Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Duplicate
-
10.11, 11.4, 11.8, 12.3, 12.3.2
-
Linux x86_64, Docker container
-
Not for Release Notes
Description
~~~sql
SELECT DISTINCT x , tan ( radians ( x ) ) , CASE WHEN tan ( radians ( x ) ) IN ( - x , -1 , 0 , 1 , x ) THEN TRUE ELSE ROW_NUMBER ( ) OVER ( ) END AS x , 1 % tan ( radians ( x ) ) , CASE WHEN 1 / tan ( radians ( x ) ) IN ( - x , -1 , 0 , 1 , x ) THEN TRUE ELSE FALSE END AS x FROM ( SELECT 0 AS x UNION SELECT 45 UNION SELECT 90 UNION SELECT 135 UNION SELECT CAST( 1 AS DECIMAL ) UNION SELECT 225 UNION SELECT 270 UNION SELECT x FROM ( SELECT * FROM ( SELECT 1 AS x UNION SELECT RANDOM_BYTES ( 1025 ) UNION SELECT 3 UNION SELECT 4 UNION SELECT HEX ( EXP ( '192.168.1.2' ) ) ) AS x GROUP BY x HAVING x LIKE 'x' AND NOT x ) AS x UNION SELECT 360 ) AS x GROUP BY x , x HAVING x = 1 LIMIT 2 , 2 ;
~~~
-
- Expected result
The server should either execute the query or return a normal SQL error without crashing.
- Expected result
-
- Actual result
The fuzzing run observed a server crash. The deduplicated stack signature is:
~~~
stack:_ZN13Item_func_not10fix_fieldsEP3THDPP4Item|_ZN13st_select_lex31pushdown_from_having_into_whereEP3THDP4Item|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZL22mysql_derived_optimizeP3THDP3LEXP10TABLE_LIST|_Z27mysql_handle_single_derivedP3LEXP10TABLE_LISTj|_ZN18st_select_lex_unit8optimizeEv|_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex
~~~
- Actual result
Attachments
Issue Links
- duplicates
-
MDEV-39916 MariaDB crash triggered by INFORMATION_SCHEMA query with ExtractValue and GIS predicate
-
- Confirmed
-
- relates to
-
MDEV-39863 Crash in Item_func_not::fix_fields on HAVING (NOT a) AND TRUE
-
- Closed
-
-
MDEV-39916 MariaDB crash triggered by INFORMATION_SCHEMA query with ExtractValue and GIS predicate
-
- Confirmed
-