Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Fixed
-
10.5.9, 10.4(EOL), 10.5
-
Ubuntu 18.04
MariaDB 10.5.9
Description
I used my fuzzing tool to test Mariadb , and found a bug that can result in an abortion.
Mariadb installation:
1) cd mariadb-10.5.9
2) mkdir build; cd build
3) cmake -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_DEBUG=ON ../
4) make -j8 && sudo make install
How to Repeat:
export ASAN_OPTIONS=detect_leaks=0
/usr/local/mysql/bin/mysqld_safe &
/usr/local/mysql/bin/mysql -uroot -p123456(your password)
MariaDB> drop database if exists test_db;
MariaDB> create database test_db;
MariaDB> source fuzz.sql;
I have simplified the content of fuzz.sql, and I hope fuzz.sql can help you reproduce the bug and fix it. In addition, I attach the abortion report (which has its stack trace).
Attachments
Issue Links
- relates to
-
MDEV-26402 A SEGV in Item_field::used_tables/update_depend_map_for_order or Assertion `fixed == 1'
-
- Closed
-
-
MDEV-26452 SIGSEGV in Item::cleanup from Item::cleanup_processor
-
- Closed
-
- links to
This is a legacy bug and it's present in 10.2 as well.
Let's try to construct a test case for the bug in 10.2 that would catch the bug in 10.2 where there is no pushdown from HAVING to WHERE. However in 10.2 we have pushdown of conditions into HAVING of materialized tables / views that also builds items of the form Item_direct_view_ref(Item_ref(Item_sum_func(Item_basic_constant))) if the pushdown happens to be from WHERE of mergeable derived tables / views.
Here is a test case that uses such pushdown:
The result set from the query is:
MariaDB [test]> select * from (select * from v1) as dt where a=f and a=g;
+------+------+------+
| a | f | g |
+------+------+------+
| 3 | 3 | 3 |
+------+------+------+
1 row in set
though select from v1 returns
MariaDB [test]> select * from v1;
+------+------+------+
| a | f | g |
+------+------+------+
| 1 | 1 | 1 |
| 3 | 3 | 3 |
| 7 | 3 | 3 |
+------+------+------+
3 rows in set
If we manually push the condition a=f and a=g into v1 we have a proper result set:
MariaDB [test]> select * from (select a, sum(1) as f, sum(1) as g from t1 group by a having a=f and a=g) as dt;
+------+------+------+
| a | f | g |
+------+------+------+
| 1 | 1 | 1 |
| 3 | 3 | 3 |
+------+------+------+
2 rows in set