Skip to content

Commit 5f2a67a

Browse files
varunraikovarunraiko
committed
MDEV-15247: Crash when SET NAMES 'utf8' is set
In this case we are accessing incorrect memory when we have mergeable semi-joins. In the case when we have mergeable semi joins parent select will have a table count of all the tables in that select plus all the tables involved in the IN-subquery. But this table count does not include the "sjm table" (only includes the inner and outer tables) denotes as <subquery#> in explain.
1 parent c450f7d commit 5f2a67a

File tree

3 files changed

+180
-1
lines changed

3 files changed

+180
-1
lines changed

‎mysql-test/r/subselect_sj2_mat.result

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1691,3 +1691,93 @@ id
16911691
12
16921692
13
16931693
drop table t1;
1694+
#
1695+
# MDEV-15247: Crash when SET NAMES 'utf8' is set
1696+
#
1697+
CREATE TABLE t1 (
1698+
id_category int unsigned,
1699+
id_product int unsigned,
1700+
PRIMARY KEY (id_category,id_product)
1701+
) ENGINE=MyISAM;
1702+
INSERT INTO `t1` VALUES (31,216), (31,215), (31,214), (31,213), (31,212), (32,211), (32,210), (32,209), (32,208), (29,207), (30,315372), (2,161), (2,132), (33,315380), (31,315371), (29,315370), (29,315373), (29,315369), (29,315374), (29,315368), (29,315375), (29,315367), (29,183), (29,182), (30,177), (29,315376), (13,315365), (2,167), (2,315357), (2,164), (2,159), (2,131), (2,127), (14,315364), (27,315363), (29,205), (29,204), (29,203), (29,202), (29,201), (29,200), (29,199), (29,198), (29,197), (29,196), (29,195), (29,194), (29,193), (29,192), (29,191), (29,190), (29,189), (14,188), (29,187), (29,186), (29,185), (29,184), (29,315377), (29,315378), (29,181), (33,315379), (29,179), (30,178), (29,180), (30,176), (30,175), (30,174), (30,173), (30,172), (11,171), (27,315357), (23,108), (23,102);
1703+
CREATE TABLE t2 (
1704+
id_product int,
1705+
id_t2 int,
1706+
KEY id_t2 (id_t2),
1707+
KEY id_product (id_product)
1708+
) ENGINE=MyISAM;
1709+
INSERT INTO `t2` VALUES (11,31), (11,31), (11,31), (11,32), (11,32),
1710+
(11,32), (10,26), (11,32), (10,28), (11,32), (10,29), (11,33), (10,26),
1711+
(11,33), (10,27), (9,23), (11,32), (10,26), (8,18), (7,15), (11,32),
1712+
(10,28), (11,32), (10,28), (11,32), (10,29), (11,32), (10,29), (8,19),
1713+
(7,16), (8,18), (7,16), (8,20), (7,16), (11,32), (10,28), (8,19),
1714+
(7,16), (8,20), (7,16), (11,32), (10,29), (8,19), (7,16), (8,20),
1715+
(7,16), (10,27), (9,23), (10,27), (9,23), (10,27), (9,23), (11,32),
1716+
(10,27), (11,32), (10,27), (8,18), (7,15), (10,26), (9,24), (8,19),
1717+
(7,16), (10,26), (9,23), (8,19), (7,16), (8,18), (7,16), (8,18), (7,16),
1718+
(9,23), (8,18), (9,23), (8,19), (7,16), (7,16), (8,19), (7,16), (11,31),
1719+
(10,27), (9,24), (11,31), (10,27), (9,23), (8,19), (11,31), (10,26), (9,24),
1720+
(8,19), (11,31), (10,26), (9,25), (8,18), (11,31), (10,26), (9,23), (8,19),
1721+
(11,31), (10,26), (9,23), (8,18), (11,31), (10,30), (9,23), (8,18), (11,31),
1722+
(10,30), (9,23), (8,19), (11,31), (10,26), (9,25), (8,19), (8,21), (11,32),
1723+
(10,26), (9,22), (8,19), (11,32), (10,26), (9,22), (8,18), (11,32), (10,26),
1724+
(9,22), (8,20), (11,33), (10,26), (9,22), (8,19), (11,33), (10,26), (9,22),
1725+
(8,18), (11,33), (10,26), (9,22), (8,20), (11,32), (10,26), (9,24), (8,19),
1726+
(11,32), (10,26), (9,25), (8,19), (11,32), (10,26), (9,25), (8,18), (11,32),
1727+
(10,26), (9,23), (8,18), (11,32), (10,30), (9,23), (8,18), (11,32), (10,30),
