[MDEV-12060] Crash in EXECUTE IMMEDIATE with an expression returning a GRANT command - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.1(EOL), 10.2(EOL)
Fix Version/s: 10.1.34, 10.2.16, 10.3.8, 10.4.0
Component/s: Prepared Statements
Labels:
None

Sprint:
10.1.22

Description

I create a role and a procedure p1:

CREATE ROLE IF NOT EXISTS testrole;

DELIMITER /

CREATE OR REPLACE PROCEDURE p1()

BEGIN

END;

DELIMITER ;

Now I create a procedure p2 and execute it. It works fine:

DELIMITER /

CREATE OR REPLACE PROCEDURE p2 (IN wgrp  VARCHAR(10))

BEGIN

  DECLARE wcmd VARCHAR(200);

  set wcmd=concat('GRANT EXECUTE ON PROCEDURE p1 TO ',wgrp);

  -- This works fine

  EXECUTE IMMEDIATE wcmd;

 END;

DELIMITER ;

CALL p2('testrole');

Now I change the procedure body slightly and re-run it. It crashes:

DELIMITER /

CREATE OR REPLACE PROCEDURE p2 (wgrp  VARCHAR(10))

BEGIN

  -- assertion failed

  EXECUTE IMMEDIATE concat('GRANT EXECUTE ON PROCEDURE p1 TO ',wgrp);

END;

DELIMITER ;

CALL p2('testrole');

This procedure also crashes:

DELIMITER /

CREATE OR REPLACE PROCEDURE p2 ()

BEGIN

  EXECUTE IMMEDIATE concat(_utf8'GRANT EXECUTE ON PROCEDURE p1 TO ',_latin1'testrole');

END;

DELIMITER ;

CALL p2();

So does this one:

DELIMITER /

CREATE OR REPLACE PROCEDURE p2 ()

BEGIN

  PREPARE stmt FROM concat(_utf8'GRANT EXECUTE ON PROCEDURE p1 TO ',_latin1' testrole');

  EXECUTE stmt;

  DEALLOCATE PREPARE stmt;

END;

DELIMITER ;

CALL p2();

Attachments

Issue Links

relates to

MDEV-14603 signal 11 with short stacktrace

Closed

Activity

Ascending order - Click to sort in descending order

Alexander Barkov created issue - 2017-02-14 08:52

Alexander Barkov made changes - 2017-02-14 13:08

Field	Original Value	New Value
Description	I create a role and a procedure p1: {code:sql} CREATE ROLE IF NOT EXISTS testrole; DELIMITER / CREATE OR REPLACE PROCEDURE p1() BEGIN END; / DELIMITER ; {code} Now I create a procedure p2 and execute it. It works fine: {code:sql} DELIMITER / CREATE OR REPLACE PROCEDURE p2 (IN wgrp VARCHAR(10)) BEGIN DECLARE wcmd VARCHAR(200); set wcmd=concat('GRANT EXECUTE ON PROCEDURE p1 TO ',wgrp); -- This works fine EXECUTE IMMEDIATE wcmd; END; / DELIMITER ; CALL p2('testrole'); {code} Now I change the procedure body slightly and re-run it. It crashes: {code:sql} DELIMITER / CREATE OR REPLACE PROCEDURE p2 (wgrp VARCHAR(10)) BEGIN -- assertion failed EXECUTE IMMEDIATE concat('GRANT EXECUTE ON PROCEDURE p1 TO ',wgrp); END; / DELIMITER ; CALL p2('testrole'); {code}	I create a role and a procedure p1: {code:sql} CREATE ROLE IF NOT EXISTS testrole; DELIMITER / CREATE OR REPLACE PROCEDURE p1() BEGIN END; / DELIMITER ; {code} Now I create a procedure p2 and execute it. It works fine: {code:sql} DELIMITER / CREATE OR REPLACE PROCEDURE p2 (IN wgrp VARCHAR(10)) BEGIN DECLARE wcmd VARCHAR(200); set wcmd=concat('GRANT EXECUTE ON PROCEDURE p1 TO ',wgrp); -- This works fine EXECUTE IMMEDIATE wcmd; END; / DELIMITER ; CALL p2('testrole'); {code} Now I change the procedure body slightly and re-run it. It crashes: {code:sql} DELIMITER / CREATE OR REPLACE PROCEDURE p2 (wgrp VARCHAR(10)) BEGIN -- assertion failed EXECUTE IMMEDIATE concat('GRANT EXECUTE ON PROCEDURE p1 TO ',wgrp); END; / DELIMITER ; CALL p2('testrole'); {code} This procedure also crashes: {code:sql} DELIMITER / CREATE OR REPLACE PROCEDURE p2 () BEGIN EXECUTE IMMEDIATE concat(_utf8'GRANT EXECUTE ON PROCEDURE p1 TO ',_latin1'testrole'); END; / DELIMITER ; CALL p2(); {code}

