Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-25629

Crash in get_sort_by_table() in subquery with order by having outer ref

Details

    • Bug
    • Status: Closed (View Workflow)
    • Critical
    • Resolution: Fixed
    • 10.5.9, 5.5(EOL), 10.0(EOL), 10.1(EOL), 10.2(EOL), 10.3(EOL), 10.4(EOL), 10.5
    • 10.6.2, 10.2.39, 10.3.30, 10.4.20, 10.5.11
    • Optimizer
    • Ubuntu 18.04
      MariaDB 10.5.9

    Description

      I used my fuzzing tool to test Mariadb , and found a bug that can result in an abortion.

      Mariadb installation：
      1) cd mariadb-10.5.9
      2) mkdir build; cd build
      3) cmake -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_DEBUG=ON ../
      4) make -j8 && sudo make install

      How to Repeat:
      export ASAN_OPTIONS=detect_leaks=0
      /usr/local/mysql/bin/mysqld_safe &
      /usr/local/mysql/bin/mysql -uroot -p123456(your password)
      MariaDB> drop database if exists test_db;
      MariaDB> create database test_db;
      MariaDB> source fuzz.sql;

      I have simplified the content of fuzz.sql, and I hope fuzz.sql can help you reproduce the bug and fix it. In addition, I attach the abortion report (which has its stack trace).

      Attachments

        Issue Links

          links to

          Web Link CVE-2021-46657

          Activity

            Ascending order - Click to sort in descending order
            Zuming Jiang Zuming Jiang created issue -
            alice Alice Sherepa made changes -
            Field Original Value New Value
            Affects Version/s 5.5 [ 15800 ]
            Affects Version/s 10.1 [ 16100 ]
            Affects Version/s 10.2 [ 14601 ]
            Affects Version/s 10.3 [ 22126 ]
            Affects Version/s 10.4 [ 22408 ]
            Affects Version/s 10.5 [ 23123 ]
            Affects Version/s 10.0 [ 16000 ]
            alice Alice Sherepa made changes -
            Fix Version/s 10.2 [ 14601 ]
            Fix Version/s 10.3 [ 22126 ]
            Fix Version/s 10.4 [ 22408 ]
            Fix Version/s 10.5 [ 23123 ]
            alice Alice Sherepa made changes -
            Component/s Optimizer [ 10200 ]
            alice Alice Sherepa made changes -
            Assignee Igor Babaev [ igor ]
            alice Alice Sherepa made changes -
            Status Open [ 1 ] Confirmed [ 10101 ]
            alice Alice Sherepa made changes -
            Assignee Igor Babaev [ igor ] Sergei Golubchik [ serg ]
            alice Alice Sherepa made changes -
            Assignee Sergei Golubchik [ serg ] Sergei Petrunia [ psergey ]
            serg Sergei Golubchik made changes -
            Component/s Query Cache [ 10120 ]
            serg Sergei Golubchik made changes -
            Epic/Theme server
            psergei Sergei Petrunia made changes -
            Status Confirmed [ 10101 ] In Progress [ 3 ]
            psergei Sergei Petrunia made changes -
            Summary Bug report: abortion in sql/sql_plugin.cc:0 Crash in get_sort_by_table() in subquery with order by having outer ref
            psergei Sergei Petrunia made changes -
            Assignee Sergei Petrunia [ psergey ] Oleksandr Byelkin [ sanja ]
            Status In Progress [ 3 ] In Review [ 10002 ]
            sanja Oleksandr Byelkin made changes -
            Assignee Oleksandr Byelkin [ sanja ] Sergei Petrunia [ psergey ]
            Status In Review [ 10002 ] Stalled [ 10000 ]
            psergei Sergei Petrunia made changes -
            Fix Version/s 10.2.39 [ 25731 ]
            Fix Version/s 10.3.30 [ 25732 ]
            Fix Version/s 10.4.20 [ 25733 ]
            Fix Version/s 10.5.11 [ 25734 ]
            Fix Version/s 10.2 [ 14601 ]
            Fix Version/s 10.3 [ 22126 ]
            Fix Version/s 10.4 [ 22408 ]
            Fix Version/s 10.5 [ 23123 ]
            Resolution Fixed [ 1 ]
            Status Stalled [ 10000 ] Closed [ 6 ]
            psergei Sergei Petrunia made changes -
            Fix Version/s 10.6.1 [ 24437 ]
            marko Marko Mäkelä made changes -
            Fix Version/s 10.6.2 [ 25800 ]
            Fix Version/s 10.6.1 [ 24437 ]
            serg Sergei Golubchik made changes -
            Workflow MariaDB v3 [ 121706 ] MariaDB v4 [ 159253 ]
            serg Sergei Golubchik made changes -

            People

              psergei Sergei Petrunia
              Zuming Jiang Zuming Jiang
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.