Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Cannot Reproduce
-
11.4.0
-
None
-
ubuntu20.04,x86
-
Not for Release Notes
Description
A segmentation fault occurs in JOIN::make_sum_func_list() (sql/sql_select.cc:28560) due to a missing null pointer check on a SELECT item. When MariaDB processes an aggregation query (SUM, COUNT, etc.), an invalid or null item in the field_list leads to item->type() being called on a null pointer, resulting in a crash. This can be triggered by malformed or corrupted subqueries, allowing a remote authenticated attacker to cause a denial-of-service (DoS).
Attachments
Issue Links
- duplicates
-
MDEV-33177 Assertion `!order->item[0]->with_sum_func()' failed
-
- Confirmed
-