MySQL Bugs: #27362: SELECT id FROM tablename WHERE id IN(4564, (SELECT IF(1=0,1,1/0)) ) crash

Bug #27362	SELECT id FROM tablename WHERE id IN(4564, (SELECT IF(1=0,1,1/0)) ) crash
Submitted:	21 Mar 2007 22:16	Modified:	3 Apr 2007 22:30
Reporter:	Mads Martin Joergensen	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server	Severity:	S3 (Non-critical)
Version:	5.0.38	OS:	Any
Assigned to:	Igor Babaev	CPU Architecture:	Any

Description:
SELECT id FROM tablename WHERE id IN(4564, (SELECT IF(1=0,1,1/0)) ); crashes most recent 5.0.

How to repeat:
SELECT id FROM tablename WHERE id IN(4564, (SELECT IF(1=0,1,1/0)) );

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/22557

ChangeSet@1.2490, 2007-03-21 22:57:22-07:00, igor@olga.mysql.com +3 -0
  Fixed bug #27362: crash at evaluation of IN predicate when one
  of its argument happened to be a decimal expression returning
  the NULL value.
  The crash was due to the fact the function in_decimal::set did
  not take into account that val_decimal() could return 0 if 
  the decimal expression had been evaluated to NULL.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/22559

ChangeSet@1.2490, 2007-03-22 00:05:36-07:00, igor@olga.mysql.com +3 -0
  Fixed bug #27362: crash at evaluation of IN predicate when one
  of its argument happened to be a decimal expression returning
  the NULL value.
  The crash was due to the fact the function in_decimal::set did
  not take into account that val_decimal() could return 0 if 
  the decimal expression had been evaluated to NULL.

Pushed in 5.0.40 and 5.1.18

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/23704

ChangeSet@1.2499, 2007-04-03 14:08:09-04:00, cmiller@zippy.cornsilk.net +3 -0
  Backport of Igor's patch for Bug#27362, March 22 2007.
  
  Fixed bug #27362: crash at evaluation of IN predicate when one
  of its argument happened to be a decimal expression returning
  the NULL value.
  The crash was due to the fact the function in_decimal::set did
  not take into account that val_decimal() could return 0 if 
  the decimal expression had been evaluated to NULL.

Noted in 5.0.40, 5.1.18 changelogs.

This patch also fixes Bug#27513.

Pushed into 6.0.5-alpha

Pushed into 5.1.24-rc

Also documented for 6.0.5.

Pushed into 5.0.82 (revid:chad@mysql.com-20090506130632-s1cl4ygdj9rt2rrz) (version source revid:chad@mysql.com-20090506130632-s1cl4ygdj9rt2rrz) (merge vers: 5.0.82) (pib:6)