Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36875

a malformed KILL cause a denial of service

    XMLWordPrintable

Details

    Description

      This crash occurs in MariaDB when parsing a malformed KILL statement that includes an illogical combination of predicates and subquery expressions. The crash is triggered in the Item_subselect::init() function due to a null or uninitialized outer_select pointer being dereferenced. Specifically, an Item_in_subselect object is constructed without proper validation of the surrounding expression, leading to unsafe access in the subquery initialization logic. The triggering SQL includes a mix of IN (SELECT ...), SOUNDS LIKE, NOT REGEXP, and other predicates in an invalid logical context, which the parser does not reject. As a result, the server encounters a segmentation fault (SIGSEGV) during parsing. This issue highlights a lack of robust sanity checks for malformed expressions involving subqueries.

      Attachments

        1. gdb.log
          3 kB
        2. poc.sql
          0.0 kB

        Issue Links

          Activity

            People

              sanja Oleksandr Byelkin
              yx yx
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.