[MDEV-28094] Window function in expression in ORDER BY - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Blocker
Resolution: Fixed
Affects Version/s: 10.9.0, 10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL)
Fix Version/s: 10.4.25, 10.5.16, 10.6.8, 10.7.4
Component/s: Optimizer
Labels:
- regression
Environment:
Linux jie-2 5.4.143-1-pve #1 SMP PVE 5.4.143-1 (Tue, 28 Sep 2021 09:10:37 +0200) x86_64 x86_64 x86_64 GNU/Linux

Description

PoC:

SELECT EXISTS ( ( SELECT -1 ORDER BY AVG ( 2147483647 ) OVER ( ROWS BETWEEN UNBOUNDED PRECEDING AND 83 PRECEDING ) / 'x' ) ) ;

report (compiled with ASAN):

Thread pointer: 0x62b00015e218

Attempting backtrace. You can use the following information to find out

where mysqld died. If you see no messages after this, something went

terribly wrong...

stack_bottom = 0x7fd219e69880 thread_stack 0x5fc00

??:0(__interceptor_backtrace)[0x7cbadb]

mysys/stacktrace.c:212(my_print_stacktrace)[0x2a86d37]

sql/signal_handler.cc:0(handle_fatal_signal)[0x15af5d9]

sigaction.c:0(__restore_rt)[0x7fd2406673c0]

sql/field_conv.cc:205(set_field_to_null_with_conversions(Field*, bool))[0x158a63e]

sql/item.cc:6796(Item::save_decimal_in_field(Field*, bool))[0x164caae]

sql/item.cc:6812(Item::save_in_field(Field*, bool))[0x164ce5a]

sql/sql_list.h:441(base_list_iterator::next_fast())[0x137f492]

??:0(Window_func_runner::exec(THD*, TABLE*, SORT_INFO*))[0x1380b36]

sql/sql_window.cc:3013(Window_funcs_sort::exec(JOIN*, bool))[0x138110a]

??:0(Window_funcs_computation::exec(JOIN*, bool))[0x1383947]

sql/sql_select.cc:29515(AGGR_OP::end_send())[0xe2fe7f]

sql/sql_select.cc:20806(sub_select_postjoin_aggr(JOIN*, st_join_table*, bool))[0xdb6f23]

sql/sql_select.cc:20642(do_select(JOIN*, Procedure*))[0xdc6a47]

sql/sql_select.cc:4528(JOIN::exec())[0xdc344d]

??:0(subselect_single_select_engine::exec())[0x1952e44]

sql/item_subselect.cc:858(Item_subselect::exec())[0x1927eda]

sql/item_subselect.cc:1814(Item_exists_subselect::val_int())[0x193379d]

sql/sql_type.cc:7502(Type_handler::Item_send_long(Item*, Protocol*, st_value*) const)[0x13548b2]

sql/protocol.cc:1328(Protocol::send_result_set_row(List<Item>*))[0x920512]

sql/sql_class.cc:3060(select_send::send_data(List<Item>&))[0xaf940a]

sql/sql_select.cc:4615(JOIN::exec_inner())[0xdc7875]

sql/sql_select.cc:4528(JOIN::exec())[0xdc344d]

sql/sql_select.cc:5009(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0xd4e4e9]

sql/sql_select.cc:543(handle_select(THD*, LEX*, select_result*, unsigned long))[0xd4d74c]

sql/sql_parse.cc:6252(execute_sqlcom_select(THD*, TABLE_LIST*))[0xc74411]

sql/sql_parse.cc:3943(mysql_execute_command(THD*, bool))[0xc609ca]

sql/sql_class.h:2734(THD::enter_stage(PSI_stage_info_v1 const*, char const*, char const*, unsigned int))[0xc4a67f]

sql/sql_parse.cc:1894(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0xc41baa]

sql/sql_parse.cc:1404(do_command(THD*, bool))[0xc4b74c]

sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x111f9f3]

sql/sql_connect.cc:0(handle_one_connection)[0x111f249]

perfschema/pfs.cc:2203(pfs_spawn_thread)[0x1f3f9de]

nptl/pthread_create.c:478(start_thread)[0x7fd24065b609]

??:0(clone)[0x7fd240371163]

Trying to get some variables.

Some pointers may be invalid and cause the dump to abort.

