| Bug #30832 | Assertion + crash with select name_const('test',now()); | ||
|---|---|---|---|
| Submitted: | 5 Sep 2007 14:21 | Modified: | 13 Nov 2007 19:13 |
| Reporter: | Shane Bester (Platinum Quality Contributor) | Email Updates: | |
| Status: | Closed | Impact on me: | |
| Category: | MySQL Server: Data Types | Severity: | S1 (Critical) |
| Version: | 5.0.50-debug, 5.2.4, 5.1.21-debug | OS: | Any |
| Assigned to: | Martin Hansson | CPU Architecture: | Any |
| Tags: | name_const | ||
[5 Sep 2007 14:27]
MySQL Verification Team
mysqld-debug.exe!_NMSG_WRITE mysqld-debug.exe!abort mysqld-debug.exe!_wassert mysqld-debug.exe!Protocol_simple::store mysqld-debug.exe!Item::send mysqld-debug.exe!Item_name_const::send mysqld-debug.exe!select_send::send_data mysqld-debug.exe!JOIN::exec mysqld-debug.exe!mysql_select mysqld-debug.exe!handle_select mysqld-debug.exe!mysql_execute_command mysqld-debug.exe!mysql_parse mysqld-debug.exe!dispatch_command mysqld-debug.exe!do_command mysqld-debug.exe!handle_one_connection mysqld-debug.exe!pthread_start mysqld-debug.exe!_callthreadstart mysqld-debug.exe!_threadstart
[28 Sep 2007 15:40]
Martin Hansson
The problem here is obvious: NAME_CONST is not supposed to be callable with anything but a constant. (it's not even intended for users) However, what displayed this bug is that Item_name_const does not override the default Item::field_type(). This function will cast the type to one of string, int, decimal, or real. This is what caused the failed assertion in the Protocol. But since NAME_CONST is supposed to be totally transparent, it should probably return whatever its value_item returns. I can't construct a test case to catch this, however, so I will just note this here.
[28 Sep 2007 16:02]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/34652 ChangeSet@1.2530, 2007-09-28 18:05:23+02:00, mhansson@linux-st28.site +3 -0 Bug #30832: Assertion + crash with select name_const('test', now()); The NAME_CONST function is required to work correctly with constants only. When executed with functions that return types other than those returned by Item::field_type (string, int, decimal, or real), the result gets cast to one of those types. This cannot happen for constants. Fixed by only allowing constants as arguments to NAME_CONST.
[8 Oct 2007 18:42]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/35124 ChangeSet@1.2530, 2007-10-08 20:45:50+02:00, mhansson@linux-st28.site +4 -0 Bug #30832: Assertion + crash with select name_const('test', now()); The NAME_CONST function is required to work correctly with constants only. When executed with functions that return types other than those returned by Item::field_type (string, int, decimal, or real), the result gets cast to one of those types. This cannot happen for constants. Fixed by only allowing constants as arguments to NAME_CONST.
[9 Oct 2007 9:32]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/35182 ChangeSet@1.2553, 2007-10-09 11:36:05+02:00, mhansson@linux-st28.site +3 -0 Bug#30832:Assertion + crash with select name_const('test',now()); Completion of previous patch. Negative number were denied as the second argument to NAME_CONST.
[29 Oct 2007 8:42]
Bugs System
Pushed into 5.0.52
[29 Oct 2007 8:45]
Bugs System
Pushed into 5.1.23-beta
[29 Oct 2007 8:49]
Bugs System
Pushed into 6.0.4-alpha
[13 Nov 2007 19:13]
Paul DuBois
Noted in 5.0.52, 5.1.23, 6.0.4 changelogs. Calling NAME_CONST() with non-constant arguments triggered an assertion failure. Non-constant arguments are now disallowed.
Description: debug build crashes with: Version: '5.0.50-debug' socket: '' port: 3306 yes Assertion failed: field_types == 0 || field_types[field_pos] == MYSQL_TYPE_DATETIME || field_types[field_pos] == MYSQL_TYPE_TIMESTAMP, file .\protocol.cpp, line 956 How to repeat: start a debug build of mysqld and login then run this: select name_const('test',now()); Suggested fix: .