Details
-
Bug
-
Status: Confirmed (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.11, 11.4, 11.8, 12.3, 12.3.2
-
Linux x86_64, Docker container
Description
~~~sql
SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT 1 EXCEPT SELECT GET_LOCK ( NULL , 0 ) ) SELECT x FROM x WHERE x IN ( SELECT x FROM x GROUP BY x HAVING x = 'ffffffffff7fffff' ) ORDER BY x LIMIT 1 ) ) ; SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT * FROM ( SELECT 'test1' AS x UNION SELECT 'test2' ) AS x WHERE ( x = 3 AND x = 2 AND x = 1 ) OR ( x = 2 AND LEAST ( 'c111' , UTC_TIME ( ) ) AND x = 1 ) OR ( CONCAT ( x , '::regclass' ) AND CURRENT_TIME ( 6 ) = x OR hex ( x ) < hex ( lower ( x ) ) AND x = 3 ) OR ( x = elt ( 1 , x , '�' ) AND x = 1 AND x = 3 ) ) SELECT x FROM x WHERE x NOT IN ( SELECT x FROM ( SELECT CASE WHEN CASE WHEN extractvalue ( '<a>A<b>B1</b><b>B2</b></a>' , '/a/b[count(.)=1]' ) NOT IN ( SELECT * FROM ( SELECT 2 UNION SELECT 3 UNION SELECT 'LINESTRING(0 0,-0.00 0)' ) AS x GROUP BY x HAVING NOT NOT ( x ) ) THEN 1 ELSE 1 END THEN 1 WHEN 'x' LIKE 'x' THEN 1 END FROM ( SELECT 1 AS x UNION SELECT 2 UNION SELECT 'GEOMETRYCOLLECTION(POLYGON((0 0,0 10,10 10,10 0,0 0,0 0,0 0)))' ) AS x ) AS x ) ORDER BY x ) ) ;
~~~
-
- Expected result
The server should either execute the query or return a normal SQL error without crashing.
- Expected result
-
- Actual result
The fuzzing run observed a server crash. The deduplicated stack signature is:
~~~
stack:_ZNK10Item_field11used_tablesEv|_ZL12remove_constP4JOINP8st_orderP4ItembPb|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZN13st_select_lex31optimize_unflattened_subqueriesEb|_ZN4JOIN15optimize_stage2Ev|_ZN13st_select_lex28optimize_constant_subqueriesEv|_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex
~~~
- Actual result
Top frames:
~~~
_ZNK10Item_field11used_tablesEv
_ZL12remove_constP4JOINP8st_orderP4ItembPb
_ZN4JOIN14optimize_innerEv
_ZN4JOIN8optimizeEv
_ZN13st_select_lex31optimize_unflattened_subqueriesEb
_ZN4JOIN15optimize_stage2Ev
_ZN13st_select_lex28optimize_constant_subqueriesEv
_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex
~~~