Alexander Barkov made changes - 2017-02-14 13:22

Description

I create a role and a procedure p1:
{code:sql}
CREATE ROLE IF NOT EXISTS testrole;
DELIMITER /
CREATE OR REPLACE PROCEDURE p1()
BEGIN
END;
/
DELIMITER ;
{code}

Now I create a procedure p2 and execute it. It works fine:
{code:sql}
DELIMITER /
CREATE OR REPLACE PROCEDURE p2 (IN wgrp VARCHAR(10))
BEGIN
  DECLARE wcmd VARCHAR(200);
  set wcmd=concat('GRANT EXECUTE ON PROCEDURE p1 TO ',wgrp);
  -- This works fine
  EXECUTE IMMEDIATE wcmd;
END;
/
DELIMITER ;
CALL p2('testrole');
{code}

Now I change the procedure body slightly and re-run it. It crashes:
{code:sql}
DELIMITER /
CREATE OR REPLACE PROCEDURE p2 (wgrp VARCHAR(10))
BEGIN
  -- assertion failed
  EXECUTE IMMEDIATE concat('GRANT EXECUTE ON PROCEDURE p1 TO ',wgrp);
END;
/
DELIMITER ;
CALL p2('testrole');
{code}

This procedure also crashes:
{code:sql}
DELIMITER /
CREATE OR REPLACE PROCEDURE p2 ()
BEGIN
  EXECUTE IMMEDIATE concat(_utf8'GRANT EXECUTE ON PROCEDURE p1 TO ',_latin1'testrole');
END;
/
DELIMITER ;
CALL p2();
{code}

Alexander Barkov added a comment - 2017-02-15 10:36

The same problem is repeatable in 10.1:

DELIMITER /

CREATE OR REPLACE PROCEDURE p2 ()

BEGIN

  SET STATEMENT join_cache_level=CAST(CONCAT(_utf8'6',_latin1'') AS INT) FOR PREPARE stmt FROM 'SELECT 1';

  EXECUTE stmt;

  DEALLOCATE PREPARE stmt;

END;

DELIMITER ;

CALL p2();

Alexander Barkov added a comment - 2017-02-15 10:36 The same problem is repeatable in 10.1: DELIMITER / CREATE OR REPLACE PROCEDURE p2 () BEGIN SET STATEMENT join_cache_level= CAST (CONCAT(_utf8 '6' ,_latin1 '' ) AS INT ) FOR PREPARE stmt FROM 'SELECT 1' ; EXECUTE stmt; DEALLOCATE PREPARE stmt; END ; / DELIMITER ; CALL p2();

Alexander Barkov made changes - 2017-02-15 10:36

Affects Version/s

10.1 [ 16100 ]

Alexander Barkov made changes - 2017-02-15 10:36

Fix Version/s		10.1 [ 16100 ]
Fix Version/s	10.2 [ 14601 ]

Rasmus Johansson (Inactive) made changes - 2017-03-02 12:38

Sprint

10.1.22 [ 143 ]

