Details
-
Bug
-
Status: In Review (View Workflow)
-
Major
-
Resolution: Unresolved
-
12.3.2
-
Linux x86_64, Docker container
-
Q2/2026 Server Development, Q3/2026 Server Maintenance
Description
~~~sql
SELECT ST_ASTEXT ( ST_CONVEXHULL ( ST_GEOMFROMTEXT ( x ) ) ) ; SELECT ST_ASTEXT ( ST_CONVEXHULL ( ST_GEOMFROMTEXT ( x ) ) ) ; SELECT ST_ASTEXT ( ST_CONVEXHULL ( ST_GEOMFROMTEXT ( 'LINESTRING(0 0,-0.00 0,0.0 0)' ) ) ) ; SELECT ST_ASTEXT ( ST_CONVEXHULL ( ST_GEOMFROMTEXT ( 'LINESTRING(0 0,0 5,5 5,5 0,0 0)' ) ) ) ; SELECT CONCAT_WS ( ST_SIMPLIFY ( ST_GEOMFROMTEXT ( 'MULTILINESTRING((0 0,5 5,0 10),(0 0,-5 5,0 10))' ) , 5 ) , 7 , 5 ) ;
~~~
-
- Expected result
The server should either execute the query or return a normal SQL error without crashing.
- Expected result
-
- Actual result
The fuzzing run observed a server crash. The deduplicated stack signature is:
~~~
stack:pthread_kill|raise|abort|_fsetlocking|fortify_fail|_stack_chk_fail|_ZN19Item_func_concat_ws7val_strEP6String|_ZNK12Type_handler13Item_send_strEP4ItemP8ProtocolP8st_value
~~~
- Actual result
Top frames:
~~~
pthread_kill
raise
abort
__fsetlocking
__fortify_fail
__stack_chk_fail
_ZN19Item_func_concat_ws7val_strEP6String
_ZNK12Type_handler13Item_send_strEP4ItemP8ProtocolP8st_value
~~~
Attachments
Issue Links
- relates to
-
MDEV-34141 Implement the GIS function ST_Simplify
-
- Closed
-
-
MDEV-39914 MariaDB crash triggered by INFORMATION_SCHEMA query with ROW_NUMBER and GIS simplify
-
- In Review
-