Skip to content
  • Norvald H. Ryeng's avatar
    fba9d341
    Bug#14728142 EXPLAIN CRASH WITH UNKNOWN COLUMN IN GROUP BY SUBQUERY · fba9d341
    Norvald H. Ryeng authored
    Problem: The server crashes when explaining a query with an IN
    subquery with a GROUP BY clause with a subquery selecting a column
    that doesn't exist.
    
    During JOIN::prepare() of the IN subquery,
    remove_redundant_subquery_clauses() is called to remove redundant
    clauses. The GROUP BY clause is found to be redundant, and is
    removed. Since it is removed, the subquery with the non-existent
    column is not resolved in this round.
    
    Later, all subqueries are explained, also the subquery that was
    removed and not prepared. JOIN::prepare is called for this subquery,
    but resolving of the non-existent column name crashes in
    Item_field::fix_outer_field() when trying to find the Item_subselect
    for the middle query. This item has been removed in a transformation
    from IN to semijoin.
    
    Fix: Resolve all items before calling
    remove_redundant_subquery_clauses(). This has the added benefit of
    emitting error messages for non-existent columns.
    fba9d341
    Bug#14728142 EXPLAIN CRASH WITH UNKNOWN COLUMN IN GROUP BY SUBQUERY
    Norvald H. Ryeng authored
    Problem: The server crashes when explaining a query with an IN
    subquery with a GROUP BY clause with a subquery selecting a column
    that doesn't exist.
    
    During JOIN::prepare() of the IN subquery,
    remove_redundant_subquery_clauses() is called to remove redundant
    clauses. The GROUP BY clause is found to be redundant, and is
    removed. Since it is removed, the subquery with the non-existent
    column is not resolved in this round.
    
    Later, all subqueries are explained, also the subquery that was
    removed and not prepared. JOIN::prepare is called for this subquery,
    but resolving of the non-existent column name crashes in
    Item_field::fix_outer_field() when trying to find the Item_subselect
    for the middle query. This item has been removed in a transformation
    from IN to semijoin.
    
    Fix: Resolve all items before calling
    remove_redundant_subquery_clauses(). This has the added benefit of
    emitting error messages for non-existent columns.
Loading