Skip to content

Commit e7aaf29

Browse files
raghunandanbhatraghunandanbhat
committed
MDEV-24588: Fix crash with unnamed column in derived table
MariaDB server crashes when a query includes a derived table containing unnamed column (eg: `SELECT '' from t`). When `Item` object representing such unnamed column was checked for valid, non-empty name in `TABLE_LIST::create_field_translation`, the server crahsed(assertion `item->name.str && item->name.str[0]` failed). This fix removes the redundant assertion. The assert was a strict debug guard that's no longer needed because the code safely handles empty strings without it. Selecting `''` from a derived table caused `item->name.str` to be an empty string. While the pointer itself wasn't `NULL` (`item->name.str` is `true`), its first character (`item->name.str[0]`) was null terminator, which evaluates to `false` and eventually made the assert fail. The code immediately after the assert can safely handle empty strings and the assert was guarding against something which the code can already handle. Includes `mysql-test/main/derived.test` to verify the fix.
1 parent 5ff01ad commit e7aaf29

File tree

3 files changed

+254
-1
lines changed

3 files changed

+254
-1
lines changed

‎mysql-test/main/derived.result‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1356,3 +1356,149 @@ drop table t1,t2,t3;
13561356
#
13571357
# End of 10.3 tests
13581358
#
1359+
#
1360+
# MDEV-24588: Fix crash with unnamed column in derived table.
1361+
# Assertion `item->name.str && item->name.str[0]` in
1362+
# `TABLE_LIST::create_field_translation` fails when a SELECT
1363+
# query includes a derived table containing unnamed column
1364+
# (eg: `SELECT '' from t`).
1365+
#
1366+
# Tests from the bug report
1367+
CREATE TABLE t (pk INT PRIMARY KEY);
1368+
INSERT INTO t VALUES (1), (2), (3);
1369+
SELECT SHA(pk) IN (SELECT * FROM (SELECT '' FROM t) AS a) FROM t;
1370+
SHA(pk) IN (SELECT * FROM (SELECT '' FROM t) AS a)
1371+
0
1372+
0
1373+
0
1374+
SET sql_mode='';
1375+
PREPARE p FROM 'SELECT SHA(pk) IN (SELECT * FROM (SELECT \'\' FROM t) AS a) FROM t;';
1376+
EXECUTE p;
1377+
SHA(pk) IN (SELECT * FROM (SELECT '' FROM t) AS a)
1378+
0
1379+
0
1380+
0
1381+
EXECUTE p;
1382+
SHA(pk) IN (SELECT * FROM (SELECT '' FROM t) AS a)
1383+
0
1384+
0
1385+
0
1386+
DEALLOCATE PREPARE p;
1387+
# Tests on derived tables
1388+
SELECT * FROM (SELECT 1, '' FROM t) AS a;
1389+
1
1390+
1
1391+
1
1392+
1
1393+
SELECT * FROM (SELECT '', 1 FROM t) AS a;
1394+
1
1395+
1
1396+
1
1397+
1
1398+
SELECT * FROM (SELECT 1, 2, '' FROM t) AS a;
1399+
1 2
1400+
1 2
1401+
1 2