Alexander Barkov added a comment - 2018-06-11 12:35 - edited

The same problem is repeatable (in 10.1) with an anonymous block, with a SET STATEMENT..PREPARE, which creates a character set conversion Item at the SET STATEMENT stage:

DELIMITER /

BEGIN NOT ATOMIC

  SET STATEMENT join_cache_level=CAST(CONCAT(_utf8'6',_latin1'') AS INT) FOR PREPARE stmt FROM 'SELECT 1';

  EXECUTE stmt;

  DEALLOCATE PREPARE stmt;

END;

DELIMITER ;

Note, EXECUTE is not needed. It crashes just with PREPARE:

DELIMITER /

BEGIN NOT ATOMIC

  SET STATEMENT join_cache_level=CAST(CONCAT(_utf8'6',_latin1'') AS INT) FOR PREPARE stmt FROM 'SELECT 1';

  DEALLOCATE PREPARE stmt;

END;

DELIMITER ;

The problem is also repeatable with SET STATEMENT..EXECUTE:

DELIMITER /

BEGIN NOT ATOMIC

  PREPARE stmt FROM 'SELECT 1';

  SET STATEMENT join_cache_level=CAST(CONCAT(_utf8'6',_latin1'') AS INT) FOR EXECUTE stmt;

  DEALLOCATE PREPARE stmt;

END;

DELIMITER ;

Alexander Barkov added a comment - 2018-06-11 12:35 - edited The same problem is repeatable (in 10.1) with an anonymous block, with a SET STATEMENT..PREPARE , which creates a character set conversion Item at the SET STATEMENT stage: DELIMITER / BEGIN NOT ATOMIC SET STATEMENT join_cache_level= CAST (CONCAT(_utf8 '6' ,_latin1 '' ) AS INT ) FOR PREPARE stmt FROM 'SELECT 1' ; EXECUTE stmt; DEALLOCATE PREPARE stmt; END ; / DELIMITER ; Note, EXECUTE is not needed. It crashes just with PREPARE : DELIMITER / BEGIN NOT ATOMIC SET STATEMENT join_cache_level= CAST (CONCAT(_utf8 '6' ,_latin1 '' ) AS INT ) FOR PREPARE stmt FROM 'SELECT 1' ; DEALLOCATE PREPARE stmt; END ; / DELIMITER ; The problem is also repeatable with SET STATEMENT..EXECUTE : DELIMITER / BEGIN NOT ATOMIC PREPARE stmt FROM 'SELECT 1' ; SET STATEMENT join_cache_level= CAST (CONCAT(_utf8 '6' ,_latin1 '' ) AS INT ) FOR EXECUTE stmt; DEALLOCATE PREPARE stmt; END ; / DELIMITER ;

Alexander Barkov made changes - 2018-06-12 03:42

Link

This issue relates to ~~MDEV-14603~~ [ ~~MDEV-14603~~ ]

Alexander Barkov made changes - 2018-06-12 10:13

issue.field.resolutiondate

2018-06-12 10:13:46.0

2018-06-12 10:13:46.05

Alexander Barkov made changes - 2018-06-12 10:13

Component/s		Prepared Statements [ 10804 ]
Fix Version/s		10.1.34 [ 23100 ]
Fix Version/s		10.2.16 [ 23110 ]
Fix Version/s		10.3.8 [ 23113 ]
Fix Version/s		10.4.0 [ 23115 ]
Fix Version/s	10.1 [ 16100 ]
Resolution		Fixed [ 1 ]
Status	Open [ 1 ]	Closed [ 6 ]

Sergei Golubchik made changes - 2021-12-06 21:44

Workflow

MariaDB v3 [ 79635 ]

MariaDB v4 [ 151706 ]

People

Assignee:: Alexander Barkov

Reporter:: Alexander Barkov

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2017-02-14 08:52

Updated:: 2018-06-12 10:13

Resolved:: 2018-06-12 10:13

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server

Details

Description

Attachments

Issue Links

Activity

People

Dates

Git Integration