Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-39900

MariaDB crash triggered by RANDOM_BYTES with window function and CASE expression

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Duplicate
    • 10.11, 11.4, 11.8, 12.3, 12.3.2
    • N/A
    • Optimizer
    • Linux x86_64, Docker container
    • Not for Release Notes

    Description

      ~~~sql
      SELECT DISTINCT x , tan ( radians ( x ) ) , CASE WHEN tan ( radians ( x ) ) IN ( - x , -1 , 0 , 1 , x ) THEN TRUE ELSE ROW_NUMBER ( ) OVER ( ) END AS x , 1 % tan ( radians ( x ) ) , CASE WHEN 1 / tan ( radians ( x ) ) IN ( - x , -1 , 0 , 1 , x ) THEN TRUE ELSE FALSE END AS x FROM ( SELECT 0 AS x UNION SELECT 45 UNION SELECT 90 UNION SELECT 135 UNION SELECT CAST( 1 AS DECIMAL ) UNION SELECT 225 UNION SELECT 270 UNION SELECT x FROM ( SELECT * FROM ( SELECT 1 AS x UNION SELECT RANDOM_BYTES ( 1025 ) UNION SELECT 3 UNION SELECT 4 UNION SELECT HEX ( EXP ( '192.168.1.2' ) ) ) AS x GROUP BY x HAVING x LIKE 'x' AND NOT x ) AS x UNION SELECT 360 ) AS x GROUP BY x , x HAVING x = 1 LIMIT 2 , 2 ;
      ~~~

        1. Expected result
          The server should either execute the query or return a normal SQL error without crashing.
        1. Actual result
          The fuzzing run observed a server crash. The deduplicated stack signature is:
          ~~~
          stack:_ZN13Item_func_not10fix_fieldsEP3THDPP4Item|_ZN13st_select_lex31pushdown_from_having_into_whereEP3THDP4Item|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZL22mysql_derived_optimizeP3THDP3LEXP10TABLE_LIST|_Z27mysql_handle_single_derivedP3LEXP10TABLE_LISTj|_ZN18st_select_lex_unit8optimizeEv|_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex
          ~~~

      Attachments

        Issue Links

          Activity

            People

              shipjain Shipra Jain
              maohaogang maohaogang
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.