1402+
1 2
1403+
SELECT * FROM (SELECT pk, '' FROM t) AS a;
1404+
pk
1405+
1
1406+
2
1407+
3
1408+
SELECT '/', '/';
1409+
/ /
1410+
/ /
1411+
SELECT * FROM (SELECT pk, '', '' as c1 FROM t) AS a;
1412+
pk c1
1413+
1
1414+
2
1415+
3
1416+
SELECT * FROM (SELECT '', '' from t) AS a;
1417+
ERROR 42S21: Duplicate column name ''
1418+
SELECT * FROM (SELECT '/', '/' FROM t) AS a;
1419+
ERROR 42S21: Duplicate column name '/'
1420+
SELECT * FROM (SELECT '/', '/') AS a;
1421+
ERROR 42S21: Duplicate column name '/'
1422+
DROP TABLE t;
1423+
# Tests on views
1424+
CREATE TABLE t (pk INT PRIMARY KEY);
1425+
INSERT INTO t VALUES (1), (2), (3);
1426+
CREATE VIEW v_t AS SELECT * FROM t;
1427+
SHOW CREATE VIEW v_t;
1428+
View Create View character_set_client collation_connection
1429+
v_t CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`localhost` SQL SECURITY DEFINER VIEW `v_t` AS select `t`.`pk` AS `pk` from `t` latin1 latin1_swedish_ci
1430+
SELECT SHA(pk) IN (SELECT * FROM (SELECT '' FROM v_t) AS a) FROM v_t;
1431+
SHA(pk) IN (SELECT * FROM (SELECT '' FROM v_t) AS a)
1432+
0
1433+
0
1434+
0
1435+
SELECT * FROM (SELECT pk, '', '' as c1 FROM v_t) AS a;
1436+
pk c1
1437+
1
1438+
2
1439+
3
1440+
SELECT * FROM (SELECT '', '' from v_t) AS a;
1441+
ERROR 42S21: Duplicate column name ''
1442+
SELECT * FROM (SELECT '/', '/' from v_t) AS a;
1443+
ERROR 42S21: Duplicate column name '/'
1444+
CREATE VIEW v1 AS SELECT '/', '/';
1445+
SHOW CREATE VIEW v1;
1446+
View Create View character_set_client collation_connection
1447+
v1 CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`localhost` SQL SECURITY DEFINER VIEW `v1` AS select '/' AS `/`,'/' AS `My_exp_/` latin1 latin1_swedish_ci
1448+
DROP VIEW v_t, v1;
1449+
DROP TABLE t;
1450+
# Tests on views created using SELECT statements that contain derived columns
1451+
CREATE TABLE t (pk INT PRIMARY KEY);
1452+
INSERT INTO t VALUES (1), (2), (3);
1453+
CREATE VIEW v1_t AS SELECT '' FROM t;
1454+
SHOW CREATE VIEW v1_t;
1455+
View Create View character_set_client collation_connection
1456+
v1_t CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`localhost` SQL SECURITY DEFINER VIEW `v1_t` AS select '' AS `Name_exp_1` from `t` latin1 latin1_swedish_ci
1457+
SELECT * FROM v1_t;
1458+
Name_exp_1
1459+
1460+
1461+
1462+
CREATE VIEW v2_t AS SELECT * FROM (SELECT '' FROM t) AS a;
1463+
SHOW CREATE VIEW v2_t;
1464+
View Create View character_set_client collation_connection
1465+
v2_t CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`localhost` SQL SECURITY DEFINER VIEW `v2_t` AS select `tmp_field` AS `Name_exp_1` from (select '' from `t`) `a` latin1 latin1_swedish_ci
