• kroki/tomash@moonlight.intranet's avatar
    BUG#21856: Prepared Statements: crash if bad create · 00b2fc6a
    kroki/tomash@moonlight.intranet authored
    When statement to be prepared contained CREATE PROCEDURE, CREATE FUNCTION
    or CREATE TRIGGER statements with a syntax error in it, the preparation
    would fail with syntax error message, but the memory could be corrupted.
    
    The problem occurred because we switch memroot when parse stored
    routine or trigger definitions, and on parse error we restored the
    original memroot only after performing some memory operations.  In more
    detail:
     - prepared statement would activate its own memory root to parse
       the definition of the stored procedure.
     - SP would reset this memory root with its own memory root to
       parse SP statements
     - a syntax error would happen
     - prepared statement would restore the original memory root
     - stored procedure would restore what it thinks was the original
       memory root, but actually was the statement memory root.
    That led to double free - in destruction of the statement and in
    a next call to mysql_parse().
    
    The solution is to restore memroot right after the failed parsing.
    00b2fc6a
sql_prepare.cc 83.4 KB