MDEV-9304: MariaDB crash with specific query

tmp_join may get its tables freed twice during JOIN cleanup. Set them to NULL when the tmp_join is different than the current join.
MariaDB · Aug 8, 2016 · a7c43a6 · a7c43a6
1 parent 5269d37
commit a7c43a6
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/sql/sql_union.cc b/sql/sql_union.cc
@@ -887,6 +887,12 @@ bool st_select_lex_unit::cleanup()
       join->tables_list= 0;
       join->table_count= 0;
       join->top_join_tab_count= 0;
+      if (join->tmp_join && join->tmp_join != join)
+      {
+        join->tmp_join->tables_list= 0;
+        join->tmp_join->table_count= 0;
+        join->tmp_join->top_join_tab_count= 0;
+      }
     }
     error|= fake_select_lex->cleanup();
     /*