MySQL Lists are EOL. Please join:

List:Commits« Previous MessageNext Message »
From:Sergey Glukhov Date:November 25 2008 3:14pm
Subject:bzr commit into mysql-5.0-bugteam branch (Sergey.Glukhov:2722)
Bug#37671 Bug#37956
View as plain text  
#At file:///home/gluh/MySQL/mysql-5.0-bug-37956/ based on revid:ramil@stripped

 2722 Sergey Glukhov	2008-11-25
      Bug#37956 memory leak and / or crash with geometry and prepared statements!
      Bug#37671 crash on prepared statement + cursor + geometry + too many open files!
      if mysql_execute_command() returns error then free materialized_cursor object.
      is_rnd_inited is added to satisfy rnd_end() assertion
      (handler may be uninitialized in some cases)
modified:
  sql/sql_cursor.cc
  sql/sql_select.cc

per-file messages:
  sql/sql_cursor.cc
    if mysql_execute_command() returns error then free materialized_cursor object.
    is_rnd_inited is added to satisfy rnd_end() assertion
    (handler may be uninitialized in some cases)
  sql/sql_select.cc
    added result check
=== modified file 'sql/sql_cursor.cc'
--- a/sql/sql_cursor.cc	2008-08-11 09:40:54 +0000
+++ b/sql/sql_cursor.cc	2008-11-25 15:13:05 +0000
@@ -85,6 +85,7 @@ class Materialized_cursor: public Server
   List<Item> item_list;
   ulong fetch_limit;
   ulong fetch_count;
+  bool is_rnd_inited;
 public:
   Materialized_cursor(select_result *result, TABLE *table);
 
@@ -191,7 +192,11 @@ int mysql_open_cursor(THD *thd, uint fla
       such command is SHOW VARIABLES or SHOW STATUS.
   */
   if (rc)
+  {
+    if (result_materialize->materialized_cursor)
+      delete result_materialize->materialized_cursor;
     goto err_open;
+  }
 
   if (sensitive_cursor->is_open())
   {
@@ -532,7 +537,8 @@ Materialized_cursor::Materialized_cursor
   :Server_side_cursor(&table_arg->mem_root, result_arg),
   table(table_arg),
   fetch_limit(0),
-  fetch_count(0)
+  fetch_count(0),
+  is_rnd_inited(0)
 {
   fake_unit.init_query();
   fake_unit.thd= table->in_use;
@@ -589,11 +595,12 @@ int Materialized_cursor::open(JOIN *join
   THD *thd= fake_unit.thd;
   int rc;
   Query_arena backup_arena;
-
   thd->set_n_backup_active_arena(this, &backup_arena);
   /* Create a list of fields and start sequential scan */
-  rc= (result->prepare(item_list, &fake_unit) ||
-       table->file->ha_rnd_init(TRUE));
+  rc= result->prepare(item_list, &fake_unit);
+  if (!rc && !(rc= table->file->ha_rnd_init(TRUE)))
+    is_rnd_inited= 1;
+
   thd->restore_active_arena(this, &backup_arena);
   if (rc == 0)
   {
@@ -673,7 +680,8 @@ void Materialized_cursor::close()
 {
   /* Free item_list items */
   free_items();
-  (void) table->file->ha_rnd_end();
+  if (is_rnd_inited)
+    (void) table->file->ha_rnd_end();
   /*
     We need to grab table->mem_root to prevent free_tmp_table from freeing:
     the cursor object was allocated in this memory.

=== modified file 'sql/sql_select.cc'
--- a/sql/sql_select.cc	2008-11-03 09:50:32 +0000
+++ b/sql/sql_select.cc	2008-11-25 15:13:05 +0000
@@ -1589,8 +1589,11 @@ JOIN::exec()
 		      (zero_result_cause?zero_result_cause:"No tables used"));
     else
     {
-      result->send_fields(*columns_list,
-                          Protocol::SEND_NUM_ROWS | Protocol::SEND_EOF);
+      if (result->send_fields(*columns_list,
+                              Protocol::SEND_NUM_ROWS | Protocol::SEND_EOF))
+      {
+        DBUG_VOID_RETURN;
+      }
       /*
         We have to test for 'conds' here as the WHERE may not be constant
         even if we don't have any tables for prepared statements or if

Thread
bzr commit into mysql-5.0-bugteam branch (Sergey.Glukhov:2722)Bug#37671 Bug#37956Sergey Glukhov25 Nov