MDEV-35975 Server crashes after CREATE VIEW as SELECT ST_COLLECT...

Ensure that orig_args is populated during Item_func_collect::fix_fields_impl
MariaDB · Jan 29, 2025 · 26eefee · 26eefee
1 parent fa3f261
commit 26eefee
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 0 deletions.
diff --git a/mysql-test/main/spatial_utility_function_collect.result b/mysql-test/main/spatial_utility_function_collect.result
@@ -135,3 +135,10 @@ tb1	CREATE TABLE `tb1` (
   `(ST_collect(( POINTFROMTEXT(' POINT( 4 1 ) ') )) )` geometry DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 DROP TABLE tb1;
+#
+# MDEV-35975 Server crashes after CREATE VIEW as SELECT ST_COLLECT
+#
+create view v1 as SELECT ST_COLLECT(ST_GEOMFROMTEXT('POINT(0 0)'));
+drop view v1;
+create view v1 as SELECT GROUP_CONCAT(ST_GEOMFROMTEXT('POINT(0 0)'));
+drop view v1;
diff --git a/mysql-test/main/spatial_utility_function_collect.test b/mysql-test/main/spatial_utility_function_collect.test
@@ -197,3 +197,11 @@ SELECT ST_astext(ST_collect(( POINTFROMTEXT(' POINT( 4 1 ) ') )));
 CREATE TABLE tb1 AS SELECT (ST_collect(( POINTFROMTEXT(' POINT( 4 1 ) ') )) );
 SHOW CREATE TABLE tb1;
 DROP TABLE tb1;
+
+--echo #
+--echo # MDEV-35975 Server crashes after CREATE VIEW as SELECT ST_COLLECT
+--echo #
+create view v1 as SELECT ST_COLLECT(ST_GEOMFROMTEXT('POINT(0 0)'));
+drop view v1;
+create view v1 as SELECT GROUP_CONCAT(ST_GEOMFROMTEXT('POINT(0 0)'));
+drop view v1;
diff --git a/sql/item_sum.cc b/sql/item_sum.cc
@@ -4818,6 +4818,8 @@ const Type_handler *Item_func_collect::type_handler() const
 
 bool Item_func_collect::fix_fields_impl(THD *thd,Item **)
 {
+  if (arg_count)
+    memcpy (orig_args, args, sizeof (Item *) * arg_count);
   max_length= UINT_MAX32;
   return FALSE;
 }