-
Bug
-
-
Blocker
-
Resolution:
Duplicate
-
10.9.0, 10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL)
-
-
-
-
Linux jie-2 5.4.143-1-pve #1 SMP PVE 5.4.143-1 (Tue, 28 Sep 2021 09:10:37 +0200) x86_64 x86_64 x86_64 GNU/Linux
PoC:
CREATE TABLE v2 ( v3 INT ( 29 ) ) ;
|
SELECT ( 'x' ) FROM v2 GROUP BY v3 HAVING v3 = ( NOT EXISTS ( SELECT * WHERE 'x' ) ) ;
|
report (compiled with ASAN):
Thread pointer: 0x7f0dac000c58
|
Attempting backtrace. You can use the following information to find out
|
where mysqld died. If you see no messages after this, something went
|
terribly wrong...
|
stack_bottom = 0x7f0e10057e30 thread_stack 0x49000
|
mysys/stacktrace.c:212(my_print_stacktrace)[0xe12bae]
|
sql/signal_handler.cc:226(handle_fatal_signal)[0x973f04]
|
sigaction.c:0(__restore_rt)[0x7f0e1b8b53c0]
|
sql/item_subselect.cc:4026(subselect_single_select_engine::exec())[0xa36cdc]
|
sql/item_subselect.cc:858(Item_subselect::exec())[0xa2e4bc]
|
sql/item_subselect.cc:1872(Item_exists_subselect::val_bool())[0xa30a1e]
|
sql/item_cmpfunc.cc:202(Item_func_not::val_int())[0x9a6739]
|
sql/sql_type.cc:8716(Type_handler_int_result::Item_eq_value(THD*, Type_cmp_attributes const*, Item*, Item*) const)[0x8d676c]
|
sql/item_cmpfunc.cc:6746(Item_equal::add_const(THD*, Item*))[0x9b79d8]
|
??:0(Item_equal::merge_with_check(THD*, Item_equal*, bool))[0x9b7d7b]
|
sql/sql_list.h:429(base_list_iterator::next())[0x7aec59]
|
sql/field.h:429(Context)[0x899f87]
|
??:0(JOIN::optimize_inner())[0x79112c]
|
??:0(JOIN::optimize())[0x78af00]
|
sql/sql_select.cc:4993(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_
|
select_lex*))[0x785468]
|
sql/sql_select.cc:543(handle_select(THD*, LEX*, select_result*, unsigned long))[0x785330]
|
sql/sql_parse.cc:6252(execute_sqlcom_select(THD*, TABLE_LIST*))[0x754fea]
|
??:0(mysql_execute_command(THD*, bool))[0x74ef77]
|
sql/sql_class.h:2734(THD::enter_stage(PSI_stage_info_v1 const*, char const*, char const*, unsigned int))[0x74b207]
|
sql/sql_parse.cc:1896(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x7490c7]
|
sql/sql_parse.cc:1404(do_command(THD*, bool))[0x74b65e]
|
sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x85bf2e]
|
sql/sql_connect.cc:1318(handle_one_connection)[0x85bd4d]
|
perfschema/pfs.cc:2203(pfs_spawn_thread)[0xb8496e]
|
nptl/pthread_create.c:478(start_thread)[0x7f0e1b8a9609]
|
??:0(clone)[0x7f0e1b5c9163]
|
|
Trying to get some variables.
|
Some pointers may be invalid and cause the dump to abort.
