Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-25630

Crash with window function in left expr of IN subquery

Details

    Description

      I used my fuzzing tool to test Mariadb , and found a bug that can result in an abortion.

      Mariadb installation：
      1) cd mariadb-10.5.9
      2) mkdir build; cd build
      3) cmake -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_DEBUG=ON ../
      4) make -j8 && sudo make install

      How to Repeat:
      export ASAN_OPTIONS=detect_leaks=0
      /usr/local/mysql/bin/mysqld_safe &
      /usr/local/mysql/bin/mysql -uroot -p123456(your password)
      MariaDB> drop database if exists test_db;
      MariaDB> create database test_db;
      MariaDB> source fuzz.sql;

      I have simplified the content of fuzz.sql, and I hope fuzz.sql can help you reproduce the bug and fix it. In addition, I attach the abortion report (which has its stack trace).

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-14791 Crash with order by expression containing window functions

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-28094 Window function in expression in ORDER BY

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          links to

          Web Link CVE-2021-46658

          Activity

            Ascending order - Click to sort in descending order
            Zuming Jiang Zuming Jiang created issue -
            Zuming Jiang Zuming Jiang made changes -
            Field Original Value New Value
            Description I used my fuzzing tool to test Mariadb , and found a bug that can result in an abortion.

            Mariadb installation：
            1) cd mariadb-10.5.9
            2) mkdir build; cd build
            3) cmake -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_DEBUG=ON ../
            4) make -j8 && sudo make install

            How to Repeat:
            export ASAN_OPTIONS=detect_leaks=0
            /usr/local/mysql/bin/mysqld_safe &
            /usr/local/mysql/bin/mysql -uroot -p123456(your password)
            MariaDB> drop database if exists test_db;
            MariaDB> create database test_db;
            MariaDB> source fuzz.sql;

            I have simplified the content of fuzz.sql, and I hope fuzz.sql can help you reproduce the bug and fix it. In addition, I attach the abortion report (which has its stack trace).             		I used my fuzzing tool to test Mariadb , and found a bug that can result in an abortion.

            *Mariadb installation：*
            1) cd mariadb-10.5.9
            2) mkdir build; cd build
            3) cmake -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_DEBUG=ON ../
            4) make -j8 && sudo make install

            *How to Repeat:*
            export ASAN_OPTIONS=detect_leaks=0
            /usr/local/mysql/bin/mysqld_safe &
            /usr/local/mysql/bin/mysql -uroot -p123456(your password)
            MariaDB> drop database if exists test_db;
            MariaDB> create database test_db;
            MariaDB> source fuzz.sql;

            I have simplified the content of fuzz.sql, and I hope fuzz.sql can help you reproduce the bug and fix it. In addition, I attach the abortion report (which has its stack trace).
            alice Alice Sherepa made changes -
            Affects Version/s 10.2 [ 14601 ]
            Affects Version/s 10.3 [ 22126 ]
            Affects Version/s 10.4 [ 22408 ]
            Affects Version/s 10.5 [ 23123 ]
            alice Alice Sherepa made changes -
            Fix Version/s 10.2 [ 14601 ]
            Fix Version/s 10.3 [ 22126 ]
            Fix Version/s 10.4 [ 22408 ]
            Fix Version/s 10.5 [ 23123 ]
            alice Alice Sherepa made changes -
            Component/s Optimizer - Window functions [ 13502 ]
            alice Alice Sherepa made changes -
            alice Alice Sherepa made changes -
            Assignee Sergei Petrunia [ psergey ]
            alice Alice Sherepa made changes -
            Status Open [ 1 ] Confirmed [ 10101 ]
            serg Sergei Golubchik made changes -
            Epic/Theme server
            serg Sergei Golubchik made changes -
            Component/s Query Cache [ 10120 ]
            serg Sergei Golubchik made changes -
            Priority Critical [ 2 ] Major [ 3 ]
            psergei Sergei Petrunia made changes -
            Status Confirmed [ 10101 ] In Progress [ 3 ]
            psergei Sergei Petrunia made changes -
            Summary Bug report: abortion in sql/sql_yacc.yy:0 Crash with window function in left expr of IN subquery
            psergei Sergei Petrunia made changes -
            Assignee Sergei Petrunia [ psergey ] Oleksandr Byelkin [ sanja ]
            Status In Progress [ 3 ] In Review [ 10002 ]
            sanja Oleksandr Byelkin made changes -
            Assignee Oleksandr Byelkin [ sanja ] Sergei Petrunia [ psergey ]
            Status In Review [ 10002 ] Stalled [ 10000 ]
            psergei Sergei Petrunia made changes -
            Fix Version/s 10.6.2 [ 25800 ]
            Fix Version/s 10.2.39 [ 25731 ]
            Fix Version/s 10.3.30 [ 25732 ]
            Fix Version/s 10.4.20 [ 25733 ]
            Fix Version/s 10.5.11 [ 25734 ]
            Fix Version/s 10.2 [ 14601 ]
            Fix Version/s 10.3 [ 22126 ]
            Fix Version/s 10.4 [ 22408 ]
            Fix Version/s 10.5 [ 23123 ]
            Resolution Fixed [ 1 ]
            Status Stalled [ 10000 ] Closed [ 6 ]
            psergei Sergei Petrunia made changes -
            Labels crash crash fuzzer
            marko Marko Mäkelä made changes -
            Fix Version/s 10.2.40 [ 26027 ]
            Fix Version/s 10.3.31 [ 26028 ]
            Fix Version/s 10.4.21 [ 26030 ]
            Fix Version/s 10.5.12 [ 26025 ]
            Fix Version/s 10.6.3 [ 25904 ]
            Fix Version/s 10.2.39 [ 25731 ]
            Fix Version/s 10.3.30 [ 25732 ]
            Fix Version/s 10.4.20 [ 25733 ]
            Fix Version/s 10.5.11 [ 25734 ]
            Fix Version/s 10.6.2 [ 25800 ]
            serg Sergei Golubchik made changes -
            Workflow MariaDB v3 [ 121707 ] MariaDB v4 [ 159254 ]
            serg Sergei Golubchik made changes -
            alice Alice Sherepa made changes -

            People

              psergei Sergei Petrunia
              Zuming Jiang Zuming Jiang
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.