Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-39911

MariaDB crash triggered by ST_CONVEXHULL and ST_SIMPLIFY string concatenation

    XMLWordPrintable

Details

    • Can result in hang or crash
    • Q2/2026 Server Development, Q3/2026 Server Maintenance

    Description

      ~~~sql
      SELECT ST_ASTEXT ( ST_CONVEXHULL ( ST_GEOMFROMTEXT ( x ) ) ) ; SELECT ST_ASTEXT ( ST_CONVEXHULL ( ST_GEOMFROMTEXT ( x ) ) ) ; SELECT ST_ASTEXT ( ST_CONVEXHULL ( ST_GEOMFROMTEXT ( 'LINESTRING(0 0,-0.00 0,0.0 0)' ) ) ) ; SELECT ST_ASTEXT ( ST_CONVEXHULL ( ST_GEOMFROMTEXT ( 'LINESTRING(0 0,0 5,5 5,5 0,0 0)' ) ) ) ; SELECT CONCAT_WS ( ST_SIMPLIFY ( ST_GEOMFROMTEXT ( 'MULTILINESTRING((0 0,5 5,0 10),(0 0,-5 5,0 10))' ) , 5 ) , 7 , 5 ) ;
      ~~~

        1. Expected result
          The server should either execute the query or return a normal SQL error without crashing.
        1. Actual result
          The fuzzing run observed a server crash. The deduplicated stack signature is:
          ~~~
          stack:pthread_kill|raise|abort|_fsetlocking|fortify_fail|_stack_chk_fail|_ZN19Item_func_concat_ws7val_strEP6String|_ZNK12Type_handler13Item_send_strEP4ItemP8ProtocolP8st_value
          ~~~

      Top frames:
      ~~~
      pthread_kill
      raise
      abort
      __fsetlocking
      __fortify_fail
      __stack_chk_fail
      _ZN19Item_func_concat_ws7val_strEP6String
      _ZNK12Type_handler13Item_send_strEP4ItemP8ProtocolP8st_value
      ~~~

      Attachments

        Issue Links

          Activity

            People

              Gosselin Dave Gosselin
              maohaogang maohaogang
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 6h 52m
                  6h 52m
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 4.2h Time Not Required
                  4.2h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.