Query (0x629000087238): SELECT EXISTS ( ( SELECT -1 ORDER BY AVG ( 2147483647 ) OVER ( ROWS BETWEEN UNBOUNDED PRECEDING AND 83 PRECEDING ) / 'x' ) )

Attachments

Issue Links

relates to

MDEV-25630 Crash with window function in left expr of IN subquery

Closed

links to

CVE-2022-27451

Activity

Ascending order - Click to sort in descending order

Jingzhou Fu created issue - 2022-03-16 09:50

Alice Sherepa made changes - 2022-03-16 14:32

Field	Original Value	New Value
Affects Version/s		10.4 [ 22408 ]
Affects Version/s		10.5 [ 23123 ]
Affects Version/s		10.6 [ 24028 ]
Affects Version/s		10.7 [ 24805 ]
Affects Version/s		10.8 [ 26121 ]

Alice Sherepa made changes - 2022-03-16 14:32

Fix Version/s		10.4 [ 22408 ]
Fix Version/s		10.5 [ 23123 ]
Fix Version/s		10.6 [ 24028 ]
Fix Version/s		10.7 [ 24805 ]

Alice Sherepa made changes - 2022-03-22 10:05

Labels

regression

Alice Sherepa added a comment - 2022-03-22 10:10

Thank you!
the bug is reproducible on 10.4-10.8, while not on 10.2,10.3

#SELECT EXISTS ( ( SELECT -1 ORDER BY AVG ( 2147483647 ) OVER ( ROWS BETWEEN UNBOUNDED PRECEDING AND 83 PRECEDING ) / 'x' ) ) ;

SELECT EXISTS (SELECT 1 ORDER BY 1+sum(2) OVER ());

Version: '10.4.25-MariaDB-debug-log'

220322 11:06:10 [ERROR] mysqld got signal 11 ;

Server version: 10.4.25-MariaDB-debug-log

sigaction.c:0(__restore_rt)[0x7f70cf4bc3c0]

sql/field.h:1199(Field::set_notnull(long long))[0x56182d234633]

sql/item.cc:6686(Item::save_decimal_in_field(Field*, bool))[0x56182dcf519b]

sql/sql_type.cc:3832(Type_handler_decimal_result::Item_save_in_field(Item*, Field*, bool) const)[0x56182da3121a]

sql/item.cc:6702(Item::save_in_field(Field*, bool))[0x56182dcf552d]

sql/sql_window.cc:2725(save_window_function_values(List<Item_window_func>&, TABLE*, unsigned char*))[0x56182da764ad]

sql/sql_window.cc:2879(compute_window_func(THD*, List<Item_window_func>&, List<Cursor_manager>&, TABLE*, SORT_INFO*))[0x56182da76f7d]

sql/sql_window.cc:2980(Window_func_runner::exec(THD*, TABLE*, SORT_INFO*))[0x56182da775fa]

sql/sql_window.cc:3008(Window_funcs_sort::exec(JOIN*, bool))[0x56182da77848]

sql/sql_window.cc:3135(Window_funcs_computation::exec(JOIN*, bool))[0x56182da78650]

sql/sql_select.cc:28988(AGGR_OP::end_send())[0x56182d656018]

sql/sql_select.cc:20342(sub_select_postjoin_aggr(JOIN*, st_join_table*, bool))[0x56182d614a0b]

sql/sql_select.cc:20166(do_select(JOIN*, Procedure*))[0x56182d613c06]

sql/sql_select.cc:4542(JOIN::exec_inner())[0x56182d5a2792]

sql/sql_select.cc:4325(JOIN::exec())[0x56182d59fdbe]

sql/item_subselect.cc:4042(subselect_single_select_engine::exec())[0x56182dec0098]

sql/item_subselect.cc:800(Item_subselect::exec())[0x56182de9b30f]

sql/item_subselect.cc:1742(Item_exists_subselect::val_int())[0x56182dea5a0d]

sql/sql_type.cc:7102(Type_handler::Item_send_long(Item*, Protocol*, st_value*) const)[0x56182da41288]

sql/sql_type.h:5155(Type_handler_long::Item_send(Item*, Protocol*, st_value*) const)[0x56182da5cc42]

sql/item.h:1043(Item::send(Protocol*, st_value*))[0x56182d21641e]

sql/protocol.cc:1038(Protocol::send_result_set_row(List<Item>*))[0x56182d207f43]

