• Gleb Shchepa's avatar
    Bug #41363: crash of mysqld on windows with aggregate in case · 335e842d
    Gleb Shchepa authored
    Execution of queries containing the CASE function of
    aggregate function like in "SELECT ... CASE ARGV(...) WHEN ..."
    crashed the server.
    
    
    The CASE function caches pointers to concrete comparison
    functions for an each pair of types of CASE-WHERE clause
    parameters, i.e. for the "CASE INT_RESULT WHERE REAL_RESULT
    THEN ... WHERE DECIMAL_RESULT ... END" function call it
    caches comparisons for INT_RESULT with REAL_RESULT and
    for INT_RESULT with DECIMAL_RESULT. Usually a result
    type is known after a call to the fix_fields function,
    however, the setup_copy_fields function call may
    wrap aggregate items with Item_copy_string that has
    STRING_RESULT result type, so setup_copy_fields may
    change argument result types of the CASE function after
    call to Item_func_case::fix_fields/fix_length_and_dec.
    Then the Item_func_case::find_item function tries to
    use comparison function for unexpected pair of the
    STRING_RESULT and some other type - that caused
    an assertion failure of server crash.
    
    The Item_func_case::fix_length_and_dec function has
    been modified to take into account possible STRING_RESULT
    result type in the presence of aggregate arguments of
    the CASE function.
    
    
    mysql-test/r/func_in.result:
      Added test case for bug #41363.
    mysql-test/t/func_in.test:
      Added test case for bug #41363.
    sql/item_cmpfunc.cc:
      Bug #41363: crash of mysqld on windows with aggregate in case
      
      The Item_func_case::fix_length_and_dec function has
      been modified to take into account possible STRING_RESULT
      result type in the presence of aggregate arguments of
      the CASE function.
    335e842d
item_cmpfunc.cc 133 KB