Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Duplicate
-
12.3.2
-
None
-
Linux x86_64, Docker container
-
Not for Release Notes
Description
~~~sql
SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT 1 EXCEPT SELECT GET_LOCK ( NULL , 0 ) ) SELECT x FROM x WHERE x IN ( SELECT x FROM x GROUP BY x HAVING x = 'ffffffffff7fffff' ) ORDER BY x LIMIT 1 ) ) ; SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT * FROM ( SELECT 'test1' AS x UNION SELECT 'test2' ) AS x WHERE ( x = 3 AND x = 2 AND x = 1 ) OR ( x = CASE WHEN ( SELECT ( 1 ) WHERE x IS NULL OR ( 1 = x ) GROUP BY 'x' ) - 1 THEN ( 1 ^ x ) ELSE CASE WHEN CASE WHEN 1 NOT IN ( SELECT 1.000000 WHERE SEC_TO_TIME ( 39050.121094 ) = x GROUP BY x HAVING x >= 1 UNION SELECT CAST( ( 1 ) AS VARCHAR ( 1 ) ) ) THEN 1 ELSE 1 END THEN 1 WHEN 'x' LIKE 'x' THEN 1 END END AND x = 3 AND x = 1 ) OR ( CONCAT ( x , '::regclass' ) AND CURRENT_TIME ( 6 ) = x OR hex ( x ) < hex ( lower ( x ) ) AND x = 3 ) OR ( x = 2 AND x = 1 AND x = 3 ) ) SELECT x FROM x WHERE x NOT IN ( SELECT x FROM x ) ORDER BY x ) ) ;
~~~
-
- Expected result
The server should either execute the query or return a normal SQL error without crashing.
- Expected result
-
- Actual result
The fuzzing run observed a server crash. The deduplicated stack signature is:
~~~
stack:Z17setup_copy_fieldsP3THDP15TMP_TABLE_PARAM20Bounds_checked_arrayIP4ItemER4ListIS4_ES9_jS9|_ZN4JOIN21make_aggr_tables_infoEv|_ZN4JOIN15optimize_stage2Ev|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZN13st_select_lex31optimize_unflattened_subqueriesEb|_ZN13st_select_lex28optimize_constant_subqueriesEv|_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex
~~~
- Actual result
Attachments
Issue Links
- duplicates
-
MDEV-39887 MariaDB crash triggered by nested recursive CTE with GIS geohash and window expression
-
- Confirmed
-