1728+
(9,23), (8,19), (11,32), (10,26), (9,23), (8,19), (11,32), (10,27), (9,23),
1729+
(11,32), (10,27), (9,23), (11,32), (10,27), (9,23), (10,26), (9,22), (8,19),
1730+
(7,15), (10,26), (9,22), (8,20), (7,15), (10,26), (9,22), (8,18), (7,15),
1731+
(8,19), (10,26), (10,26), (11,33), (10,26), (11,33), (10,26), (11,33),
1732+
(10,27), (11,33), (10,27), (11,31), (10,26), (11,31), (10,26), (8,18),
1733+
(7,15), (9,23), (9,23), (9,24), (8,21), (7,15), (7,15), (7,15), (7,15),
1734+
(7,15), (7,15), (7,15), (7,15), (7,15), (8,18), (7,17), (8,18), (7,17), (8,19), (8,19);
1735+
CREATE TABLE t3 (
1736+
id_product int unsigned,
1737+
PRIMARY KEY (id_product)
1738+
) ENGINE=MyISAM;
1739+
INSERT INTO t3 VALUES
1740+
(102),(103),(104),(105),(106),(107),(108),(109),(110),
1741+
(315371),(315373),(315374),(315375),(315376),(315377),
1742+
(315378),(315379),(315380);
1743+
CREATE TABLE t4 (
1744+
id_product int not null,
1745+
id_shop int,
1746+
PRIMARY KEY (id_product,id_shop)
1747+
) ENGINE=MyISAM ;
1748+
INSERT INTO t4 VALUES
1749+
(202,1),(201,1),(200,1),(199,1),(198,1),(197,1),(196,1),(195,1),
1750+
(194,1),(193,1),(192,1),(191,1),(190,1),(189,1),(188,1),(187,1),
1751+
(186,1),(185,1),(184,1),(183,1),(182,1),(181,1),(179,1),(178,1),
1752+
(177,1),(176,1),(126,1),(315380,1);
1753+
CREATE TABLE t5 (id_product int) ENGINE=MyISAM;
1754+
INSERT INTO `t5` VALUES
1755+
(652),(668),(669),(670),(671),(673),(674),(675),(676),
1756+
(677),(679),(680),(681),(682),(683),(684),(685),(686);
1757+
explain
1758+
SELECT * FROM t3
1759+
JOIN t4 ON (t4.id_product = t3.id_product AND t4.id_shop = 1)
1760+
JOIN t1 ON (t1.id_product = t3.id_product)
1761+
LEFT JOIN t5 ON (t5.id_product = t3.id_product)
1762+
WHERE 1=1
1763+
AND t3.id_product IN (SELECT id_product FROM t2 t2_1 WHERE t2_1.id_t2 = 32)
1764+
AND t3.id_product IN (SELECT id_product FROM t2 t2_2 WHERE t2_2.id_t2 = 15)
1765+
AND t3.id_product IN (SELECT id_product FROM t2 t2_3 WHERE t2_3.id_t2 = 18 OR t2_3.id_t2 = 19)
1766+
AND t3.id_product IN (SELECT id_product FROM t2 t2_4 WHERE t2_4.id_t2 = 34 OR t2_4.id_t2 = 23)
1767+
AND t3.id_product IN (SELECT id_product FROM t2 t2_5 WHERE t2_5.id_t2 = 29 OR t2_5.id_t2 = 28 OR t2_5.id_t2 = 26);
1768+
id select_type table type possible_keys key key_len ref rows Extra
1769+
1 PRIMARY t1 index NULL PRIMARY 8 NULL 73 Using index
1770+
1 PRIMARY t3 eq_ref PRIMARY PRIMARY 4 test.t1.id_product 1 Using index
1771+
1 PRIMARY <subquery5> eq_ref distinct_key distinct_key 4 func 1 Using where
1772+
1 PRIMARY <subquery4> eq_ref distinct_key distinct_key 4 func 1 Using where
1773+
1 PRIMARY <subquery3> eq_ref distinct_key distinct_key 4 func 1 Using where
1774+
1 PRIMARY <subquery2> eq_ref distinct_key distinct_key 4 func 1 Using where
1775+
1 PRIMARY t4 eq_ref PRIMARY PRIMARY 8 test.t1.id_product,const 1 Using where; Using index
1776+
1 PRIMARY <subquery6> eq_ref distinct_key distinct_key 4 func 1 Using where
1777+
1 PRIMARY t5 ALL NULL NULL NULL NULL 18 Using where; Using join buffer (flat, BNL join)
1778+
5 MATERIALIZED t2_4 range id_t2,id_product id_t2 5 NULL 18 Using index condition; Using where
1779+
4 MATERIALIZED t2_3 range id_t2,id_product id_t2 5 NULL 32 Using index condition; Using where
1780+
3 MATERIALIZED t2_2 ref id_t2,id_product id_t2 5 const 12
1781+
2 MATERIALIZED t2_1 ref id_t2,id_product id_t2 5 const 50
1782+
6 MATERIALIZED t2_5 range id_t2,id_product id_t2 5 NULL 30 Using index condition; Using where
1783+
drop table t1,t2,t3,t4,t5;

