Skip to content
  • Norvald H. Ryeng's avatar
    03d3e9d2
    Bug#11764313 57135: CRASH IN ITEM_FUNC_CASE::FIND_ITEM WITH CASE WHEN · 03d3e9d2
    Norvald H. Ryeng authored
    ELSE CLAUSE
    
    Problem: During optimization, ZEROFILL values, which includes YEAR
    values, may be converted to string constants. However, the CASE
    function does not handle switching datatypes after planning, leading
    to CASE finding a null pointer instead of its argument.
    
    Item_func_case creates a table of cmp_items, one for each datatype
    used in the comparison. This table is created during query planning by
    fix_length_and_dec(). During optimization,
    Item_field::equal_fields_propagator() converts ZEROFILL numbers to
    strings, but the comparison table in Item_func_case is not
    updated. Later in optimization, the condition is evaluated as part of
    removing trivial comparisons from the query. During evaluation, the
    position in the comparison table is found by examining the result
    types of the fields to be compared. Since the result type of the
    fields have changed, the wrong position in the comparison table is
    inferred, and this position contains a null pointer.
    
    This bug is similar to bug#11764818, which affects the IN
    function. Item_func_in and Item_func_case are the only functions using
    the cmp_items construct.
    
    Fix: Set the cmp_context of WHEN arguments to Item_func_case so that
    Item_field::equal_fields_propagator() will not convert them to
    strings.
    03d3e9d2
    Bug#11764313 57135: CRASH IN ITEM_FUNC_CASE::FIND_ITEM WITH CASE WHEN
    Norvald H. Ryeng authored
    ELSE CLAUSE
    
    Problem: During optimization, ZEROFILL values, which includes YEAR
    values, may be converted to string constants. However, the CASE
    function does not handle switching datatypes after planning, leading
    to CASE finding a null pointer instead of its argument.
    
    Item_func_case creates a table of cmp_items, one for each datatype
    used in the comparison. This table is created during query planning by
    fix_length_and_dec(). During optimization,
    Item_field::equal_fields_propagator() converts ZEROFILL numbers to
    strings, but the comparison table in Item_func_case is not
    updated. Later in optimization, the condition is evaluated as part of
    removing trivial comparisons from the query. During evaluation, the
    position in the comparison table is found by examining the result
    types of the fields to be compared. Since the result type of the
    fields have changed, the wrong position in the comparison table is
    inferred, and this position contains a null pointer.
    
    This bug is similar to bug#11764818, which affects the IN
    function. Item_func_in and Item_func_case are the only functions using
    the cmp_items construct.
    
    Fix: Set the cmp_context of WHEN arguments to Item_func_case so that
    Item_field::equal_fields_propagator() will not convert them to
    strings.
Loading