Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-30756

Crash in get_sort_by_table / make_join_statistics / update_depend_map_for_order, UBSAN member access within null pointer in update_depend_map_for_order

    XMLWordPrintable

Details

    Description

      POC:

      CREATE TABLE v0 ( v1 INT , v2 CHAR UNIQUE UNIQUE NOT NULL CHECK ( v2 NOT IN ( v1 > 59 OR v1 > 67 AND FALSE NOT LIKE 'x' , 'x' ) ) ) ;
       CREATE VIEW v3 AS SELECT DISTINCT 41503055.000000 FROM v0 WHERE v2 ;
       UPDATE v0 SET v2 = v2 * 0 WHERE v2 IN ( SELECT DISTINCT v2 FROM v0 WHERE EXISTS ( SELECT v1 FROM v3 WHERE v1 = v2 + -1 GROUP BY ( SELECT v2 FROM v0 AS v4 WHERE v2 = 'x' OR v1 = 'x' OR v1 = 'x' GROUP BY v2 HAVING v1 < 'x' ) BETWEEN 44 AND 0 HAVING 2147483647 ) ) ORDER BY v1 IS NULL ;
       DROP TABLE v3 ;
       INSERT INTO v0 VALUES ( 15 ) ;
      

      Backtrace:

      Attempting backtrace. You can use the following information to find out
      where mysqld died. If you see no messages after this, something went
      terribly wrong...
      stack_bottom = 0x7f02b8109c00 thread_stack 0x49000
      addr2line: DWARF error: invalid or unhandled FORM value: 0x23
      ??:0(my_print_stacktrace)[0x56554d0d200b]
      ??:0(handle_fatal_signal)[0x56554c89b68f]
      ??:0(__sigaction)[0x7f02baa08520]
      addr2line: DWARF error: invalid or unhandled FORM value: 0x23
      sql_select.cc:0(get_sort_by_table(st_order*, st_order*, List<TABLE_LIST>&, unsigned long long))[0x56554c56656b]
      sql_select.cc:0(make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*))[0x56554c508744]
      ??:0(JOIN::optimize_inner())[0x56554c5027db]
      ??:0(JOIN::optimize())[0x56554c4fd5d6]
      ??:0(st_select_lex::optimize_unflattened_subqueries(bool))[0x56554c44916c]
      ??:0(JOIN::optimize_stage2())[0x56554c4ff3c4]
      ??:0(JOIN::optimize_inner())[0x56554c50232b]
      ??:0(JOIN::optimize())[0x56554c4fd5d6]
      ??:0(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x56554c4f3048]
      ??:0(mysql_multi_update(THD*, TABLE_LIST*, List<Item>*, List<Item>*, Item*, unsigned long long, enum_duplicates, bool, st_select_lex_unit*, st_select_lex*, multi_update**))[0x56554c611053]
      ??:0(mysql_execute_command(THD*, bool))[0x56554c492722]
      ??:0(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x56554c481aa2]
      ??:0(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x56554c47f01b]
      ??:0(do_command(THD*, bool))[0x56554c4821d1]
      ??:0(do_handle_one_connection(CONNECT*, bool))[0x56554c68edc5]
      ??:0(handle_one_connection)[0x56554c68e9f7]
      :0(pfs_spawn_thread)[0x56554cc1582f]
      ??:0(pthread_condattr_setpshared)[0x7f02baa5ab43]
      ??:0(clone)[0x7f02baaebbb4]
      

      Trying to get some variables.

      Attachments

        Issue Links

          Activity

            People

              psergei Sergei Petrunia
              Ne0 Yongheng Chen
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.