Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-25994

Crash with union of my_decimal type in ORDER BY clause

Details

    Description

      Steps to reproduce:

      CREATE TABLE v0 ( v1 INTEGER ) ;
      		 
      INSERT INTO v0 ( v1 ) VALUES ( 8 ) ;
      		 
      UPDATE v0 SET v1 = 1 ORDER BY ( SELECT 1.1 UNION SELECT -1 );


      sigaction.c:0(__restore_rt)[0x7f5b729fc870]
      		 
      sql/my_decimal.h:132(my_decimal::operator=(my_decimal const&))[0x55e7157e1e30]
      		 
      sql/my_decimal.h:354(my_decimal2decimal(my_decimal const*, my_decimal*))[0x55e7157e2011]
      		 
      sql/my_decimal.cc:207(my_decimal::to_binary(unsigned char*, int, unsigned short, unsigned int) const)[0x55e715a84a04]
      		 
      sql/filesort.cc:1321(Type_handler_decimal_result::make_sort_key_part(unsigned char*, Item*, SORT_FIELD_ATTR const*, Sort_param*) const)[0x55e7158e8810]
      		 
      sql/filesort.cc:3030(make_sortkey(Sort_param*, unsigned char*))[0x55e7158ecfe6]
      		 
      sql/filesort.cc:1352(make_sortkey(Sort_param*, unsigned char*, unsigned char*, bool))[0x55e7158e8933]
      		 
      sql/filesort.cc:969(find_all_keys(THD*, Sort_param*, SQL_SELECT*, SORT_INFO*, st_io_cache*, st_io_cache*, Bounded_queue<unsigned char, unsigned char>*, unsigned long long*))[0x55e7158e7592]
      		 
      sql/filesort.cc:357(filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long))[0x55e7158e53fb]
      		 
      sql/sql_update.cc:796(mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*))[0x55e7156b1588]
      		 
      sql/sql_parse.cc:4399(mysql_execute_command(THD*))[0x55e71557ebb4]
      		 
      sql/sql_parse.cc:8016(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x55e71558ad79]
      		 
      sql/sql_parse.cc:1899(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x55e7155773a8]
      		 
      sql/sql_parse.cc:1406(do_command(THD*, bool))[0x55e715575d6b]
      		 
      sql/sql_connect.cc:1410(do_handle_one_connection(CONNECT*, bool))[0x55e71572ca46]
      		 
      sql/sql_connect.cc:1314(handle_one_connection)[0x55e71572c7b1]
      		 
      perfschema/pfs.cc:2203(pfs_spawn_thread)[0x55e715c4180a]
      		 
      pthread_create.c:0(start_thread)[0x7f5b729f2259]
      		 
      :0(__GI___clone)[0x7f5b7259d5e3]

      Attachments

        Issue Links

          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-26280 MariaDB server crash at my_decimal::operator=

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-26404 A SEGV insql/filesort.cc

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-27080 Malicious data type overflow in joint query leads to service coredump

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-29019 Assertion `(length % 4) == 0' failed in my_lengthsp_utf32 on SELECT

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-32324 Server crashes inside filesort at my_decimal::to_binary

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-32718 Segmentation fault at /mariadb-11.3.0/sql/my_decimal.h:132

          • Major - Major loss of function.
          • Confirmed

          Activity

            Ascending order - Click to sort in descending order
            View 8 older comments
            psergei Sergei Petrunia added a comment -

            Take-aways from the call: it seems the best way forward is to make Item_singlerow_subselect NULLable when appropriate

            psergei Sergei Petrunia added a comment - Take-aways from the call: it seems the best way forward is to make Item_singlerow_subselect NULLable when appropriate
            psergei Sergei Petrunia added a comment -

            https://github.com/MariaDB/server/commit/baec17bc033cb9be02428e2089046df9f530754a

            psergei Sergei Petrunia added a comment - https://github.com/MariaDB/server/commit/baec17bc033cb9be02428e2089046df9f530754a
            psergei Sergei Petrunia added a comment -

            sanja, please review the second patch variant: https://github.com/MariaDB/server/commit/baec17bc033cb9be02428e2089046df9f530754a

            psergei Sergei Petrunia added a comment - sanja , please review the second patch variant: https://github.com/MariaDB/server/commit/baec17bc033cb9be02428e2089046df9f530754a
            sanja Oleksandr Byelkin added a comment -

            OK to push.

            sanja Oleksandr Byelkin added a comment - OK to push.
            oleg.smirnov Oleg Smirnov added a comment - - edited

            And what do you think about my comment #2:
            "2. Does it make any sense to evaluate ORDER BY for an UPDATE that does not have a LIMIT clause? Maybe we can eliminate such ORDER BY at an early stage?"

            oleg.smirnov Oleg Smirnov added a comment - - edited And what do you think about my comment #2 : "2. Does it make any sense to evaluate ORDER BY for an UPDATE that does not have a LIMIT clause? Maybe we can eliminate such ORDER BY at an early stage?"

            People

              psergei Sergei Petrunia
              cvicentiu Vicențiu Ciorbaru
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.