Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Duplicate
-
10.11, 11.4, 11.8, 12.3, 12.3.2
-
Linux x86_64, Docker container
-
Not for Release Notes
Description
~~~sql
SELECT LOWER ( ( SELECT x FROM x WHERE x IN ( SELECT x FROM x ) ORDER BY x LIMIT 1 ) ) ; SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT x + 1 FROM x ) SELECT POW ( 46 , DATE ( NULL ) ) EXCEPT SELECT x FROM x UNION SELECT x FROM x GROUP BY x HAVING x = x AND x = 1 AND extractValue ( CASE WHEN timediff ( x , LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT 1 EXCEPT SELECT GET_LOCK ( NULL , 0 ) ) SELECT DISTINCT x FROM ( SELECT 1 ) AS x WHERE x IN ( SELECT x FROM x ) ORDER BY CONCAT_WS ( '' , x , x , 'lp-lpi' ) < '222' LIMIT 1 ) ) ) IN ( - x , -1 , 0 , 1 , x ) THEN TRUE ELSE FALSE END , '/a/@b[2>=position()]' ) ORDER BY x ) SELECT x FROM x WHERE NOT ( NOT ( x > 10 ) ) AND ( x < 1 OR x > 1 ) AND x IN ( SELECT * FROM x WHERE x >= -869367531 ) AND x IN ( SELECT ceil ( x ) AS x FROM x GROUP BY x , x HAVING x = 1 ) ORDER BY x ) ) ;
~~~
-
- Expected result
The server should either execute the query or return a normal SQL error without crashing.
- Expected result
-
- Actual result
The fuzzing run observed a server crash. The deduplicated stack signature is:
~~~
stack:_ZL13add_key_fieldP4JOINPP9KEY_FIELDjP14Item_bool_funcP5FieldbPP4ItemjyPP14SARGABLE_PARAMj|_ZN10Item_equal14add_key_fieldsEP4JOINPP9KEY_FIELDPjyPP14SARGABLE_PARAM|_ZL19update_ref_and_keysP3THDP16st_dynamic_arrayP13st_join_tablejP4ItemyP13st_select_lexPP14SARGABLE_PARAM|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZN13st_select_lex31optimize_unflattened_subqueriesEb|_ZN4JOIN15optimize_stage2Ev|_ZN18st_select_lex_unit8optimizeEv
~~~
- Actual result
Top frames:
~~~
_ZL13add_key_fieldP4JOINPP9KEY_FIELDjP14Item_bool_funcP5FieldbPP4ItemjyPP14SARGABLE_PARAMj
_ZN10Item_equal14add_key_fieldsEP4JOINPP9KEY_FIELDPjyPP14SARGABLE_PARAM
_ZL19update_ref_and_keysP3THDP16st_dynamic_arrayP13st_join_tablejP4ItemyP13st_select_lexPP14SARGABLE_PARAM
_ZN4JOIN14optimize_innerEv
_ZN4JOIN8optimizeEv
_ZN13st_select_lex31optimize_unflattened_subqueriesEb
_ZN4JOIN15optimize_stage2Ev
_ZN18st_select_lex_unit8optimizeEv
~~~
Attachments
Issue Links
- duplicates
-
MDEV-32848 Server crash via Item_equal::add_key_fields in /sql/sql_bitmap.h:196, member access within null pointer of type 'struct JOIN_TAB' in add_key_field
-
- Stalled
-