Merge lp:~linuxjedi/drizzle/drizzle-bug-628419 into lp:~drizzle-trunk/drizzle/development

[Andrew Hutchings]

A double free was possible during a range query cleanup

[Patrick Crews (patrick-crews)]

Retested with the randgen and was unable to crash Andrew's tree with multiple runs (standard + random seed values). Looks good to me.

review: Approve

=== modified file 'drizzled/optimizer/range.cc'
--- drizzled/optimizer/range.cc	2010-08-06 11:21:12 +0000
+++ drizzled/optimizer/range.cc	2010-09-07 13:36:10 +0000
@@ -385,8 +385,12 @@
 
 void optimizer::SqlSelect::cleanup()
 {
-  delete quick;
-  quick= 0;
+  if (quick)
+  {
+    delete quick;
+    quick= NULL;
+  }
+
   if (free_cond)
   {
     free_cond= 0;
@@ -641,8 +645,11 @@
 {
   uint32_t idx;
   double scan_time;
-  delete quick;
-  quick=0;
+  if (quick)
+  {
+    delete quick;
+    quick= NULL;
+  }
   needed_reg.reset();
   quick_keys.reset();
   if (keys_to_use.none())
@@ -858,8 +865,12 @@
       records= best_trp->records;
       if (! (quick= best_trp->make_quick(&param, true)) || quick->init())
       {
-        delete quick;
-        quick= NULL;
+        /* quick can already be free here */
+        if (quick)
+        {
+          delete quick;
+          quick= NULL;
+        }
       }
     }