Bug #20007383: HANDLE_FATAL_SIGNAL (SIG=11) IN UPDATE_REF_AND_KEYS.

mithuncy · mithuncy · commit f92dd6ae6fb8 · 2015-10-12T12:56:36.000+05:30
Issue:
======
The fulltext predicate is inside a subquery and involves
an outer reference; it thus cannot be used for FT index look-up,
but MySQL does not see it, which causes a illegal access.

Solution:
=========
Solution is backported from bug#21140088. Outer reference can
not be used as argument of the MATCH function. Added check for
outer reference.
diff --git a/mysql-test/r/fulltext.result b/mysql-test/r/fulltext.result
@@ -541,7 +541,7 @@ MATCH(a) AGAINST('aaa1* aaa14 aaa15 aaa16' IN BOOLEAN MODE)
 DROP TABLE t1;
 CREATE TABLE t1(a TEXT);
 SELECT GROUP_CONCAT(a) AS st FROM t1 HAVING MATCH(st) AGAINST('test' IN BOOLEAN MODE);
-ERROR HY000: Incorrect arguments to AGAINST
+ERROR HY000: Incorrect arguments to MATCH
 DROP TABLE t1;
 CREATE TABLE t1(a VARCHAR(64), FULLTEXT(a));
 INSERT INTO t1 VALUES('awrd bwrd cwrd'),('awrd bwrd cwrd'),('awrd bwrd cwrd');
diff --git a/sql/item_func.cc b/sql/item_func.cc
@@ -1,4 +1,4 @@
-/* Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.
+/* Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -5900,12 +5900,12 @@ bool Item_func_match::fix_fields(THD *thd, Item **ref)
   const_item_cache=0;
   for (uint i=1 ; i < arg_count ; i++)
   {
-    item=args[i];
-    if (item->type() == Item::REF_ITEM)
-      args[i]= item= *((Item_ref *)item)->ref;
-    if (item->type() != Item::FIELD_ITEM)
+    item= args[i]= args[i]->real_item();
+    if (item->type() != Item::FIELD_ITEM ||
+        /* Cannot use FTS index with outer table field */
+        (item->used_tables() & OUTER_REF_TABLE_BIT))
     {
-      my_error(ER_WRONG_ARGUMENTS, MYF(0), "AGAINST");
+      my_error(ER_WRONG_ARGUMENTS, MYF(0), "MATCH");
       return TRUE;
     }
   }

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-/* Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.`
	`1`	`+/* Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.`
`2`	`2`
`3`	`3`	`This program is free software; you can redistribute it and/or modify`
`4`	`4`	`it under the terms of the GNU General Public License as published by`
`@@ -5900,12 +5900,12 @@ bool Item_func_match::fix_fields(THD thd, Item *ref)`
`5900`	`5900`	`const_item_cache=0;`
`5901`	`5901`	`for (uint i=1 ; i < arg_count ; i++)`
`5902`	`5902`	`{`
`5903`		`- item=args[i];`
`5904`		`- if (item->type() == Item::REF_ITEM)`
`5905`		`- args[i]= item= ((Item_ref )item)->ref;`
`5906`		`- if (item->type() != Item::FIELD_ITEM)`
	`5903`	`+ item= args[i]= args[i]->real_item();`
	`5904`	`+ if (item->type() != Item::FIELD_ITEM \|\|`
	`5905`	`+ /* Cannot use FTS index with outer table field */`
	`5906`	`+ (item->used_tables() & OUTER_REF_TABLE_BIT))`
`5907`	`5907`	`{`
`5908`		`- my_error(ER_WRONG_ARGUMENTS, MYF(0), "AGAINST");`
	`5908`	`+ my_error(ER_WRONG_ARGUMENTS, MYF(0), "MATCH");`
`5909`	`5909`	`return TRUE;`
`5910`	`5910`	`}`
`5911`	`5911`	`}`