MDEV-40237: Partition info nullptr dereference#5366
Conversation
thd->lex is null in InnoDB purge thd. The Item_field can take a NULL context as a pointer for resolving field names.
There was a problem hiding this comment.
Code Review
This pull request introduces a null check for thd->lex when initializing the name resolution context in partition_info::vers_fix_field_list. The review feedback correctly identifies that thd->lex->current_select could also be null, which would still result in a null pointer dereference. It is recommended to update the check to ensure both pointers are valid before accessing the context.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| // needed in handle_list_of_fields() | ||
| row_end->flags|= GET_FIXED_FIELDS_FLAG; | ||
| Name_resolution_context *context= &thd->lex->current_select->context; | ||
| Name_resolution_context *context= thd->lex ? &thd->lex->current_select->context : nullptr; |
There was a problem hiding this comment.
The current check only guards against thd->lex being nullptr. However, if thd->lex is non-null but thd->lex->current_select is nullptr, accessing thd->lex->current_select->context will still result in a null pointer dereference (which matches the bug title: member access within null pointer of type 'SELECT_LEX').
To prevent this, we should also check if thd->lex->current_select is non-null before accessing its context member.
Name_resolution_context *context= (thd->lex && thd->lex->current_select) ? &thd->lex->current_select->context : nullptr;
thd->lex is null in InnoDB purge thd. The Item_field can take a NULL context as a pointer for resolving field names.