Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-39889

MariaDB crash triggered by GIS and JSON/XML predicates inside set-operation query

    XMLWordPrintable

Details

    • Bug
    • Status: Confirmed (View Workflow)
    • Major
    • Resolution: Unresolved
    • 10.11, 11.4, 11.8, 12.3, 12.3.2
    • 10.11, 11.4, 11.8, 12.3
    • Optimizer
    • None
    • Linux x86_64, Docker container

    Description

      SELECT * FROM ( SELECT x FROM ( SELECT * FROM ( SELECT 1 AS x UNION SELECT 2 UNION SELECT 3 UNION SELECT 4 INTERSECT SELECT ST_ASTEXT ( ST_ENVELOPE ( ST_GEOMFROMTEXT ( 'MULTILINESTRING((0 0,0 5,5 5,5 0,0 0))' ) ) ) ) AS x ) AS x GROUP BY x , x HAVING x = CASE WHEN ( SELECT ( 1 ) WHERE x IS NULL OR ST_LONGFROMGEOHASH ( ST_GEOHASH ( -180 , 0 , 20 ) ) GROUP BY 'x' ) - 1 THEN ( 1 ^ x ) ELSE CASE WHEN CASE WHEN extractvalue ( '<a>A<b>B1</b><b>B2</b></a>' , '/a/b[count(.)=1]' ) NOT IN ( SELECT * FROM ( SELECT 2 UNION SELECT 3 UNION SELECT 'LINESTRING(0 0,-0.00 0)' ) AS x GROUP BY x HAVING NOT NOT ( x ) ) THEN 1 ELSE 1 END THEN 1 WHEN 'x' LIKE 'x' THEN 1 END END EXCEPT SELECT x FROM ( SELECT * FROM ( SELECT 1 AS x UNION SELECT 2 UNION SELECT 3 ) AS x ) AS x ) AS x ;
      

        1. Expected result
          The server should either execute the query or return a normal SQL error without crashing.
        1. Actual result
          The fuzzing run observed a server crash. The deduplicated stack signature is:

          stack:_ma_unique_hash|maria_write|_ZN7handler16ha_write_tmp_rowEPh|_ZL9end_writeP4JOINP13st_join_tableb|_ZL20evaluate_join_recordP4JOINP13st_join_tablei|_Z10sub_selectP4JOINP13st_join_tableb|_ZN4JOIN10exec_innerEv|_ZN4JOIN4execEv
          

      Top frames:

      _ma_unique_hash
      maria_write
      _ZN7handler16ha_write_tmp_rowEPh
      _ZL9end_writeP4JOINP13st_join_tableb
      _ZL20evaluate_join_recordP4JOINP13st_join_tablei
      _Z10sub_selectP4JOINP13st_join_tableb
      _ZN4JOIN10exec_innerEv
      _ZN4JOIN4execEv
      

      Attachments

        Issue Links

          Activity

            People

              psergei Sergei Petrunia
              maohaogang maohaogang
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.