37 lines
1.6 KiB
Diff
37 lines
1.6 KiB
Diff
# UNDF: UNDF-2026-000000177
|
|
--- a/sql/sql_base.cc
|
|
+++ b/sql/sql_base.cc
|
|
@@ -9376,8 +9376,12 @@ bool setup_fields(THD *thd, Access_bitmask want_privilege, bool allow_sum_func,
|
|
Ref_item_array ref = ref_item_array;
|
|
|
|
- for (auto it = fields->begin(); it != fields->end(); ++it) {
|
|
- const size_t old_size = fields->size();
|
|
- Item *item = *it;
|
|
+ // CWE-407 fix (mysql-0003): use index-based loop so that iterator
|
|
+ // recovery after split_sum_func() does not require an O(F) std::find
|
|
+ // scan. split_sum_func() only ever appends new items to the END of
|
|
+ // `fields`, so the index of the current item is stable; the loop
|
|
+ // re-evaluates fields->size() each iteration to pick up appended items.
|
|
+ for (size_t field_idx = 0; field_idx < fields->size(); ++field_idx) {
|
|
+ Item *item = (*fields)[field_idx];
|
|
assert(!item->hidden);
|
|
- Item **item_pos = &*it;
|
|
+ Item **item_pos = &(*fields)[field_idx];
|
|
if ((!item->fixed && item->fix_fields(thd, item_pos)) ||
|
|
(item = *item_pos)->check_cols(1)) {
|
|
DBUG_PRINT("info",
|
|
@@ -9460,9 +9464,7 @@ bool setup_fields(THD *thd, Access_bitmask want_privilege, bool allow_sum_func,
|
|
}
|
|
}
|
|
|
|
- select->select_list_tables |= item->used_tables();
|
|
-
|
|
- if (old_size != fields->size()) {
|
|
- // Items have been added (either by fix_fields or by split_sum_func), so
|
|
- // our iterator is invalidated. Reconstruct it.
|
|
- it = std::find(fields->begin(), fields->end(), item);
|
|
- }
|
|
+ select->select_list_tables |= item->used_tables();
|
|
+ // No iterator recovery needed: index loop is stable under append-only
|
|
+ // growth of fields (split_sum_func only appends to the back).
|
|
}
|