[MDEV-16054] simple json functions flatline cpu on garbage input - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.3.6, 10.2(EOL), 10.3(EOL)
Fix Version/s: 10.2.17
Component/s: JSON
Labels:
None
Environment:
Win x64

Description

MariaDB [(none)]> select * from information_schema.processlist where user<>'system user' and id<>connection_id()\G

*************************** 1. row ***************************

             ID: 8

           USER: root

           HOST:

             DB: test

        COMMAND: Query

           TIME: 121

          STATE: NULL

           INFO: do json_array(1,uuid(),compress(5.140264e+307))

        TIME_MS: 121143.104

          STAGE: 0

      MAX_STAGE: 0

       PROGRESS: 0.000

    MEMORY_USED: 76104

MAX_MEMORY_USED: 76104

  EXAMINED_ROWS: 0

       QUERY_ID: 1

    INFO_BINARY: do json_array(1,uuid(),compress(5.140264e+307))

            TID: 0

1 row in set (0.002 sec)

How to Repeat:

do json_array(1,uuid(),compress(5.140264e+307));

Attachments

Activity

Ascending order - Click to sort in descending order

sbester1 created issue - 2018-04-27 17:23

sbester1 made changes - 2018-04-27 17:24

Field	Original Value	New Value
Description	{noformat} MariaDB [(none)]> select * from information_schema.processlist where user<>'system user' and id<>connection_id()\G ************************* 1. row ************************* ID: 8 USER: root HOST: DB: test COMMAND: Query TIME: 121 STATE: NULL INFO: do json_array(1,uuid(),compress(5.140264e+307)) TIME_MS: 121143.104 STAGE: 0 MAX_STAGE: 0 PROGRESS: 0.000 MEMORY_USED: 76104 MAX_MEMORY_USED: 76104 EXAMINED_ROWS: 0 QUERY_ID: 1 INFO_BINARY: do json_array(1,uuid(),compress(5.140264e+307)) TID: 0 1 row in set (0.002 sec) {noformat} {code:sql} do json_array(1,uuid(),compress(5.140264e+307)); {code}	{noformat} MariaDB [(none)]> select * from information_schema.processlist where user<>'system user' and id<>connection_id()\G ************************* 1. row ************************* ID: 8 USER: root HOST: DB: test COMMAND: Query TIME: 121 STATE: NULL INFO: do json_array(1,uuid(),compress(5.140264e+307)) TIME_MS: 121143.104 STAGE: 0 MAX_STAGE: 0 PROGRESS: 0.000 MEMORY_USED: 76104 MAX_MEMORY_USED: 76104 EXAMINED_ROWS: 0 QUERY_ID: 1 INFO_BINARY: do json_array(1,uuid(),compress(5.140264e+307)) TID: 0 1 row in set (0.002 sec) {noformat} +How to Repeat:+ {code:sql} do json_array(1,uuid(),compress(5.140264e+307)); {code}

Elena Stepanova made changes - 2018-04-27 23:32

Status

Open [ 1 ]

Confirmed [ 10101 ]

Elena Stepanova added a comment - 2018-04-27 23:34

Thanks for the report and test case.

10.3 6c5e60f1b1
Thread 2 (Thread 0x7f90c24d8700 (LWP 28367)):
#0 json_escape (str_cs=0x557d71c8b1c0 <my_charset_utf8_general_ci>, str=0x7f90b0037fc5 "\234\063\325\063\064\061\060\062\063I560\a", str_end=0x7f90b0037fd8 "f0038c3", json_cs=0x557d71ad9000 <my_charset_bin>, json=0x7f90c24d60d2 "\001\260\003", json_end=0x7f90c24d61dd "\031") at /data/src/10.3/strings/json_lib.c:1582
#1 0x0000557d70a1a274 in st_append_escaped (s=0x7f90c24d6070, a=0x7f90b0015448) at /data/src/10.3/sql/item_jsonfunc.cc:102
#2 0x0000557d70a1e0eb in append_json_value (str=0x7f90c24d6070, item=0x7f90b0015250, tmp_val=0x7f90b0015448) at /data/src/10.3/sql/item_jsonfunc.cc:1432
#3 0x0000557d70a1e484 in Item_func_json_array::val_str (this=0x7f90b0015388, str=0x7f90c24d6070) at /data/src/10.3/sql/item_jsonfunc.cc:1500
#4 0x0000557d70541652 in Item_str_func::update_null_value (this=0x7f90b0015388) at /data/src/10.3/sql/item_strfunc.h:73
#5 0x0000557d705059bf in Item_func::is_null (this=0x7f90b0015388) at /data/src/10.3/sql/item_func.h:172
#6 0x0000557d709df9dc in mysql_do (thd=0x7f90b0000b00, values=...) at /data/src/10.3/sql/sql_do.cc:35
#7 0x0000557d7055853d in mysql_execute_command (thd=0x7f90b0000b00) at /data/src/10.3/sql/sql_parse.cc:3797
#8 0x0000557d70565706 in mysql_parse (thd=0x7f90b0000b00, rawbuf=0x7f90b0014eb0 "do json_array(1,uuid(),compress(5.140264e+307))", length=47, parser_state=0x7f90c24d75d0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:8001
#9 0x0000557d70552ee9 in dispatch_command (command=COM_QUERY, thd=0x7f90b0000b00, packet=0x7f90b008ff91 "do json_array(1,uuid(),compress(5.140264e+307))", packet_length=47, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1846
#10 0x0000557d70551928 in do_command (thd=0x7f90b0000b00) at /data/src/10.3/sql/sql_parse.cc:1391
#11 0x0000557d706b488d in do_handle_one_connection (connect=0x557d73338270) at /data/src/10.3/sql/sql_connect.cc:1402
#12 0x0000557d706b461a in handle_one_connection (arg=0x557d73338270) at /data/src/10.3/sql/sql_connect.cc:1308
#13 0x0000557d70b38f55 in pfs_spawn_thread (arg=0x557d733fa6e0) at /data/src/10.3/storage/perfschema/pfs.cc:1862
#14 0x00007f90ca007494 in start_thread (arg=0x7f90c24d8700) at pthread_create.c:333
#15 0x00007f90c83ed93f in clone () from /lib/x86_64-linux-gnu/libc.so.6