1466+
Warnings:
1467+
Warning 1356 View 'test.v2_t' references invalid table(s) or column(s) or function(s) or definer/invoker of view lack rights to use them
1468+
SELECT * FROM v2_t;
1469+
ERROR HY000: View 'test.v2_t' references invalid table(s) or column(s) or function(s) or definer/invoker of view lack rights to use them
1470+
CREATE VIEW v3_t AS SELECT * FROM (SELECT '' as c1 FROM t) AS a;
1471+
SHOW CREATE VIEW v3_t;
1472+
View Create View character_set_client collation_connection
1473+
v3_t CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`localhost` SQL SECURITY DEFINER VIEW `v3_t` AS select `a`.`c1` AS `c1` from (select '' AS `c1` from `t`) `a` latin1 latin1_swedish_ci
1474+
SELECT * FROM v3_t;
1475+
c1
1476+
1477+
1478+
1479+
CREATE VIEW v4_t AS SELECT * FROM (SELECT 1, '' FROM t) AS a;
1480+
SHOW CREATE VIEW v4_t;
1481+
View Create View character_set_client collation_connection
1482+
v4_t CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`localhost` SQL SECURITY DEFINER VIEW `v4_t` AS select `a`.`1` AS `1`,`tmp_field` AS `Name_exp_2` from (select 1 AS `1`,'' from `t`) `a` latin1 latin1_swedish_ci
1483+
Warnings:
1484+
Warning 1356 View 'test.v4_t' references invalid table(s) or column(s) or function(s) or definer/invoker of view lack rights to use them
1485+
SELECT * from v4_t;
1486+
ERROR HY000: View 'test.v4_t' references invalid table(s) or column(s) or function(s) or definer/invoker of view lack rights to use them
1487+
CREATE VIEW v5_t AS SELECT '';
1488+
SHOW CREATE VIEW v5_t;
1489+
View Create View character_set_client collation_connection
1490+
v5_t CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`localhost` SQL SECURITY DEFINER VIEW `v5_t` AS select '' AS `Name_exp_1` latin1 latin1_swedish_ci
1491+
SELECT * FROM v5_t;
1492+
Name_exp_1
1493+
1494+
CREATE VIEW v6_t AS SELECT * FROM (SELECT '') AS a;
1495+
SHOW CREATE VIEW v6_t;
1496+
View Create View character_set_client collation_connection
1497+
v6_t CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`localhost` SQL SECURITY DEFINER VIEW `v6_t` AS select `tmp_field` AS `Name_exp_1` from (select '') `a` latin1 latin1_swedish_ci
1498+
Warnings:
1499+
Warning 1356 View 'test.v6_t' references invalid table(s) or column(s) or function(s) or definer/invoker of view lack rights to use them
1500+
SELECT * FROM v6_t;
1501+
ERROR HY000: View 'test.v6_t' references invalid table(s) or column(s) or function(s) or definer/invoker of view lack rights to use them
1502+
DROP VIEW v1_t, v2_t, v3_t, v4_t, v5_t, v6_t;
1503+
DROP TABLE t;
1504+
# End of 10.11 tests