sql/sql_class.cc:3123(select_send::send_data(List<Item>&))[0x56182d3b5035]

sql/sql_select.cc:4409(JOIN::exec_inner())[0x56182d5a11d3]

sql/sql_select.cc:4325(JOIN::exec())[0x56182d59fdbe]

sql/sql_select.cc:4765(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x56182d5a3f9e]

sql/sql_select.cc:436(handle_select(THD*, LEX*, select_result*, unsigned long))[0x56182d575054]

sql/sql_parse.cc:6465(execute_sqlcom_select(THD*, TABLE_LIST*))[0x56182d4e3517]

sql/sql_parse.cc:3979(mysql_execute_command(THD*))[0x56182d4d0df6]

sql/sql_parse.cc:8011(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x56182d4eca05]

sql/sql_parse.cc:1876(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x56182d4c318c]

sql/sql_parse.cc:1378(do_command(THD*))[0x56182d4bfa3f]

sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x56182d8bb6f1]

sql/sql_connect.cc:1317(handle_one_connection)[0x56182d8bae4a]

perfschema/pfs.cc:1871(pfs_spawn_thread)[0x56182e5bc481]

nptl/pthread_create.c:478(start_thread)[0x7f70cf4b0609]

/lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f70cf081163]

Query (0x62b0000a1290): SELECT EXISTS (SELECT 1 ORDER BY 1+sum(2) OVER ())

Alice Sherepa added a comment - 2022-03-22 10:10 Thank you! the bug is reproducible on 10.4-10.8, while not on 10.2,10.3 # SELECT EXISTS ( ( SELECT -1 ORDER BY AVG ( 2147483647 ) OVER ( ROWS BETWEEN UNBOUNDED PRECEDING AND 83 PRECEDING ) / 'x' ) ) ; SELECT EXISTS ( SELECT 1 ORDER BY 1+ sum (2) OVER ()); Version: '10.4.25-MariaDB-debug-log' 220322 11:06:10 [ERROR] mysqld got signal 11 ; Server version: 10.4.25-MariaDB-debug-log sigaction.c:0(__restore_rt)[0x7f70cf4bc3c0] sql/field.h:1199(Field::set_notnull(long long))[0x56182d234633] sql/item.cc:6686(Item::save_decimal_in_field(Field*, bool))[0x56182dcf519b] sql/sql_type.cc:3832(Type_handler_decimal_result::Item_save_in_field(Item*, Field*, bool) const)[0x56182da3121a] sql/item.cc:6702(Item::save_in_field(Field*, bool))[0x56182dcf552d] sql/sql_window.cc:2725(save_window_function_values(List<Item_window_func>&, TABLE*, unsigned char*))[0x56182da764ad] sql/sql_window.cc:2879(compute_window_func(THD*, List<Item_window_func>&, List<Cursor_manager>&, TABLE*, SORT_INFO*))[0x56182da76f7d] sql/sql_window.cc:2980(Window_func_runner::exec(THD*, TABLE*, SORT_INFO*))[0x56182da775fa] sql/sql_window.cc:3008(Window_funcs_sort::exec(JOIN*, bool))[0x56182da77848] sql/sql_window.cc:3135(Window_funcs_computation::exec(JOIN*, bool))[0x56182da78650] sql/sql_select.cc:28988(AGGR_OP::end_send())[0x56182d656018] sql/sql_select.cc:20342(sub_select_postjoin_aggr(JOIN*, st_join_table*, bool))[0x56182d614a0b] sql/sql_select.cc:20166(do_select(JOIN*, Procedure*))[0x56182d613c06] sql/sql_select.cc:4542(JOIN::exec_inner())[0x56182d5a2792] sql/sql_select.cc:4325(JOIN::exec())[0x56182d59fdbe] sql/item_subselect.cc:4042(subselect_single_select_engine::exec())[0x56182dec0098] sql/item_subselect.cc:800(Item_subselect::exec())[0x56182de9b30f] sql/item_subselect.cc:1742(Item_exists_subselect::val_int())[0x56182dea5a0d] sql/sql_type.cc:7102(Type_handler::Item_send_long(Item*, Protocol*, st_value*) const)[0x56182da41288] sql/sql_type.h:5155(Type_handler_long::Item_send(Item*, Protocol*, st_value*) const)[0x56182da5cc42] sql/item.h:1043(Item::send(Protocol*, st_value*))[0x56182d21641e] sql/protocol.cc:1038(Protocol::send_result_set_row(List<Item>*))[0x56182d207f43] sql/sql_class.cc:3123(select_send::send_data(List<Item>&))[0x56182d3b5035] sql/sql_select.cc:4409(JOIN::exec_inner())[0x56182d5a11d3] sql/sql_select.cc:4325(JOIN::exec())[0x56182d59fdbe] sql/sql_select.cc:4765(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x56182d5a3f9e] sql/sql_select.cc:436(handle_select(THD*, LEX*, select_result*, unsigned long))[0x56182d575054] sql/sql_parse.cc:6465(execute_sqlcom_select(THD*, TABLE_LIST*))[0x56182d4e3517] sql/sql_parse.cc:3979(mysql_execute_command(THD*))[0x56182d4d0df6] sql/sql_parse.cc:8011(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x56182d4eca05] sql/sql_parse.cc:1876(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x56182d4c318c] sql/sql_parse.cc:1378(do_command(THD*))[0x56182d4bfa3f] sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x56182d8bb6f1] sql/sql_connect.cc:1317(handle_one_connection)[0x56182d8bae4a] perfschema/pfs.cc:1871(pfs_spawn_thread)[0x56182e5bc481] nptl/pthread_create.c:478(start_thread)[0x7f70cf4b0609] /lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f70cf081163] Query (0x62b0000a1290): SELECT EXISTS (SELECT 1 ORDER BY 1+sum(2) OVER ())

