Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-25630

Crash with window function in left expr of IN subquery

Details

    Description

      I used my fuzzing tool to test Mariadb , and found a bug that can result in an abortion.

      Mariadb installation：
      1) cd mariadb-10.5.9
      2) mkdir build; cd build
      3) cmake -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_DEBUG=ON ../
      4) make -j8 && sudo make install

      How to Repeat:
      export ASAN_OPTIONS=detect_leaks=0
      /usr/local/mysql/bin/mysqld_safe &
      /usr/local/mysql/bin/mysql -uroot -p123456(your password)
      MariaDB> drop database if exists test_db;
      MariaDB> create database test_db;
      MariaDB> source fuzz.sql;

      I have simplified the content of fuzz.sql, and I hope fuzz.sql can help you reproduce the bug and fix it. In addition, I attach the abortion report (which has its stack trace).

      Attachments

        1. abortion_report.txt
          6 kB
          Zuming Jiang
        2. fuzz.sql
          0.8 kB
          Zuming Jiang

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-14791 Crash with order by expression containing window functions

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-28094 Window function in expression in ORDER BY

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          links to

          Web Link CVE-2021-46658

          Activity

            Ascending order - Click to sort in descending order
            View 8 older comments
            psergei Sergei Petrunia added a comment -

            ... and save_window_function_values() has the reverse logic:

              for (; (func = *func_ptr) ; func_ptr++)
            		 
              {
            		 
                if (func->with_window_func && func->type() != Item::WINDOW_FUNC_ITEM)
            		 
                  func->save_in_result_field(true);
            		 
              }

            It recomputes the values of items that have with_window_func=true, so it does
            not recompute the in-subquery.

            psergei Sergei Petrunia added a comment - ... and save_window_function_values() has the reverse logic: for (; (func = *func_ptr) ; func_ptr++) { if (func->with_window_func && func->type() != Item::WINDOW_FUNC_ITEM) func->save_in_result_field( true ); } It recomputes the values of items that have with_window_func=true, so it does not recompute the in-subquery.
            psergei Sergei Petrunia added a comment -

            http://lists.askmonty.org/pipermail/commits/2021-May/014627.html

            psergei Sergei Petrunia added a comment - http://lists.askmonty.org/pipermail/commits/2021-May/014627.html
            psergei Sergei Petrunia added a comment -

            bb-10.2-mdev25630

            psergei Sergei Petrunia added a comment - bb-10.2-mdev25630
            psergei Sergei Petrunia added a comment -

            sanja, please review

            psergei Sergei Petrunia added a comment - sanja , please review
            sanja Oleksandr Byelkin added a comment -

            OK to push

            sanja Oleksandr Byelkin added a comment - OK to push

            People

              psergei Sergei Petrunia
              Zuming Jiang Zuming Jiang
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.