[MDEV-26115] Crash when calling stored function in FOR loop argument - Jira

Type: Bug
Status: Stalled (View Workflow)
Priority: Critical
Resolution: Unresolved
Affects Version/s: 10.4.14, 10.5.10, 10.6.3, 10.3(EOL), 10.4(EOL), 10.5, 10.6
Fix Version/s: 10.5, 10.6, 10.11, 11.4
Component/s: Stored routines
Labels:
- crash
Environment:
Linux CentOS 7.7

When a stored function is used to provide the upper bound of a FOR loop, the server crashes. Example:

delimiter //

CREATE OR REPLACE FUNCTION cnt()

RETURNS INTEGER

NO SQL

BEGIN

   RETURN 1;

END;

//

CREATE OR REPLACE PROCEDURE p1()

NO SQL

BEGIN

   DECLARE i INTEGER;

   FOR i IN 1..cnt() DO

      SELECT i;

   END FOR;

END;

//

Calling this will crash the server on the second attempt:

MariaDB [test]> CALL p1();

+---+

| i |

+---+

| 1 |

+---+

1 row in set (0.002 sec)

Query OK, 0 rows affected (0.002 sec)

MariaDB [test]> CALL p1();

ERROR 2013 (HY000): Lost connection to MySQL server during query

The effect is the same when using SQL_MODE=Oracle and when using FOR loops outside a stored procedure, like this:

MARIADB> delimiter //

MARIADB> BEGIN NOT ATOMIC

DECLARE i INTEGER;

FOR i IN 1..cnt() DO

  SELECT i;

END FOR;

END;

//

ERROR 2006 (HY000): MySQL server has gone away

No connection. Trying to reconnect...

Connection id:    4

Current database: test

+---+

| i |

+---+

| 1 |

+---+

1 row in set (0.014 sec)

ERROR 2013 (HY000): Lost connection to MySQL server during query

is duplicated by

MDEV-32850 MariaDB got crash when call procedure

relates to

MDEV-23902 MariaDB crash on calling function

MDEV-33702 crash in SP -> Trigger -> SUM aggregate + UDF?

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server