Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36876

Crash during the Item_subselect::init - outer_select is NULL

    XMLWordPrintable

Details

    • Can result in hang or crash
    • Q1/2026 Server Maintenance

    Description

      This crash occurs in MariaDB when parsing a malformed CREATE PROCEDURE statement containing a complex and invalid subquery expression. Specifically, the issue arises in the Item_subselect::init() function, where an uninitialized or null outer_select pointer is dereferenced, leading to a segmentation fault (SIGSEGV). The backtrace shows that the crash is triggered during the construction of an Item_allany_subselect object while handling the expression ROW(1, 2) = SOME(SELECT 1) = ALL(SELECT 1). This invalid combination of subquery predicates is not properly validated by the parser, resulting in unsafe access to internal structures. The bug highlights a lack of defensive checks in subquery initialization logic.

      create procedure test_proc (id varchar(255))
      begin
        declare dt datetime(6) default row(1, 2) = some(select 1) = all(select 1);
      

      Attachments

        1. poc.sql
          0.1 kB
        2. gdb.log
          3 kB

        Issue Links

          Activity

            People

              midenok Aleksey Midenkov
              yx yx
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.