[MDEV-12060] Crash in EXECUTE IMMEDIATE with an expression returning a GRANT command - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.1(EOL), 10.2(EOL)
Fix Version/s: 10.1.34, 10.2.16, 10.3.8, 10.4.0
Component/s: Prepared Statements
Labels:
None

Sprint:
10.1.22

Description

I create a role and a procedure p1:

CREATE ROLE IF NOT EXISTS testrole;

DELIMITER /

CREATE OR REPLACE PROCEDURE p1()

BEGIN

END;

DELIMITER ;

Now I create a procedure p2 and execute it. It works fine:

DELIMITER /

CREATE OR REPLACE PROCEDURE p2 (IN wgrp  VARCHAR(10))

BEGIN

  DECLARE wcmd VARCHAR(200);

  set wcmd=concat('GRANT EXECUTE ON PROCEDURE p1 TO ',wgrp);

  -- This works fine

  EXECUTE IMMEDIATE wcmd;

 END;

DELIMITER ;

CALL p2('testrole');

Now I change the procedure body slightly and re-run it. It crashes:

DELIMITER /

CREATE OR REPLACE PROCEDURE p2 (wgrp  VARCHAR(10))

BEGIN

  -- assertion failed

  EXECUTE IMMEDIATE concat('GRANT EXECUTE ON PROCEDURE p1 TO ',wgrp);

END;

DELIMITER ;

CALL p2('testrole');

This procedure also crashes:

DELIMITER /

CREATE OR REPLACE PROCEDURE p2 ()

BEGIN

  EXECUTE IMMEDIATE concat(_utf8'GRANT EXECUTE ON PROCEDURE p1 TO ',_latin1'testrole');

END;

DELIMITER ;

CALL p2();

So does this one:

DELIMITER /

CREATE OR REPLACE PROCEDURE p2 ()

BEGIN

  PREPARE stmt FROM concat(_utf8'GRANT EXECUTE ON PROCEDURE p1 TO ',_latin1' testrole');

  EXECUTE stmt;

  DEALLOCATE PREPARE stmt;

END;

DELIMITER ;

CALL p2();

Attachments

Issue Links

relates to

MDEV-14603 signal 11 with short stacktrace

Closed

Activity

Ascending order - Click to sort in descending order

Alexander Barkov added a comment - 2017-02-15 10:36

The same problem is repeatable in 10.1:

DELIMITER /

CREATE OR REPLACE PROCEDURE p2 ()

BEGIN

  SET STATEMENT join_cache_level=CAST(CONCAT(_utf8'6',_latin1'') AS INT) FOR PREPARE stmt FROM 'SELECT 1';

  EXECUTE stmt;

  DEALLOCATE PREPARE stmt;

END;

DELIMITER ;

CALL p2();

Alexander Barkov added a comment - 2017-02-15 10:36 The same problem is repeatable in 10.1: DELIMITER / CREATE OR REPLACE PROCEDURE p2 () BEGIN SET STATEMENT join_cache_level= CAST (CONCAT(_utf8 '6' ,_latin1 '' ) AS INT ) FOR PREPARE stmt FROM 'SELECT 1' ; EXECUTE stmt; DEALLOCATE PREPARE stmt; END ; / DELIMITER ; CALL p2();

Alexander Barkov added a comment - 2018-06-11 12:35 - edited

The same problem is repeatable (in 10.1) with an anonymous block, with a SET STATEMENT..PREPARE, which creates a character set conversion Item at the SET STATEMENT stage:

DELIMITER /

BEGIN NOT ATOMIC

  SET STATEMENT join_cache_level=CAST(CONCAT(_utf8'6',_latin1'') AS INT) FOR PREPARE stmt FROM 'SELECT 1';

  EXECUTE stmt;

  DEALLOCATE PREPARE stmt;

END;

DELIMITER ;

Note, EXECUTE is not needed. It crashes just with PREPARE:

DELIMITER /

BEGIN NOT ATOMIC

  SET STATEMENT join_cache_level=CAST(CONCAT(_utf8'6',_latin1'') AS INT) FOR PREPARE stmt FROM 'SELECT 1';

  DEALLOCATE PREPARE stmt;

END;

DELIMITER ;

The problem is also repeatable with SET STATEMENT..EXECUTE:

DELIMITER /

BEGIN NOT ATOMIC

  PREPARE stmt FROM 'SELECT 1';

  SET STATEMENT join_cache_level=CAST(CONCAT(_utf8'6',_latin1'') AS INT) FOR EXECUTE stmt;

  DEALLOCATE PREPARE stmt;

END;

DELIMITER ;

Alexander Barkov added a comment - 2018-06-11 12:35 - edited The same problem is repeatable (in 10.1) with an anonymous block, with a SET STATEMENT..PREPARE , which creates a character set conversion Item at the SET STATEMENT stage: DELIMITER / BEGIN NOT ATOMIC SET STATEMENT join_cache_level= CAST (CONCAT(_utf8 '6' ,_latin1 '' ) AS INT ) FOR PREPARE stmt FROM 'SELECT 1' ; EXECUTE stmt; DEALLOCATE PREPARE stmt; END ; / DELIMITER ; Note, EXECUTE is not needed. It crashes just with PREPARE : DELIMITER / BEGIN NOT ATOMIC SET STATEMENT join_cache_level= CAST (CONCAT(_utf8 '6' ,_latin1 '' ) AS INT ) FOR PREPARE stmt FROM 'SELECT 1' ; DEALLOCATE PREPARE stmt; END ; / DELIMITER ; The problem is also repeatable with SET STATEMENT..EXECUTE : DELIMITER / BEGIN NOT ATOMIC PREPARE stmt FROM 'SELECT 1' ; SET STATEMENT join_cache_level= CAST (CONCAT(_utf8 '6' ,_latin1 '' ) AS INT ) FOR EXECUTE stmt; DEALLOCATE PREPARE stmt; END ; / DELIMITER ;

People

Assignee:: Alexander Barkov

Reporter:: Alexander Barkov

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2017-02-14 08:52

Updated:: 2018-06-12 10:13

Resolved:: 2018-06-12 10:13

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server