Elena Stepanova added a comment - 2018-04-27 23:34 Thanks for the report and test case. 10.3 6c5e60f1b1 Thread 2 (Thread 0x7f90c24d8700 (LWP 28367)): #0 json_escape (str_cs=0x557d71c8b1c0 <my_charset_utf8_general_ci>, str=0x7f90b0037fc5 "\234\063\325\063\064\061\060\062\063I560\a", str_end=0x7f90b0037fd8 "f0038c3", json_cs=0x557d71ad9000 <my_charset_bin>, json=0x7f90c24d60d2 "\001\260\003", json_end=0x7f90c24d61dd "\031") at /data/src/10.3/strings/json_lib.c:1582 #1 0x0000557d70a1a274 in st_append_escaped (s=0x7f90c24d6070, a=0x7f90b0015448) at /data/src/10.3/sql/item_jsonfunc.cc:102 #2 0x0000557d70a1e0eb in append_json_value (str=0x7f90c24d6070, item=0x7f90b0015250, tmp_val=0x7f90b0015448) at /data/src/10.3/sql/item_jsonfunc.cc:1432 #3 0x0000557d70a1e484 in Item_func_json_array::val_str (this=0x7f90b0015388, str=0x7f90c24d6070) at /data/src/10.3/sql/item_jsonfunc.cc:1500 #4 0x0000557d70541652 in Item_str_func::update_null_value (this=0x7f90b0015388) at /data/src/10.3/sql/item_strfunc.h:73 #5 0x0000557d705059bf in Item_func::is_null (this=0x7f90b0015388) at /data/src/10.3/sql/item_func.h:172 #6 0x0000557d709df9dc in mysql_do (thd=0x7f90b0000b00, values=...) at /data/src/10.3/sql/sql_do.cc:35 #7 0x0000557d7055853d in mysql_execute_command (thd=0x7f90b0000b00) at /data/src/10.3/sql/sql_parse.cc:3797 #8 0x0000557d70565706 in mysql_parse (thd=0x7f90b0000b00, rawbuf=0x7f90b0014eb0 "do json_array(1,uuid(),compress(5.140264e+307))", length=47, parser_state=0x7f90c24d75d0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:8001 #9 0x0000557d70552ee9 in dispatch_command (command=COM_QUERY, thd=0x7f90b0000b00, packet=0x7f90b008ff91 "do json_array(1,uuid(),compress(5.140264e+307))", packet_length=47, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1846 #10 0x0000557d70551928 in do_command (thd=0x7f90b0000b00) at /data/src/10.3/sql/sql_parse.cc:1391 #11 0x0000557d706b488d in do_handle_one_connection (connect=0x557d73338270) at /data/src/10.3/sql/sql_connect.cc:1402 #12 0x0000557d706b461a in handle_one_connection (arg=0x557d73338270) at /data/src/10.3/sql/sql_connect.cc:1308 #13 0x0000557d70b38f55 in pfs_spawn_thread (arg=0x557d733fa6e0) at /data/src/10.3/storage/perfschema/pfs.cc:1862 #14 0x00007f90ca007494 in start_thread (arg=0x7f90c24d8700) at pthread_create.c:333 #15 0x00007f90c83ed93f in clone () from /lib/x86_64-linux-gnu/libc.so.6

Elena Stepanova made changes - 2018-04-27 23:34

Fix Version/s		10.2 [ 14601 ]
Fix Version/s		10.3 [ 22126 ]
Affects Version/s		10.2 [ 14601 ]
Affects Version/s		10.3 [ 22126 ]
Assignee		Alexey Botchkov [ holyfoot ]

Alexey Botchkov made changes - 2018-07-31 12:15

Status

Confirmed [ 10101 ]

In Progress [ 3 ]

Alexey Botchkov added a comment - 2018-07-31 13:08

http://lists.askmonty.org/pipermail/commits/2018-July/012745.html

Alexey Botchkov added a comment - 2018-07-31 13:08 http://lists.askmonty.org/pipermail/commits/2018-July/012745.html

Alexey Botchkov made changes - 2018-07-31 13:08

issue.field.resolutiondate

2018-07-31 13:08:33.0

2018-07-31 13:08:33.654

Alexey Botchkov made changes - 2018-07-31 13:08

Fix Version/s		10.2.17 [ 23111 ]
Fix Version/s	10.2 [ 14601 ]
Fix Version/s	10.3 [ 22126 ]
Resolution		Fixed [ 1 ]
Status	In Progress [ 3 ]	Closed [ 6 ]

Sergei Golubchik made changes - 2021-12-06 21:47

Workflow

MariaDB v3 [ 86846 ]

MariaDB v4 [ 154278 ]

People

Assignee:: Alexey Botchkov

Reporter:: sbester1

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 2018-04-27 17:23

Updated:: 2018-07-31 13:08

Resolved:: 2018-07-31 13:08

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server