Details
-
Bug
-
Status: Confirmed (View Workflow)
-
Critical
-
Resolution: Unresolved
-
11.8.1
-
None
Description
This crash occurs in MariaDB when parsing a malformed CREATE PROCEDURE statement containing a complex and invalid subquery expression. Specifically, the issue arises in the Item_subselect::init() function, where an uninitialized or null outer_select pointer is dereferenced, leading to a segmentation fault (SIGSEGV). The backtrace shows that the crash is triggered during the construction of an Item_allany_subselect object while handling the expression ROW(1, 2) = SOME(SELECT 1) = ALL(SELECT 1). This invalid combination of subquery predicates is not properly validated by the parser, resulting in unsafe access to internal structures. The bug highlights a lack of defensive checks in subquery initialization logic.
Attachments
Issue Links
- relates to
-
MDEV-36875 a malformed KILL cause a denial of service
-
- Confirmed
-