Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-39893

MariaDB crash triggered by recursive CTE with GET_LOCK and CASE predicate

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Duplicate
    • 12.3.2
    • N/A
    • Optimizer, Server
    • None
    • Linux x86_64, Docker container
    • Not for Release Notes

    Description

      ~~~sql
      SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT 1 EXCEPT SELECT GET_LOCK ( NULL , 0 ) ) SELECT x FROM x WHERE x IN ( SELECT x FROM x GROUP BY x HAVING x = 'ffffffffff7fffff' ) ORDER BY x LIMIT 1 ) ) ; SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT * FROM ( SELECT 'test1' AS x UNION SELECT 'test2' ) AS x WHERE ( x = 3 AND x = 2 AND x = 1 ) OR ( x = CASE WHEN ( SELECT ( 1 ) WHERE x IS NULL OR ( 1 = x ) GROUP BY 'x' ) - 1 THEN ( 1 ^ x ) ELSE CASE WHEN CASE WHEN 1 NOT IN ( SELECT 1.000000 WHERE SEC_TO_TIME ( 39050.121094 ) = x GROUP BY x HAVING x >= 1 UNION SELECT CAST( ( 1 ) AS VARCHAR ( 1 ) ) ) THEN 1 ELSE 1 END THEN 1 WHEN 'x' LIKE 'x' THEN 1 END END AND x = 3 AND x = 1 ) OR ( CONCAT ( x , '::regclass' ) AND CURRENT_TIME ( 6 ) = x OR hex ( x ) < hex ( lower ( x ) ) AND x = 3 ) OR ( x = 2 AND x = 1 AND x = 3 ) ) SELECT x FROM x WHERE x NOT IN ( SELECT x FROM x ) ORDER BY x ) ) ;
      ~~~

        1. Expected result
          The server should either execute the query or return a normal SQL error without crashing.
        1. Actual result
          The fuzzing run observed a server crash. The deduplicated stack signature is:
          ~~~
          stack:Z17setup_copy_fieldsP3THDP15TMP_TABLE_PARAM20Bounds_checked_arrayIP4ItemER4ListIS4_ES9_jS9|_ZN4JOIN21make_aggr_tables_infoEv|_ZN4JOIN15optimize_stage2Ev|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZN13st_select_lex31optimize_unflattened_subqueriesEb|_ZN13st_select_lex28optimize_constant_subqueriesEv|_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex
          ~~~

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              maohaogang maohaogang
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.