Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36875

KILL with nested subqueries crash server

    XMLWordPrintable

Details

    Description

      This crash occurs in MariaDB when parsing a malformed KILL statement that includes an illogical combination of predicates and subquery expressions. The crash is triggered in the Item_subselect::init() function due to a null or uninitialized outer_select pointer being dereferenced. Specifically, an Item_in_subselect object is constructed without proper validation of the surrounding expression, leading to unsafe access in the subquery initialization logic. The triggering SQL includes a mix of IN (SELECT ...), SOUNDS LIKE, NOT REGEXP, and other predicates in an invalid logical context, which the parser does not reject. As a result, the server encounters a segmentation fault (SIGSEGV) during parsing. This issue highlights a lack of robust sanity checks for malformed expressions involving subqueries.

      Attachments

        1. gdb.log
          3 kB
        2. poc.sql
          0.0 kB

        Issue Links

          Activity

            People

              sanja Oleksandr Byelkin
              yx yx
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - 0d
                  0d
                  Remaining:
                  Time Spent - 5h 10m Remaining Estimate - 1d
                  1d
                  Logged:
                  Time Spent - 5h 10m Remaining Estimate - 1d
                  5h 10m

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.