Alice Sherepa made changes - 2022-03-22 10:12

Link

This issue relates to ~~MDEV-25630~~ [ ~~MDEV-25630~~ ]

Alice Sherepa made changes - 2022-03-22 10:12

Assignee

Sergei Petrunia [ psergey ]

Alice Sherepa made changes - 2022-03-22 10:13

Status

Open [ 1 ]

Confirmed [ 10101 ]

Sergei Golubchik made changes - 2022-04-27 16:01

Remote Link

This issue links to "CVE-2022-27451 (Web Link)" [ 33707 ]

Sergei Golubchik made changes - 2022-04-27 17:47

Priority

Major [ 3 ]

Blocker [ 1 ]

Sergei Golubchik made changes - 2022-04-28 11:57

Assignee

Sergei Petrunia [ psergey ]

Sergei Golubchik [ serg ]

Sergei Golubchik made changes - 2022-04-28 11:57

Status

Confirmed [ 10101 ]

In Progress [ 3 ]

Sergei Golubchik made changes - 2022-04-28 15:38

Summary

MariaDB SEGV issue

Window function in expression in ORDER BY

Sergei Golubchik made changes - 2022-04-28 15:41

Status

In Progress [ 3 ]

Stalled [ 10000 ]

Sergei Golubchik made changes - 2022-04-28 15:42

Assignee	Sergei Golubchik [ serg ]	Oleksandr Byelkin [ sanja ]
Status	Stalled [ 10000 ]	In Review [ 10002 ]

Oleksandr Byelkin added a comment - 2022-04-28 19:23

OK to push

Oleksandr Byelkin added a comment - 2022-04-28 19:23 OK to push

Oleksandr Byelkin made changes - 2022-04-28 19:23

Assignee	Oleksandr Byelkin [ sanja ]	Sergei Golubchik [ serg ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Sergei Golubchik made changes - 2022-04-29 15:08

Component/s		Optimizer [ 10200 ]
Fix Version/s		10.4.25 [ 27510 ]
Fix Version/s		10.5.16 [ 27508 ]
Fix Version/s		10.6.8 [ 27506 ]
Fix Version/s		10.7.4 [ 27504 ]
Fix Version/s	10.4 [ 22408 ]
Fix Version/s	10.5 [ 23123 ]
Fix Version/s	10.6 [ 24028 ]
Fix Version/s	10.7 [ 24805 ]
Resolution		Fixed [ 1 ]
Status	Stalled [ 10000 ]	Closed [ 6 ]

People

Assignee:: Sergei Golubchik

Reporter:: Jingzhou Fu

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 2022-03-16 09:50

Updated:: 2022-04-29 15:08

Resolved:: 2022-04-29 15:08

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server

Details

Description

Attachments

Issue Links

Activity

People

Dates

Git Integration