Skip to content

Commit d9114f0

Browse files
committed
Merge 11.4 into 11.8
2 parents 3cc9ac0 + 9aa8512 commit d9114f0

File tree

6 files changed

+50
-4
lines changed

6 files changed

+50
-4
lines changed

mysql-test/main/func_json.result

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5290,3 +5290,14 @@ SELECT JSON_OBJECT_FILTER_KEYS (@obj1,@arr1);
52905290
JSON_OBJECT_FILTER_KEYS (@obj1,@arr1)
52915291
NULL
52925292
# End of 11.2 Test
5293+
# Beginning of 11.4 Test
5294+
#
5295+
# MDEV-33149: JSON_ARRAY_INTERSECT function crashes the server when
5296+
# called with empty json arrays, UBSAN runtime error: member access
5297+
# within null pointer of type 'struct String' in
5298+
# Item_func_json_array_intersect::prepare_json_and_create_hash
5299+
#
5300+
SELECT json_array_intersect(@a,@b);
5301+
json_array_intersect(@a,@b)
5302+
NULL
5303+
# End of 11.4 Test

mysql-test/main/func_json.test

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4178,3 +4178,16 @@ SET @obj1='{ "a": 1,"b": 2,"c": 3}';
41784178
SELECT JSON_OBJECT_FILTER_KEYS (@obj1,@arr1);
41794179

41804180
--echo # End of 11.2 Test
4181+
4182+
--echo # Beginning of 11.4 Test
4183+
4184+
--echo #
4185+
--echo # MDEV-33149: JSON_ARRAY_INTERSECT function crashes the server when
4186+
--echo # called with empty json arrays, UBSAN runtime error: member access
4187+
--echo # within null pointer of type 'struct String' in
4188+
--echo # Item_func_json_array_intersect::prepare_json_and_create_hash
4189+
--echo #
4190+
4191+
SELECT json_array_intersect(@a,@b);
4192+
4193+
--echo # End of 11.4 Test

sql/item_jsonfunc.cc

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5409,6 +5409,9 @@ String* Item_func_json_array_intersect::val_str(String *str)
54095409
json_engine_t je2, res_je, je1;
54105410
String *js2= args[1]->val_json(&tmp_js2), *js1= args[0]->val_json(&tmp_js1);
54115411

5412+
if (!js1 || !js2)
5413+
goto null_return;
5414+
54125415
if (parse_for_each_row)
54135416
{
54145417
if (args[0]->null_value)
@@ -5504,7 +5507,9 @@ bool Item_func_json_array_intersect::fix_length_and_dec(THD *thd)
55045507
}
55055508

55065509
js1= args[0]->val_json(&tmp_js1);
5507-
prepare_json_and_create_hash(&je1, js1);
5510+
5511+
if (js1)
5512+
prepare_json_and_create_hash(&je1, js1);
55085513

55095514
end:
55105515
set_maybe_null();

storage/innobase/handler/ha_innodb.cc

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1780,6 +1780,20 @@ trx_t *thd_to_trx(const THD *thd) noexcept
17801780
return static_cast<trx_t*>(thd_get_ha_data(thd, innodb_hton_ptr));
17811781
}
17821782

1783+
/** Detach and free a transaction.
1784+
@param trx transaction
1785+
@return the trx->mysql_thd */
1786+
THD *free_thd_trx(trx_t *trx) noexcept
1787+
{
1788+
THD *const thd= trx->mysql_thd;
1789+
DBUG_ASSERT(current_thd == thd);
1790+
DBUG_ASSERT(thd_to_trx(thd) == trx);
1791+
thd->ha_data[innodb_hton_ptr->slot].ha_ptr= nullptr;
1792+
DBUG_ASSERT(thd_to_trx(thd) == nullptr);
1793+
trx->free();
1794+
return thd;
1795+
}
1796+
17831797
#ifdef WITH_WSREP
17841798
/********************************************************************//**
17851799
Obtain the InnoDB transaction id of a MySQL thread.

storage/innobase/include/ha_prototypes.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,11 @@ extern "C" unsigned long long thd_start_utime(const MYSQL_THD thd);
178178
@return InnoDB transaction */
179179
trx_t *thd_to_trx(const THD *thd) noexcept;
180180

181+
/** Detach and free a transaction.
182+
@param trx transaction
183+
@return the trx->mysql_thd */
184+
THD *free_thd_trx(trx_t *trx) noexcept;
185+
181186
/** Determines the current SQL statement.
182187
Thread unsafe, can only be called from the thread owning the THD.
183188
@param[in] thd MySQL thread handle

storage/innobase/srv/srv0srv.cc

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1474,9 +1474,7 @@ extern struct handlerton *innodb_hton_ptr;
14741474

14751475
static void release_thd(trx_t *trx, void *ctx)
14761476
{
1477-
THD *const thd= trx->mysql_thd;
1478-
trx->free();
1479-
thd_set_ha_data(thd, innodb_hton_ptr, nullptr);
1477+
THD *const thd= free_thd_trx(trx);
14801478
thd_detach_thd(ctx);
14811479
std::unique_lock<std::mutex> lk(purge_thd_mutex);
14821480
purge_thds.push_back(thd);

0 commit comments

Comments
 (0)