Commit a2bb9d26 authored by Sergey Vojtovich's avatar Sergey Vojtovich

MDEV-7505 - Too large scale in DECIMAL dynamic column getter crashes mysqld

Server may crash if sanity checks of COLUMN_GET() fail.

COLUMN_GET() description generator expects parent CAST item, which may not have
been created due to failure of sanity checks. Then further attempt to report
an error may crash the server.

Fixed COLUMN_GET() description generator to handle such case.
parent b611ac06
......@@ -1444,3 +1444,9 @@ column_get(column_create(1, "18446744073709552001" as char), 1 as int)
Warnings:
Warning 1918 Encountered illegal value '18446744073709552001' when converting to INT
Note 1105 Cast to signed converted positive out-of-range integer to it's negative complement
#
# MDEV-7505 - Too large scale in DECIMAL dynamic column getter crashes
# mysqld
#
SELECT COLUMN_GET(`x`, 'y' AS DECIMAL(5,34));
ERROR 42000: Too big scale 34 specified for ''y''. Maximum is 30.
......@@ -643,3 +643,9 @@ SELECT
#
select column_get(column_create(1, "18446744073709552001" as char), 1 as int);
--echo #
--echo # MDEV-7505 - Too large scale in DECIMAL dynamic column getter crashes
--echo # mysqld
--echo #
--error ER_TOO_BIG_SCALE
SELECT COLUMN_GET(`x`, 'y' AS DECIMAL(5,34));
......@@ -4467,6 +4467,16 @@ null:
void Item_dyncol_get::print(String *str, enum_query_type query_type)
{
/*
Parent cast doesn't exist yet, only print dynamic column name. This happens
when called from create_func_cast() / wrong_precision_error().
*/
if (!str->length())
{
args[1]->print(str, query_type);
return;
}
/* see create_func_dyncol_get */
DBUG_ASSERT(str->length() >= 5);
DBUG_ASSERT(strncmp(str->ptr() + str->length() - 5, "cast(", 5) == 0);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment