Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36583

A segmentation fault occurs in JOIN::make_sum_func_list() (sql/sql_select.cc:28560)

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Critical
    • Resolution: Cannot Reproduce
    • 11.4.0
    • N/A
    • Optimizer
    • None
    • ubuntu20.04,x86
    • Not for Release Notes

    Description

      A segmentation fault occurs in JOIN::make_sum_func_list() (sql/sql_select.cc:28560) due to a missing null pointer check on a SELECT item. When MariaDB processes an aggregation query (SUM, COUNT, etc.), an invalid or null item in the field_list leads to item->type() being called on a null pointer, resulting in a crash. This can be triggered by malformed or corrupted subqueries, allowing a remote authenticated attacker to cause a denial-of-service (DoS).

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              yx yx
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.