|
Query (0x7f0dac010b50): SELECT ( 'x' ) FROM v2 GROUP BY v3 HAVING v3 = ( NOT EXISTS ( SELECT * WHERE 'x' ) )
|
Alice Sherepa
made changes -
Field |
Original Value |
New Value |
Affects Version/s
|
|
10.4
[ 22408
]
|
Affects Version/s
|
|
10.5
[ 23123
]
|
Affects Version/s
|
|
10.6
[ 24028
]
|
Affects Version/s
|
|
10.7
[ 24805
]
|
Affects Version/s
|
|
10.8
[ 26121
]
|
Alice Sherepa
made changes -
Fix Version/s
|
|
10.4
[ 22408
]
|
Fix Version/s
|
|
10.5
[ 23123
]
|
Fix Version/s
|
|
10.6
[ 24028
]
|
Fix Version/s
|
|
10.7
[ 24805
]
|
Alice Sherepa
made changes -
Assignee
|
|
Igor Babaev
[ igor
]
|
Alice Sherepa
made changes -
Status
|
Open
[ 1
]
|
Confirmed
[ 10101
]
|
Sergei Golubchik
made changes -
Remote Link
|
|
This issue links to "CVE-2022-27444 (Web Link)"
[ 33712
]
|
Sergei Golubchik
made changes -
Priority
|
Major
[ 3
]
|
Blocker
[ 1
]
|
Sergei Golubchik
made changes -
Component/s
|
|
Optimizer
[ 10200
]
|
Fix Version/s
|
|
10.4.25
[ 27510
]
|
Fix Version/s
|
|
10.5.16
[ 27508
]
|
Fix Version/s
|
|
10.6.8
[ 27506
]
|
Fix Version/s
|
|
10.7.4
[ 27504
]
|
Fix Version/s
|
10.4
[ 22408
]
|
|
Fix Version/s
|
10.5
[ 23123
]
|
|
Fix Version/s
|
10.6
[ 24028
]
|
|
Fix Version/s
|
10.7
[ 24805
]
|
|
Resolution
|
|
Duplicate
[ 3
]
|
Status
|
In Progress
[ 3
]
|
Closed
[ 6
]
|
Igor Babaev (Inactive)
made changes -
Summary
|
MariaDB SEGV issue
|
Crash with HAVING using NOT EXIST predicate in an equality
|
Igor Babaev (Inactive)
made changes -
Summary
|
Crash with HAVING using NOT EXIST predicate in an equality
|
Crash when using HAVING with NOT EXIST predicate in an equality
|
{"report":{"fcp":1051.1999998092651,"ttfb":383.19999980926514,"pageVisibility":"visible","entityId":108856,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{},"userDeviceMemory":8,"userDeviceProcessors":64,"apdex":0.5,"journeyId":"79e3d43b-e260-473e-b08d-79bc27244f56","navigationType":0,"readyForUser":1166.2999997138977,"redirectCount":0,"resourceLoadedEnd":1260.2999997138977,"resourceLoadedStart":389.90000009536743,"resourceTiming":[{"duration":107.5,"initiatorType":"link","name":"https://jira.mariadb.org/s/2c21342762a6a02add1c328bed317ffd-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/css/_super/batch.css","startTime":389.90000009536743,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":389.90000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":497.40000009536743,"responseStart":0,"secureConnectionStart":0},{"duration":107.7000002861023,"initiatorType":"link","name":"https://jira.mariadb.org/s/7ebd35e77e471bc30ff0eba799ebc151-CDN/lu2cib/820016/12ta74/494e4c556ecbb29f90a3d3b4f09cb99c/_/download/contextbatch/css/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true&whisper-enabled=true","startTime":390.19999980926514,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":390.19999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":497.90000009536743,"responseStart":0,"secureConnectionStart":0},{"duration":167.89999961853027,"initiatorType":"script","name":"https://jira.mariadb.org/s/0917945aaa57108d00c5076fea35e069-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/js/_super/batch.js?locale=en","startTime":390.40000009536743,"connectEnd":390.40000009536743,"connectStart":390.40000009536743,"domainLookupEnd":390.40000009536743,"domainLookupStart":390.40000009536743,"fetchStart":390.40000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":390.40000009536743,"responseEnd":558.2999997138977,"responseStart":558.2999997138977,"secureConnectionStart":390.40000009536743},{"duration":235.69999980926514,"initiatorType":"script","name":"https://jira.mariadb.org/s/2d8175ec2fa4c816e8023260bd8c1786-CDN/lu2cib/820016/12ta74/494e4c556ecbb29f90a3d3b4f09cb99c/_/download/contextbatch/js/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true&whisper-enabled=true","startTime":390.5,"connectEnd":390.5,"connectStart":390.5,"domainLookupEnd":390.5,"domainLookupStart":390.5,"fetchStart":390.5,"redirectEnd":0