Details
Description
This crash occurs in MariaDB when parsing a malformed KILL statement that includes an illogical combination of predicates and subquery expressions. The crash is triggered in the Item_subselect::init() function due to a null or uninitialized outer_select pointer being dereferenced. Specifically, an Item_in_subselect object is constructed without proper validation of the surrounding expression, leading to unsafe access in the subquery initialization logic. The triggering SQL includes a mix of IN (SELECT ...), SOUNDS LIKE, NOT REGEXP, and other predicates in an invalid logical context, which the parser does not reject. As a result, the server encounters a segmentation fault (SIGSEGV) during parsing. This issue highlights a lack of robust sanity checks for malformed expressions involving subqueries.
Attachments
Issue Links
- relates to
-
MDEV-36876 Crash during the Item_subselect::init - outer_select is NULL
-
- Confirmed
-