Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-33783

Server crashes when executing SQL on a system table with wrong structure

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Critical
    • Resolution: Unresolved
    • 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5
    • 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2, 11.3, 11.4
    • None
    • None

    Description

      CREATE OR REPLACE TABLE mysql.servers ( c0 BLOB NOT NULL,INDEX (c0) );
      CREATE SERVER s1 FOREIGN DATA WRAPPER foo OPTIONS(USER 'a');
      

      Leads to:

      11.5.0 8f0c9340537b84fcd7012d4a31e6f858e7eb919c (Optimized)

      Core was generated by `/test/MD200324-mariadb-11.5.0-linux-x86_64-opt/bin/mariadbd --no-defaults --max'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x0000557824887a13 in store_server_fields (
          table=table@entry=0x557827b5a2d8, server=server@entry=0x1481e004a5a0)
          at /test/server_opt/sql/sql_servers.cc:572
      [Current thread is 1 (Thread 0x148214129700 (LWP 3496106))]
      (gdb) bt
      #0  0x0000557824887a13 in store_server_fields (table=table@entry=0x557827b5a2d8, server=server@entry=0x1481e004a5a0) at /test/server_opt/sql/sql_servers.cc:572
      #1  0x0000557824888625 in insert_server_record (server=0x1481e004a5a0, table=0x557827b5a2d8) at /test/server_opt/sql/sql_servers.cc:650
      #2  insert_server (thd=thd@entry=0x1481e0000c58, server=server@entry=0x1481e004a5a0) at /test/server_opt/sql/sql_servers.cc:489
      #3  0x0000557824888ca4 in create_server (thd=thd@entry=0x1481e0000c58, server_options=server_options@entry=0x1481e00066a8) at /test/server_opt/sql/sql_servers.cc:1251
      #4  0x000055782475da1a in mysql_execute_command (thd=0x1481e0000c58, is_called_from_prepared_stmt=<optimized out>) at /test/server_opt/sql/sql_parse.cc:5738
      #5  0x000055782474ae16 in mysql_parse (thd=0x1481e0000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/server_opt/sql/sql_parse.cc:7821
      #6  0x00005578247576f5 in dispatch_command (command=COM_QUERY, thd=0x1481e0000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/server_opt/sql/sql_class.h:1636
      #7  0x0000557824759b4e in do_command (thd=0x1481e0000c58, blocking=blocking@entry=true) at /test/server_opt/sql/sql_parse.cc:1405
      #8  0x000055782488c957 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/server_opt/sql/sql_connect.cc:1447
      #9  0x000055782488cc9d in handle_one_connection (arg=arg@entry=0x557827df8678) at /test/server_opt/sql/sql_connect.cc:1349
      #10 0x0000557824c4020c in pfs_spawn_thread (arg=0x557827e1de08) at /test/server_opt/storage/perfschema/pfs.cc:2201
      #11 0x0000148229dec609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #12 0x00001482299d8133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      11.4.2 058510a62ff9056223685d2bc544c6bff13d226f (Optimized, UBASAN)

      /test/server_opt_san/sql/sql_servers.cc:570:27: runtime error: member call on null pointer of type 'struct Field'
          #0 0x55e5d6b29b1e in store_server_fields /test/server_opt_san/sql/sql_servers.cc:570
          #1 0x55e5d6b30520 in insert_server_record /test/server_opt_san/sql/sql_servers.cc:648
          #2 0x55e5d6b30520 in insert_server /test/server_opt_san/sql/sql_servers.cc:487
          #3 0x55e5d6b31be1 in create_server(THD*, st_lex_server_options*) /test/server_opt_san/sql/sql_servers.cc:1118
          #4 0x55e5d61fe4e0 in mysql_execute_command(THD*, bool) /test/server_opt_san/sql/sql_parse.cc:5732
          #5 0x55e5d61811d0 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/server_opt_san/sql/sql_parse.cc:7815
          #6 0x55e5d61d6b00 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/server_opt_san/sql/sql_parse.cc:1893
          #7 0x55e5d61e279d in do_command(THD*, bool) /test/server_opt_san/sql/sql_parse.cc:1406
          #8 0x55e5d6b471bd in do_handle_one_connection(CONNECT*, bool) /test/server_opt_san/sql/sql_connect.cc:1437
          #9 0x55e5d6b4982c in handle_one_connection /test/server_opt_san/sql/sql_connect.cc:1339
          #10 0x14f53df45608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
          #11 0x14f53d1ba132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
      

      Bug confirmed present in:
      MariaDB: 10.4.34 (opt), 10.5.25 (dbg), 10.5.25 (opt), 10.6.18 (dbg), 10.6.18 (opt), 10.11.8 (dbg), 10.11.8 (opt), 11.0.6 (dbg), 11.0.6 (opt), 11.1.4 (dbg), 11.1.4 (opt), 11.2.4 (dbg), 11.2.4 (opt), 11.3.2 (dbg), 11.3.2 (opt), 11.4.2 (dbg), 11.4.2 (opt), 11.5.0 (dbg), 11.5.0 (opt)

      Attachments

        Activity

          People

            nikitamalyavin Nikita Malyavin
            ramesh Ramesh Sivaraman
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.