Backport

Tor Didriksen · Tor Didriksen · commit abdb79062e7e · 2012-09-25T16:03:05.000+02:00
Bug #11764313 57135: CRASH IN ITEM_FUNC_CASE::FIND_ITEM WITH CASE WHEN
Bug #11764818 57692: Crash in item_func_in::val_int() with ZEROFILL
diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc
@@ -1,4 +1,4 @@
-/* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
+/* Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -3045,6 +3045,15 @@ void Item_func_case::fix_length_and_dec()
           return;
       }
     }
+    /*
+      Set cmp_context of all WHEN arguments. This prevents
+      Item_field::equal_fields_propagator() from transforming a
+      zerofill argument into a string constant. Such a change would
+      require rebuilding cmp_items.
+    */
+    for (i= 0; i < ncases; i+= 2)
+      args[i]->cmp_context= item_cmp_type(left_result_type,
+                                          args[i]->result_type());
   }
 
   if (else_expr_num == -1 || args[else_expr_num]->maybe_null)
@@ -4032,6 +4041,16 @@ void Item_func_in::fix_length_and_dec()
       }
     }
   }
+  /*
+    Set cmp_context of all arguments. This prevents
+    Item_field::equal_fields_propagator() from transforming a zerofill integer
+    argument into a string constant. Such a change would require rebuilding
+    cmp_itmes.
+   */
+  for (arg= args + 1, arg_end= args + arg_count; arg != arg_end ; arg++)
+  {
+    arg[0]->cmp_context= item_cmp_type(left_result_type, arg[0]->result_type());
+  }
   max_length= 1;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-/* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.`
	`1`	`+/* Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.`
`2`	`2`
`3`	`3`	`This program is free software; you can redistribute it and/or modify`
`4`	`4`	`it under the terms of the GNU General Public License as published by`
`@@ -3045,6 +3045,15 @@ void Item_func_case::fix_length_and_dec()`
`3045`	`3045`	`return;`
`3046`	`3046`	`}`
`3047`	`3047`	`}`
	`3048`	`+ /*`
	`3049`	`+ Set cmp_context of all WHEN arguments. This prevents`
	`3050`	`+ Item_field::equal_fields_propagator() from transforming a`
	`3051`	`+ zerofill argument into a string constant. Such a change would`
	`3052`	`+ require rebuilding cmp_items.`
	`3053`	`+ */`
	`3054`	`+ for (i= 0; i < ncases; i+= 2)`
	`3055`	`+ args[i]->cmp_context= item_cmp_type(left_result_type,`
	`3056`	`+ args[i]->result_type());`
`3048`	`3057`	`}`
`3049`	`3058`
`3050`	`3059`	`if (else_expr_num == -1 \|\| args[else_expr_num]->maybe_null)`
`@@ -4032,6 +4041,16 @@ void Item_func_in::fix_length_and_dec()`
`4032`	`4041`	`}`
`4033`	`4042`	`}`
`4034`	`4043`	`}`
	`4044`	`+ /*`
	`4045`	`+ Set cmp_context of all arguments. This prevents`
	`4046`	`+ Item_field::equal_fields_propagator() from transforming a zerofill integer`
	`4047`	`+ argument into a string constant. Such a change would require rebuilding`
	`4048`	`+ cmp_itmes.`
	`4049`	`+ */`
	`4050`	`+ for (arg= args + 1, arg_end= args + arg_count; arg != arg_end ; arg++)`
	`4051`	`+ {`
	`4052`	`+ arg[0]->cmp_context= item_cmp_type(left_result_type, arg[0]->result_type());`
	`4053`	`+ }`
`4035`	`4054`	`max_length= 1;`
`4036`	`4055`	`}`
`4037`	`4056`