Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36876

Crash during the Item_subselect::init - outer_select is NULL

    XMLWordPrintable

Details

    • Bug
    • Status: Confirmed (View Workflow)
    • Critical
    • Resolution: Unresolved
    • 11.8.1
    • 11.8
    • Server
    • None

    Description

      This crash occurs in MariaDB when parsing a malformed CREATE PROCEDURE statement containing a complex and invalid subquery expression. Specifically, the issue arises in the Item_subselect::init() function, where an uninitialized or null outer_select pointer is dereferenced, leading to a segmentation fault (SIGSEGV). The backtrace shows that the crash is triggered during the construction of an Item_allany_subselect object while handling the expression ROW(1, 2) = SOME(SELECT 1) = ALL(SELECT 1). This invalid combination of subquery predicates is not properly validated by the parser, resulting in unsafe access to internal structures. The bug highlights a lack of defensive checks in subquery initialization logic.

      Attachments

        1. gdb.log
          3 kB
          yx
        2. poc.sql
          0.1 kB
          yx

        Issue Links

          Activity

            People

              sanja Oleksandr Byelkin
              yx yx
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.