,"redirectStart":0,"requestStart":390.5,"responseEnd":626.1999998092651,"responseStart":626.1999998092651,"secureConnectionStart":390.5},{"duration":240.2000002861023,"initiatorType":"script","name":"https://jira.mariadb.org/s/a9324d6758d385eb45c462685ad88f1d-CDN/lu2cib/820016/12ta74/c92c0caa9a024ae85b0ebdbed7fb4bd7/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en","startTime":390.7999997138977,"connectEnd":390.7999997138977,"connectStart":390.7999997138977,"domainLookupEnd":390.7999997138977,"domainLookupStart":390.7999997138977,"fetchStart":390.7999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":390.7999997138977,"responseEnd":631,"responseStart":631,"secureConnectionStart":390.7999997138977},{"duration":240.40000009536743,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":391,"connectEnd":391,"connectStart":391,"domainLookupEnd":391,"domainLookupStart":391,"fetchStart":391,"redirectEnd":0,"redirectStart":0,"requestStart":391,"responseEnd":631.4000000953674,"responseStart":631.4000000953674,"secureConnectionStart":391},{"duration":240.69999980926514,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":391.09999990463257,"connectEnd":391.09999990463257,"connectStart":391.09999990463257,"domainLookupEnd":391.09999990463257,"domainLookupStart":391.09999990463257,"fetchStart":391.09999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":391.09999990463257,"responseEnd":631.7999997138977,"responseStart":631.7999997138977,"secureConnectionStart":391.09999990463257},{"duration":314.7000002861023,"initiatorType":"link","name":"https://jira.mariadb.org/s/b04b06a02d1959df322d9cded3aeecc1-CDN/lu2cib/820016/12ta74/a2ff6aa845ffc9a1d22fe23d9ee791fc/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":391.2999997138977,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":391.2999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":706,"responseStart":0,"secureConnectionStart":0},{"duration":240.69999980926514,"initiatorType":"script","name":"https://jira.mariadb.org/rest/api/1.0/shortcuts/820016/47140b6e0a9bc2e4913da06536125810/shortcuts.js?context=issuenavigation&context=issueaction","startTime":391.5,"connectEnd":391.5,"connectStart":391.5,"domainLookupEnd":391.5,"domainLookupStart":391.5,"fetchStart":391.5,"redirectEnd":0,"redirectStart":0,"requestStart":391.5,"responseEnd":632.1999998092651,"responseStart":632.1999998092651,"secureConnectionStart":391.5},{"duration":314.5,"initiatorType":"link","name":"https://jira.mariadb.org/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.css?jira.create.linked.issue=true","startTime":391.59999990463257,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":391.59999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":706.0999999046326,"responseStart":0,"secureConnectionStart":0},{"duration":241,"initiatorType":"script","name":"https://jira.mariadb.org/s/5d5e8fe91fbc506585e83ea3b62ccc4b-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.js?jira.create.linked.issue=true&locale=en","startTime":391.7999997138977,"connectEnd":391.7999997138977,"connectStart":391.7999997138977,"domainLookupEnd":391.7999997138977,"domainLookupStart":391.7999997138977,"fetchStart":391.7999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":391.7999997138977,"responseEnd":632.7999997138977,"responseStart":632.7999997138977,"secureConnectionStart":391.7999997138977},{"duration":648.4000000953674,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":393.5,"connectEnd":393.5,"connectStart":393.5,"domainLookupEnd":393.5,"domainLookupStart":393.5,"fetchStart":393.5,"redirectEnd":0,"redirectStart":0,"requestStart":393.5,"responseEnd":1041.9000000953674,"responseStart":1041.9000000953674,"secureConnectionStart":393.5},{"duration":839.1000003814697,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":397.7999997138977,"connectEnd":397.7999997138977,"connectStart":397.7999997138977,"domainLookupEnd":397.7999997138977,"domainLookupStart":397.7999997138977,