Too big scale 34 specified for ''y''. Maximum is 30.

mysql-test/t/dyncol.test

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -643,3 +643,9 @@ SELECT
643643
#
644644
select column_get(column_create(1, "18446744073709552001" as char), 1 as int);
645645

646+
--echo #
647+
--echo # MDEV-7505 - Too large scale in DECIMAL dynamic column getter crashes
648+
--echo # mysqld
649+
--echo #
650+
--error ER_TOO_BIG_SCALE
651+
SELECT COLUMN_GET(`x`, 'y' AS DECIMAL(5,34));

sql/item_strfunc.cc

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4467,6 +4467,16 @@ bool Item_dyncol_get::get_date(MYSQL_TIME *ltime, ulonglong fuzzy_date)
44674467

44684468
void Item_dyncol_get::print(String *str, enum_query_type query_type)
44694469
{
4470+
/*
4471+
Parent cast doesn't exist yet, only print dynamic column name. This happens
4472+
when called from create_func_cast() / wrong_precision_error().
4473+
*/
4474+
if (!str->length())
4475+
{
4476+
args[1]->print(str, query_type);
4477+
return;
4478+
}
4479+
44704480
/* see create_func_dyncol_get */
44714481
DBUG_ASSERT(str->length() >= 5);
44724482
DBUG_ASSERT(strncmp(str->ptr() + str->length() - 5, "cast(", 5) == 0);

0 commit comments

Comments
 (0)