Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-39909

MariaDB crash triggered by recursive CTE with POW, GET_LOCK, and ExtractValue

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Duplicate
    • 10.11, 11.4, 11.8, 12.3, 12.3.2
    • N/A
    • Optimizer
    • Linux x86_64, Docker container
    • Not for Release Notes

    Description

      ~~~sql
      SELECT LOWER ( ( SELECT x FROM x WHERE x IN ( SELECT x FROM x ) ORDER BY x LIMIT 1 ) ) ; SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT x + 1 FROM x ) SELECT POW ( 46 , DATE ( NULL ) ) EXCEPT SELECT x FROM x UNION SELECT x FROM x GROUP BY x HAVING x = x AND x = 1 AND extractValue ( CASE WHEN timediff ( x , LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT 1 EXCEPT SELECT GET_LOCK ( NULL , 0 ) ) SELECT DISTINCT x FROM ( SELECT 1 ) AS x WHERE x IN ( SELECT x FROM x ) ORDER BY CONCAT_WS ( '' , x , x , 'lp-lpi' ) < '222' LIMIT 1 ) ) ) IN ( - x , -1 , 0 , 1 , x ) THEN TRUE ELSE FALSE END , '/a/@b[2>=position()]' ) ORDER BY x ) SELECT x FROM x WHERE NOT ( NOT ( x > 10 ) ) AND ( x < 1 OR x > 1 ) AND x IN ( SELECT * FROM x WHERE x >= -869367531 ) AND x IN ( SELECT ceil ( x ) AS x FROM x GROUP BY x , x HAVING x = 1 ) ORDER BY x ) ) ;
      ~~~

        1. Expected result
          The server should either execute the query or return a normal SQL error without crashing.
        1. Actual result
          The fuzzing run observed a server crash. The deduplicated stack signature is:
          ~~~
          stack:_ZL13add_key_fieldP4JOINPP9KEY_FIELDjP14Item_bool_funcP5FieldbPP4ItemjyPP14SARGABLE_PARAMj|_ZN10Item_equal14add_key_fieldsEP4JOINPP9KEY_FIELDPjyPP14SARGABLE_PARAM|_ZL19update_ref_and_keysP3THDP16st_dynamic_arrayP13st_join_tablejP4ItemyP13st_select_lexPP14SARGABLE_PARAM|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZN13st_select_lex31optimize_unflattened_subqueriesEb|_ZN4JOIN15optimize_stage2Ev|_ZN18st_select_lex_unit8optimizeEv
          ~~~

      Top frames:
      ~~~
      _ZL13add_key_fieldP4JOINPP9KEY_FIELDjP14Item_bool_funcP5FieldbPP4ItemjyPP14SARGABLE_PARAMj
      _ZN10Item_equal14add_key_fieldsEP4JOINPP9KEY_FIELDPjyPP14SARGABLE_PARAM
      _ZL19update_ref_and_keysP3THDP16st_dynamic_arrayP13st_join_tablejP4ItemyP13st_select_lexPP14SARGABLE_PARAM
      _ZN4JOIN14optimize_innerEv
      _ZN4JOIN8optimizeEv
      _ZN13st_select_lex31optimize_unflattened_subqueriesEb
      _ZN4JOIN15optimize_stage2Ev
      _ZN18st_select_lex_unit8optimizeEv
      ~~~

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              maohaogang maohaogang
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.