From 0ba528fe56f6c637d9fbc9d177a62610038fd519 Mon Sep 17 00:00:00 2001
From: Sergei Golubchik <serg@mariadb.org>
Date: Wed, 18 May 2022 13:11:16 +0200
Subject: [PATCH] MDEV-28606 Server crashes in st_select_lex::add_table_to_list
 instead of error 1066: Not unique table/alias

10.2-only fix, 10.3+ uses LEX_STRING's and checks the length first
---
 mysql-test/r/parser.result | 8 ++++++++
 mysql-test/t/parser.test   | 9 +++++++++
 sql/sql_parse.cc           | 2 +-
 3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/mysql-test/r/parser.result b/mysql-test/r/parser.result
index e8bf9d12a3317..870bbfbf9049e 100644
--- a/mysql-test/r/parser.result
+++ b/mysql-test/r/parser.result
@@ -1409,5 +1409,13 @@ Database Collation	latin1_swedish_ci
 drop function a;
 set timestamp=default;
 #
+# MDEV-28606 Server crashes in st_select_lex::add_table_to_list instead of error 1066: Not unique table/alias
+#
+create table t1 (i int) ;
+insert into t1 values (1),(2),(3) ;
+with cte1 as (select i from t1) select i from cte1  natural join cte1;
+ERROR 42000: Not unique table/alias: 'cte1'
+drop table t1;
+#
 # End of 10.2 tests
 #
diff --git a/mysql-test/t/parser.test b/mysql-test/t/parser.test
index 095d274724bc9..4d35a53ecf628 100644
--- a/mysql-test/t/parser.test
+++ b/mysql-test/t/parser.test
@@ -1432,6 +1432,15 @@ query_vertical show create function a;
 drop function a;
 set timestamp=default;
 
+--echo #
+--echo # MDEV-28606 Server crashes in st_select_lex::add_table_to_list instead of error 1066: Not unique table/alias
+--echo #
+create table t1 (i int) ;
+insert into t1 values (1),(2),(3) ;
+--error 1066
+with cte1 as (select i from t1) select i from cte1  natural join cte1;
+drop table t1;
+
 --echo #
 --echo # End of 10.2 tests
 --echo #
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 457849a75690a..5295fb5e0aa14 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -8040,7 +8040,7 @@ TABLE_LIST *st_select_lex::add_table_to_list(THD *thd,
 	 tables=tables->next_local)
     {
       if (!my_strcasecmp(table_alias_charset, alias_str, tables->alias) &&
-	  !strcmp(ptr->db, tables->db))
+	  !strcmp(safe_str(ptr->db), safe_str(tables->db)))
       {
 	my_error(ER_NONUNIQ_TABLE, MYF(0), alias_str); /* purecov: tested */
 	DBUG_RETURN(0);				/* purecov: tested */