Skip to content

MDEV-40237: Partition info nullptr dereference#5366

Open
grooverdan wants to merge 1 commit into
MariaDB:11.8from
grooverdan:MDEV-40237
Open

MDEV-40237: Partition info nullptr dereference#5366
grooverdan wants to merge 1 commit into
MariaDB:11.8from
grooverdan:MDEV-40237

Conversation

@grooverdan

Copy link
Copy Markdown
Member

thd->lex is null in InnoDB purge thd. The Item_field can take a NULL context as a pointer for resolving field names.

thd->lex is null in InnoDB purge thd. The Item_field
can take a NULL context as a pointer for resolving
field names.
@grooverdan grooverdan requested a review from midenok July 9, 2026 08:17
@grooverdan grooverdan changed the title MDEV-40237: Parition info nullptr dereference MDEV-40237: Partition info nullptr dereference Jul 9, 2026

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a null check for thd->lex when initializing the name resolution context in partition_info::vers_fix_field_list. The review feedback correctly identifies that thd->lex->current_select could also be null, which would still result in a null pointer dereference. It is recommended to update the check to ensure both pointers are valid before accessing the context.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

Comment thread sql/partition_info.h
// needed in handle_list_of_fields()
row_end->flags|= GET_FIXED_FIELDS_FLAG;
Name_resolution_context *context= &thd->lex->current_select->context;
Name_resolution_context *context= thd->lex ? &thd->lex->current_select->context : nullptr;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The current check only guards against thd->lex being nullptr. However, if thd->lex is non-null but thd->lex->current_select is nullptr, accessing thd->lex->current_select->context will still result in a null pointer dereference (which matches the bug title: member access within null pointer of type 'SELECT_LEX').

To prevent this, we should also check if thd->lex->current_select is non-null before accessing its context member.

  Name_resolution_context *context= (thd->lex && thd->lex->current_select) ? &thd->lex->current_select->context : nullptr;

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant