From: Jon Olav Hauglid
Date: March 8 2011 12:11pm
Subject: Re: bzr commit into mysql-5.5 branch (alexander.nozdrin:3367) Bug#11763413
List-Archive: http://lists.mysql.com/commits/132587
Message-Id: <4D761CE4.1000008@oracle.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Hello,

On 03/03/2011 08:51 AM, Alexander Nozdrin wrote:
>   3367 Alexander Nozdrin	2011-03-03
>        A patch for Bug#11763413 (invalid memory reads when PS selecting
>        from information_schema tables).
>
>        The problem was in some corner cases TABLE instance might have
>        NULL 's' attribute (a pointer to TABLE_SHARE).

Which corner cases?

> === modified file 'mysql-test/t/ps.test'
> --- a/mysql-test/t/ps.test	2010-11-13 15:05:02 +0000
> +++ b/mysql-test/t/ps.test	2011-03-03 07:51:42 +0000
> @@ -3344,7 +3344,19 @@ connection default;
>   DROP TABLE t1;
>   disconnect con1;
>
> +--echo
>   --echo #
> ---echo # End of 6.0 tests.
> +--echo # Bug#56115: invalid memory reads when PS selecting from
> +--echo #            information_schema tables
> +--echo # Bug#58701: crash in Field::make_field, cursor-protocol
> +--echo #
> +--echo
> +
> +SELECT *
> +FROM (SELECT 1 UNION SELECT 2) t;
> +
> +
> +--echo #
> +--echo # End of 5.5 tests.

I'm unable to reproduce the original problem with this test case and 
your change reverted. Is it OS specific? (I tested with 
--cursor-protocol as well).

> === modified file 'sql/field.cc'
> --- a/sql/field.cc	2011-02-08 15:47:33 +0000
> +++ b/sql/field.cc	2011-03-03 07:51:42 +0000
> @@ -1552,7 +1552,8 @@ void Field_num::add_zerofill_and_unsigne
>
>   void Field::make_field(Send_field *field)
>   {
> -  if (orig_table&&  orig_table->s->db.str&&  *orig_table->s->db.str)
> +  if (orig_table&&  orig_table->s&&
> +      orig_table->s->db.str&&  *orig_table->s->db.str)
>     {
>       field->db_name= orig_table->s->db.str;
>       if (orig_table->pos_in_table_list&&

Even with this change, I'm able to reproduce the problem from Bug#56115
using the bug56115.c test case Shane posted.

--- Jon Olav