‎mysql-test/main/derived.test‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1183,3 +1183,111 @@ drop table t1,t2,t3;
11831183
--echo #
11841184
--echo # End of 10.3 tests
11851185
--echo #
1186+
1187+
--echo #
1188+
--echo # MDEV-24588: Fix crash with unnamed column in derived table.
1189+
--echo # Assertion `item->name.str && item->name.str[0]` in
1190+
--echo # `TABLE_LIST::create_field_translation` fails when a SELECT
1191+
--echo # query includes a derived table containing unnamed column
1192+
--echo # (eg: `SELECT '' from t`).
1193+
--echo #
1194+
1195+
--echo # Tests from the bug report
1196+
1197+
CREATE TABLE t (pk INT PRIMARY KEY);
1198+
INSERT INTO t VALUES (1), (2), (3);
1199+
1200+
# this should pass withiout assertion fail in dbg or should not crash mariadb server
1201+
SELECT SHA(pk) IN (SELECT * FROM (SELECT '' FROM t) AS a) FROM t;
1202+
1203+
# The PREPARE command itself should succeed without crashing
1204+
SET sql_mode='';
1205+
PREPARE p FROM 'SELECT SHA(pk) IN (SELECT * FROM (SELECT \'\' FROM t) AS a) FROM t;';
1206+
1207+
EXECUTE p;
1208+
EXECUTE p;
1209+
1210+
DEALLOCATE PREPARE p;
1211+
1212+
--echo # Tests on derived tables
1213+
1214+
SELECT * FROM (SELECT 1, '' FROM t) AS a;
1215+
SELECT * FROM (SELECT '', 1 FROM t) AS a;
1216+
SELECT * FROM (SELECT 1, 2, '' FROM t) AS a;
1217+
SELECT * FROM (SELECT pk, '' FROM t) AS a;
1218+
SELECT '/', '/';
1219+
1220+
SELECT * FROM (SELECT pk, '', '' as c1 FROM t) AS a;
1221+
--error ER_DUP_FIELDNAME
1222+
SELECT * FROM (SELECT '', '' from t) AS a;
1223+
--error ER_DUP_FIELDNAME
1224+
SELECT * FROM (SELECT '/', '/' FROM t) AS a;
1225+
--error ER_DUP_FIELDNAME
1226+
SELECT * FROM (SELECT '/', '/') AS a;
1227+
1228+
DROP TABLE t;
1229+
1230+
--echo # Tests on views
1231+
1232+
CREATE TABLE t (pk INT PRIMARY KEY);
1233+
INSERT INTO t VALUES (1), (2), (3);
1234+
1235+
CREATE VIEW v_t AS SELECT * FROM t;
1236+
SHOW CREATE VIEW v_t;
1237+
1238+
SELECT SHA(pk) IN (SELECT * FROM (SELECT '' FROM v_t) AS a) FROM v_t;
1239+
1240+
SELECT * FROM (SELECT pk, '', '' as c1 FROM v_t) AS a;
1241+
--error ER_DUP_FIELDNAME
1242+
SELECT * FROM (SELECT '', '' from v_t) AS a;
1243+
--error ER_DUP_FIELDNAME
1244+
SELECT * FROM (SELECT '/', '/' from v_t) AS a;
1245+
1246+
CREATE VIEW v1 AS SELECT '/', '/';
1247+
SHOW CREATE VIEW v1;
1248+
1249+
DROP VIEW v_t, v1;
1250+
DROP TABLE t;
1251+
1252+
--echo # Tests on views created using SELECT statements that contain derived columns
1253+
1254+
CREATE TABLE t (pk INT PRIMARY KEY);
1255+
INSERT INTO t VALUES (1), (2), (3);
1256+
1257+
CREATE VIEW v1_t AS SELECT '' FROM t;
1258+
SHOW CREATE VIEW v1_t;
1259+
1260+
SELECT * FROM v1_t;
1261+
1262+
CREATE VIEW v2_t AS SELECT * FROM (SELECT '' FROM t) AS a;
1263+
SHOW CREATE VIEW v2_t;
1264+
1265+
--error ER_VIEW_INVALID
1266+
SELECT * FROM v2_t;
1267+
1268+
CREATE VIEW v3_t AS SELECT * FROM (SELECT '' as c1 FROM t) AS a;
1269+
SHOW CREATE VIEW v3_t;
1270+
1271+
SELECT * FROM v3_t;
1272+
1273+
CREATE VIEW v4_t AS SELECT * FROM (SELECT 1, '' FROM t) AS a;
1274+
SHOW CREATE VIEW v4_t;
1275+
1276+
--error ER_VIEW_INVALID
1277+
SELECT * from v4_t;
1278+
1279+
CREATE VIEW v5_t AS SELECT '';
1280+
SHOW CREATE VIEW v5_t;
1281+
1282+
SELECT * FROM v5_t;
1283+
1284+
CREATE VIEW v6_t AS SELECT * FROM (SELECT '') AS a;
1285+
SHOW CREATE VIEW v6_t;
1286+
1287+
--error ER_VIEW_INVALID
1288+
SELECT * FROM v6_t;
1289+
1290+
DROP VIEW v1_t, v2_t, v3_t, v4_t, v5_t, v6_t;
1291+
DROP TABLE t;
1292+
1293+
--echo # End of 10.11 tests

‎sql/table.cc‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6054,7 +6054,6 @@ bool TABLE_LIST::create_field_translation(THD *thd)
60546054

60556055
while ((item= it++))
60566056
{
6057-
DBUG_ASSERT(item->name.str && item->name.str[0]);
60586057
transl[field_count].name.str= thd->strmake(item->name.str, item->name.length);
60596058
transl[field_count].name.length= item->name.length;
60606059
transl[field_count++].item= item;

0 commit comments

Comments
 (0)