Skip to content

Commit d5cb996

Browse files
MDEV-35975 Server crashes after CREATE VIEW as SELECT ST_COLLECT...
Ensure that orig_args is populated during Item_func_collect::fix_fields_impl
1 parent b93e8c1 commit d5cb996

File tree

3 files changed

+18
-2
lines changed

3 files changed

+18
-2
lines changed

mysql-test/main/spatial_utility_function_collect.result

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,3 +135,10 @@ tb1 CREATE TABLE `tb1` (
135135
`(ST_collect(( POINTFROMTEXT(' POINT( 4 1 ) ') )) )` geometry DEFAULT NULL
136136
) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
137137
DROP TABLE tb1;
138+
#
139+
# MDEV-35975 Server crashes after CREATE VIEW as SELECT ST_COLLECT
140+
#
141+
create view v1 as SELECT ST_COLLECT(ST_GEOMFROMTEXT('POINT(0 0)'));
142+
drop view v1;
143+
create view v1 as SELECT GROUP_CONCAT(ST_GEOMFROMTEXT('POINT(0 0)'));
144+
drop view v1;

mysql-test/main/spatial_utility_function_collect.test

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,3 +197,11 @@ SELECT ST_astext(ST_collect(( POINTFROMTEXT(' POINT( 4 1 ) ') )));
197197
CREATE TABLE tb1 AS SELECT (ST_collect(( POINTFROMTEXT(' POINT( 4 1 ) ') )) );
198198
SHOW CREATE TABLE tb1;
199199
DROP TABLE tb1;
200+
201+
--echo #
202+
--echo # MDEV-35975 Server crashes after CREATE VIEW as SELECT ST_COLLECT
203+
--echo #
204+
create view v1 as SELECT ST_COLLECT(ST_GEOMFROMTEXT('POINT(0 0)'));
205+
drop view v1;
206+
create view v1 as SELECT GROUP_CONCAT(ST_GEOMFROMTEXT('POINT(0 0)'));
207+
drop view v1;

sql/item_sum.cc

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3553,6 +3553,9 @@ Item_sum_str::fix_fields(THD *thd, Item **ref)
35533553
if (check_sum_func(thd, ref))
35543554
return TRUE;
35553555

3556+
if (arg_count)
3557+
memcpy (orig_args, args, sizeof (Item *) * arg_count);
3558+
35563559
base_flags|= item_base_t::FIXED;
35573560
return FALSE;
35583561
}
@@ -3988,8 +3991,6 @@ Item_func_group_concat(THD *thd, Name_resolution_context *context_arg,
39883991

39893992
/* orig_args is only used for print() */
39903993
orig_args= (Item**) (order + arg_count_order);
3991-
if (arg_count)
3992-
memcpy(orig_args, args, sizeof(Item*) * arg_count);
39933994
if (limit_clause)
39943995
{
39953996
row_limit= row_limit_arg;

0 commit comments

Comments
 (0)