
Bug #16347343 : CRASH, GROUP_CONCAT, DERIVED TABLES
      
Problem:
A select query inside a group_concat function having an 
outer reference results in a crash.
      
Analysis:
In function Item_group_concat::add, we do not check if 
return value of get_tmp_table_field can be NULL for 
a non-const item. This can happen for a query with a 
outer reference.
While resolving the outer reference in the query present
inside group_concat function, we set the "const_item_cache" 
to false. As a result in the call to const_item() from 
Item_func_group_concat::add, it returns false and goes on 
to check if this can be NULL resulting in the crash.
get_tmp_table_field does not return NULL for Items of type 
Item_field, Item_result_field and Item_ref. 
For all other items, it returns NULL. 
     
Solution:
Check for the return value of get_tmp_table_field before we 
access field contents.

sql/item_sum.cc:
  Check for the return value of get_tmp_table_field before accessing

natsys/mariadb_10.2,ollie314/server,davidl-zend/zenddbi,flynn1973/mariadb-aix,ollie314/server,davidl-zend/zenddbi,flynn1973/mariadb-aix,davidl-zend/zenddbi,davidl-zend/zenddbi,ollie314/server,flynn1973/mariadb-aix,ollie314/server,ollie314/server,slanterns/server,ollie314/server,natsys/mariadb_10.2,natsys/mariadb_10.2,davidl-zend/zenddbi,flynn1973/mariadb-aix,davidl-zend/zenddbi,davidl-zend/zenddbi,natsys/mariadb_10.2,ollie314/server,natsys/mariadb_10.2,natsys/mariadb_10.2,flynn1973/mariadb-aix,flynn1973/mariadb-aix,flynn1973/mariadb-aix,natsys/mariadb_10.2,flynn1973/mariadb-aix,davidl-zend/zenddbi,flynn1973/mariadb-aix,davidl-zend/zenddbi,ollie314/server,davidl-zend/zenddbi,davidl-zend/zenddbi,ollie314/server,natsys/mariadb_10.2,natsys/mariadb_10.2,natsys/mariadb_10.2,natsys/mariadb_10.2,flynn1973/mariadb-aix,flynn1973/mariadb-aix,ollie314/server,ollie314/server