‎mysql-test/t/subselect_sj2_mat.test

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -345,3 +345,90 @@ WHERE (
345345
(t.id IN (0,4,12,13,1,10,3,11))
346346
);
347347
drop table t1;
348+
349+
--echo #
350+
--echo # MDEV-15247: Crash when SET NAMES 'utf8' is set
351+
--echo #
352+
353+
CREATE TABLE t1 (
354+
id_category int unsigned,
355+
id_product int unsigned,
356+
PRIMARY KEY (id_category,id_product)
357+
) ENGINE=MyISAM;
358+
359+
INSERT INTO `t1` VALUES (31,216), (31,215), (31,214), (31,213), (31,212), (32,211), (32,210), (32,209), (32,208), (29,207), (30,315372), (2,161), (2,132), (33,315380), (31,315371), (29,315370), (29,315373), (29,315369), (29,315374), (29,315368), (29,315375), (29,315367), (29,183), (29,182), (30,177), (29,315376), (13,315365), (2,167), (2,315357), (2,164), (2,159), (2,131), (2,127), (14,315364), (27,315363), (29,205), (29,204), (29,203), (29,202), (29,201), (29,200), (29,199), (29,198), (29,197), (29,196), (29,195), (29,194), (29,193), (29,192), (29,191), (29,190), (29,189), (14,188), (29,187), (29,186), (29,185), (29,184), (29,315377), (29,315378), (29,181), (33,315379), (29,179), (30,178), (29,180), (30,176), (30,175), (30,174), (30,173), (30,172), (11,171), (27,315357), (23,108), (23,102);
360+
361+
CREATE TABLE t2 (
362+
id_product int,
363+
id_t2 int,
364+
KEY id_t2 (id_t2),
365+
KEY id_product (id_product)
366+
) ENGINE=MyISAM;
367+
368+
INSERT INTO `t2` VALUES (11,31), (11,31), (11,31), (11,32), (11,32),
369+
(11,32), (10,26), (11,32), (10,28), (11,32), (10,29), (11,33), (10,26),
370+
(11,33), (10,27), (9,23), (11,32), (10,26), (8,18), (7,15), (11,32),
371+
(10,28), (11,32), (10,28), (11,32), (10,29), (11,32), (10,29), (8,19),
372+
(7,16), (8,18), (7,16), (8,20), (7,16), (11,32), (10,28), (8,19),
373+
(7,16), (8,20), (7,16), (11,32), (10,29), (8,19), (7,16), (8,20),
374+
(7,16), (10,27), (9,23), (10,27), (9,23), (10,27), (9,23), (11,32),
375+
(10,27), (11,32), (10,27), (8,18), (7,15), (10,26), (9,24), (8,19),
376+
(7,16), (10,26), (9,23), (8,19), (7,16), (8,18), (7,16), (8,18), (7,16),
377+
(9,23), (8,18), (9,23), (8,19), (7,16), (7,16), (8,19), (7,16), (11,31),
378+
(10,27), (9,24), (11,31), (10,27), (9,23), (8,19), (11,31), (10,26), (9,24),
379+
(8,19), (11,31), (10,26), (9,25), (8,18), (11,31), (10,26), (9,23), (8,19),
380+
(11,31), (10,26), (9,23), (8,18), (11,31), (10,30), (9,23), (8,18), (11,31),
381+
(10,30), (9,23), (8,19), (11,31), (10,26), (9,25), (8,19), (8,21), (11,32),
382+
(10,26), (9,22), (8,19), (11,32), (10,26), (9,22), (8,18), (11,32), (10,26),
383+
(9,22), (8,20), (11,33), (10,26), (9,22), (8,19), (11,33), (10,26), (9,22),
384+
(8,18), (11,33), (10,26), (9,22), (8,20), (11,32), (10,26), (9,24), (8,19),
385+
(11,32), (10,26), (9,25), (8,19), (11,32), (10,26), (9,25), (8,18), (11,32),
386+
(10,26), (9,23), (8,18), (11,32), (10,30), (9,23), (8,18), (11,32), (10,30),
387+
