Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-37649

Crash at my_free

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Duplicate
    • 12.1.1
    • N/A
    • JSON, Server
    • Ubuntu 20.04 x86-64, docker image mariadb:12.1.1
    • Not for Release Notes

    Description

      PoC:

      SELECT * FROM x , x ; 
      SELECT 'SM PKG' AS x GROUP BY JSON_SCHEMA_VALID ( '{"properties": "a_string": {"pattern": "^[5-9]$"}}}' , '{"a_string": "8"}' ) HAVING EXTRACTVALUE ( ( SELECT 1 AS x UNION SELECT 1 UNION SELECT 1 ORDER BY 1 ) , 'a' ) > 1 UNION SELECT 1 UNION SELECT 1 ORDER BY ( SELECT x ORDER BY 1 ) ; 
      ALTER TABLE FORCE ;
      

      docker log:

      #0 0x56b4b5b81602 (my_free+0x32)
      #1 0x56b4b5b4482d (delete_dynamic+0x4d)
      #2 0x56b4b5b4c84c (my_hash_free+0xdc)
      #3 0x56b4b50a8b33 (_ZN22Json_schema_propertiesD0Ev+0x43)
      #4 0x56b4b508b816 (_ZN27Item_func_json_schema_valid7cleanupEv+0x66)
      #5 0x56b4b4d0fa90 (_ZN3THD19cleanup_after_queryEv+0x3b0)
      #6 0x56b4b4daa9d1 (_Z16dispatch_command19enum_server_commandP3THDPcjb+0x16b1)
      #7 0x56b4b4daecd1 (_Z10do_commandP3THDb+0x4b1)
      #8 0x56b4b4fe4b74 (_Z24do_handle_one_connectionP7CONNECTb+0x2a4)
      #9 0x56b4b4fe47a3 (handle_one_connection+0xd3)
      #10 0x56b4b56ad0b4 (pfs_spawn_thread+0x104)
      #11 0x7d5a0236d609 (start_thread+0xd9)
      #12 0x7d5a0208f353 (clone+0x43)
      

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              Yuxiao Guo Yuxiao Guo
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.