Fix for CONC334:

Copy all members of MYSQL_FIELD from mysql->fields to stmt->fields.
mariadb-corporation · May 29, 2018 · e245f2d · e245f2d
1 parent 589760a
commit e245f2d
Show file tree

Hide file tree

Showing 2 changed files with 45 additions and 2 deletions.
diff --git a/libmariadb/my_stmt.c b/libmariadb/my_stmt.c
@@ -1544,6 +1544,12 @@ int STDCALL mysql_stmt_execute(MYSQL_STMT *stmt)
 
       for (i=0; i < stmt->field_count; i++)
       {
+        memcpy(&stmt->fields[i], &mysql->fields[i], sizeof(MYSQL_FIELD));
+
+        /* since  all pointers will be incorrect if another statement will
+           be executed, so we need to allocate memory and copy the
+           information */
+        stmt->fields[i].extension= 0; /* not in use yet */
         if (mysql->fields[i].db)
           stmt->fields[i].db= strdup_root(fields_alloc_root, mysql->fields[i].db);
         if (mysql->fields[i].table)
@@ -1555,8 +1561,9 @@ int STDCALL mysql_stmt_execute(MYSQL_STMT *stmt)
         if (mysql->fields[i].org_name)
           stmt->fields[i].org_name= strdup_root(fields_alloc_root, mysql->fields[i].org_name);
         if (mysql->fields[i].catalog)
-          stmt->fields[i].catalog= strdup_root(fields_alloc_root, mysql->fields[i].catalog);
-        stmt->fields[i].def= mysql->fields[i].def ? strdup_root(fields_alloc_root, mysql->fields[i].def) : NULL;
+          stmt->fields[i].catalog= ma_strdup_root(fields_ma_alloc_root, mysql->fields[i].catalog);
+        if (mysql->fields[i].def)
+          stmt->fields[i].def= ma_strdup_root(fields_ma_alloc_root, mysql->fields[i].def);
       }
     }
 

diff --git a/unittest/libmariadb/ps_bugs.c b/unittest/libmariadb/ps_bugs.c
@@ -4561,7 +4561,43 @@ static int test_codbc138(MYSQL *mysql)
   return OK;
 }
 
+static int test_conc334(MYSQL *mysql)
+{
+  MYSQL_STMT *stmt= mysql_stmt_init(mysql);
+  MYSQL_RES *result;
+  MYSQL_FIELD *field;
+  int rc;
+
+  rc= mysql_stmt_prepare(stmt, SL("SHOW ENGINES"));
+  check_stmt_rc(rc, stmt);
+
+  rc= mysql_stmt_execute(stmt);
+  check_stmt_rc(rc, stmt);
+
+  result= mysql_stmt_result_metadata(stmt);
+  if (!result)
+  {
+    diag("Coudn't retrieve result set");
+    mysql_stmt_close(stmt);
+    return FAIL;
+  }
+
+  mysql_field_seek(result, 0);
+
+  while ((field= mysql_fetch_field(result)))
+  {
+    FAIL_IF(field->name_length == 0, "Invalid name length (0)");
+    FAIL_IF(field->table_length == 0, "Invalid name length (0)");
+  }
+  mysql_free_result(result);
+  mysql_stmt_close(stmt);
+
+  return OK;
+}
+
+
 struct my_tests_st my_tests[] = {
+  {"test_conc334", test_conc334, TEST_CONNECTION_NEW, 0, NULL, NULL},
   {"test_codbc138", test_codbc138, TEST_CONNECTION_DEFAULT, 0, NULL, NULL},
   {"test_conc205", test_conc205, TEST_CONNECTION_DEFAULT, 0, NULL, NULL},
   {"test_conc198", test_conc198, TEST_CONNECTION_DEFAULT, 0, NULL, NULL},