(9,23), (8,19), (11,32), (10,26), (9,23), (8,19), (11,32), (10,27), (9,23),
388+
(11,32), (10,27), (9,23), (11,32), (10,27), (9,23), (10,26), (9,22), (8,19),
389+
(7,15), (10,26), (9,22), (8,20), (7,15), (10,26), (9,22), (8,18), (7,15),
390+
(8,19), (10,26), (10,26), (11,33), (10,26), (11,33), (10,26), (11,33),
391+
(10,27), (11,33), (10,27), (11,31), (10,26), (11,31), (10,26), (8,18),
392+
(7,15), (9,23), (9,23), (9,24), (8,21), (7,15), (7,15), (7,15), (7,15),
393+
(7,15), (7,15), (7,15), (7,15), (7,15), (8,18), (7,17), (8,18), (7,17), (8,19), (8,19);
394+
395+
CREATE TABLE t3 (
396+
id_product int unsigned,
397+
PRIMARY KEY (id_product)
398+
) ENGINE=MyISAM;
399+
400+
INSERT INTO t3 VALUES
401+
(102),(103),(104),(105),(106),(107),(108),(109),(110),
402+
(315371),(315373),(315374),(315375),(315376),(315377),
403+
(315378),(315379),(315380);
404+
405+
CREATE TABLE t4 (
406+
id_product int not null,
407+
id_shop int,
408+
PRIMARY KEY (id_product,id_shop)
409+
) ENGINE=MyISAM ;
410+
411+
INSERT INTO t4 VALUES
412+
(202,1),(201,1),(200,1),(199,1),(198,1),(197,1),(196,1),(195,1),
413+
(194,1),(193,1),(192,1),(191,1),(190,1),(189,1),(188,1),(187,1),
414+
(186,1),(185,1),(184,1),(183,1),(182,1),(181,1),(179,1),(178,1),
415+
(177,1),(176,1),(126,1),(315380,1);
416+
417+
CREATE TABLE t5 (id_product int) ENGINE=MyISAM;
418+
INSERT INTO `t5` VALUES
419+
(652),(668),(669),(670),(671),(673),(674),(675),(676),
420+
(677),(679),(680),(681),(682),(683),(684),(685),(686);
421+
422+
explain
423+
SELECT * FROM t3
424+
JOIN t4 ON (t4.id_product = t3.id_product AND t4.id_shop = 1)
425+
JOIN t1 ON (t1.id_product = t3.id_product)
426+
LEFT JOIN t5 ON (t5.id_product = t3.id_product)
427+
WHERE 1=1
428+
AND t3.id_product IN (SELECT id_product FROM t2 t2_1 WHERE t2_1.id_t2 = 32)
429+
AND t3.id_product IN (SELECT id_product FROM t2 t2_2 WHERE t2_2.id_t2 = 15)
430+
AND t3.id_product IN (SELECT id_product FROM t2 t2_3 WHERE t2_3.id_t2 = 18 OR t2_3.id_t2 = 19)
431+
AND t3.id_product IN (SELECT id_product FROM t2 t2_4 WHERE t2_4.id_t2 = 34 OR t2_4.id_t2 = 23)
432+
AND t3.id_product IN (SELECT id_product FROM t2 t2_5 WHERE t2_5.id_t2 = 29 OR t2_5.id_t2 = 28 OR t2_5.id_t2 = 26);
433+
434+
drop table t1,t2,t3,t4,t5;

‎sql/sql_select.cc

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9592,7 +9592,7 @@ make_join_select(JOIN *join,SQL_SELECT *select,COND *cond)
95929592
table_map current_map;
95939593
i= join->const_tables;
95949594
for (tab= first_depth_first_tab(join); tab;
9595-
tab= next_depth_first_tab(join, tab), i++)
9595+
tab= next_depth_first_tab(join, tab))
95969596
{
95979597
bool is_hj;
95989598
/*
@@ -10063,6 +10063,8 @@ make_join_select(JOIN *join,SQL_SELECT *select,COND *cond)
1006310063
}
1006410064
first_inner_tab= first_inner_tab->first_upper;
1006510065
}
10066+
if (!tab->bush_children)
10067+
i++;
1006610068
}
1006710069
}
1006810070
DBUG_RETURN(0);

0 commit comments

Comments
 (0)