"fetchStart":397.7999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":397.7999997138977,"responseEnd":1236.9000000953674,"responseStart":1236.9000000953674,"secureConnectionStart":397.7999997138977},{"duration":324,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":718.2999997138977,"connectEnd":718.2999997138977,"connectStart":718.2999997138977,"domainLookupEnd":718.2999997138977,"domainLookupStart":718.2999997138977,"fetchStart":718.2999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":718.2999997138977,"responseEnd":1042.2999997138977,"responseStart":1042.2999997138977,"secureConnectionStart":718.2999997138977},{"duration":223.40000009536743,"initiatorType":"script","name":"https://www.google-analytics.com/analytics.js","startTime":1044.0999999046326,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1044.0999999046326,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1267.5,"responseStart":0,"secureConnectionStart":0},{"duration":192.5,"initiatorType":"link","name":"https://jira.mariadb.org/s/d5715adaadd168a9002b108b2b039b50-CDN/lu2cib/820016/12ta74/be4b45e9cec53099498fa61c8b7acba4/_/download/contextbatch/css/jira.project.sidebar,-_super,-project.issue.navigator,-jira.general,-jira.browse.project,-jira.view.issue,-jira.global,-atl.general,-com.atlassian.jira.projects.sidebar.init/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true&whisper-enabled=true","startTime":1067.7999997138977,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1067.7999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1260.2999997138977,"responseStart":0,"secureConnectionStart":0},{"duration":170.30000019073486,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/e65b778d185daf5aee24936755b43da6/_/download/contextbatch/js/browser-metrics-plugin.contrib,-_super,-project.issue.navigator,-jira.view.issue,-atl.general/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true&whisper-enabled=true","startTime":1068.6999998092651,"connectEnd":1068.6999998092651,"connectStart":1068.6999998092651,"domainLookupEnd":1068.6999998092651,"domainLookupStart":1068.6999998092651,"fetchStart":1068.6999998092651,"redirectEnd":0,"redirectStart":0,"requestStart":1068.6999998092651,"responseEnd":1239,"responseStart":1239,"secureConnectionStart":1068.6999998092651},{"duration":172,"initiatorType":"script","name":"https://jira.mariadb.org/s/097ae97cb8fbec7d6ea4bbb1f26955b9-CDN/lu2cib/820016/12ta74/be4b45e9cec53099498fa61c8b7acba4/_/download/contextbatch/js/jira.project.sidebar,-_super,-project.issue.navigator,-jira.general,-jira.browse.project,-jira.view.issue,-jira.global,-atl.general,-com.atlassian.jira.projects.sidebar.init/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true&whisper-enabled=true","startTime":1069.4000000953674,"connectEnd":1069.4000000953674,"connectStart":1069.4000000953674,"domainLookupEnd":1069.4000000953674,"domainLookupStart":1069.4000000953674,"fetchStart":1069.4000000953674,"redirectEnd":0,"redirectStart":0,"requestStart":1069.4000000953674,"responseEnd":1241.4000000953674,"responseStart":1241.4000000953674,"secureConnectionStart":1069.4000000953674}],"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":170,"responseStart":383,"responseEnd":387,"domLoading":386,"domInteractive":1319,"domContentLoadedEventStart":1319,"domContentLoadedEventEnd":1384,"domComplete":1580,"loadEventStart":1580,"loadEventEnd":1581,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[{"name":"bigPipe.sidebar-id.start","time":1274},{"name":"bigPipe.sidebar-id.end","time":1274.7999997138977},{"name":"bigPipe.activity-panel-pipe-id.start","time":1275},{"name":"bigPipe.activity-panel-pipe-id.end","time":1279.5},{"name":"activityTabFullyLoaded","time":1404.9000000953674}],"measures":[],"correlationId":"cafeb5d4919dd8","effectiveType":"4g","downlink":10,"rtt":0,"serverDuration":147,"dbReadsTimeInMs":28,"dbConnsTimeInMs":40,"applicationHash":"9d11dbea5f4be3d4cc21f03a88dd11d8c8687422","experiments":[]}}