Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36577

a NULL pointer dereference lies in the Window_funcs_sort::setup function in sql/sql_window.cc at line 3092

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Critical
    • Resolution: Duplicate
    • 11.4.0
    • N/A
    • Optimizer
    • None
    • ubuntu20.04,x86
    • Not for Release Notes

    Description

      This vulnerability in MariaDB lies in the Window_funcs_sort::setup function in sql/sql_window.cc at line 3092. It results from dereferencing a null pointer spec->partition_list without prior validation. When the SELECT query contains window functions with improperly initialized or missing partition specifications, the server crashes due to a segmentation fault, leading to a potential denial-of-service (DoS).

      Attachments

        Issue Links

          duplicates

          Bug - A problem which impairs or prevents the functions of the product. MDEV-32609 Derived subquery selecting from dummy table causes segv

          • Major - Major loss of function.
          • Confirmed

          Activity

            People

              Unassigned Unassigned
              yx yx
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.