MDEV-40006: Prepared Statement Crash in varchar_upper_cmp_transformer() for '?'#5370
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request addresses a crash during prepared statement execution when the character set is set to utf8mb4 (MDEV-40006) by adding a null check for the cloned item cl returned by deep_copy_with_checks in sql/opt_rewrite_remove_casefold.cc before dereferencing it. It also adds a corresponding test case to verify the fix. There are no review comments, so I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| # MDEV-40006: prepared statement execution crash when names is set to utf8mb4 | ||
| # | ||
| set names utf8mb4; | ||
| CREATE TABLE t ( |
There was a problem hiding this comment.
And fix trailing whitespaces.
| return this; | ||
| trace_upper_removal_rewrite(thd, this, res); | ||
| return res; | ||
| if (cl) |
There was a problem hiding this comment.
To minimize the patch I'd change this to
if (!cl)
return this;
|
suggested commit comment |
spetrunia
left a comment
spetrunia
left a comment
There was a problem hiding this comment.
Ok to push after all is addressed.
…() for '?' Item_func_in::varchar_upper_cmp_transformer() clones Item_func_in and its arguments and doesn't check if cloning has succeed. Item_param (PS parameter, '?') doesn't implement cloning so will return NULL from clone(). This will cause a crash. Fixed by making varchar_upper_cmp_transformer() check clone results for NULL. (Adding cloning support to Item_param is out of scope of this patch).
bsrikanth-mariadb
force-pushed
the
11.4-MDEV-40006-prepared-stmt-exec-crash-with-utf8mb4
branch
from
ef98ea3 to
40de612
Compare
bsrikanth-mariadb
changed the title
2 participants
MDEV-40006: Prepared Statement Crash in varchar_upper_cmp_transformer() for '?'
Item_func_in::varchar_upper_cmp_transformer() clones Item_func_in
and its arguments and doesn't check if cloning has succeed.
Item_param (PS parameter, '?') doesn't implement cloning so will return
NULL from clone(). This will cause a crash.
Fixed by making varchar_upper_cmp_transformer() check clone results for NULL.
(Adding cloning support to Item_param is out of scope of this patch).