Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-39912

MariaDB crash triggered by recursive CTE with GET_LOCK, LEAST, and XML predicate

    XMLWordPrintable

Details

    Description

      ~~~sql
      SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT 1 EXCEPT SELECT GET_LOCK ( NULL , 0 ) ) SELECT x FROM x WHERE x IN ( SELECT x FROM x GROUP BY x HAVING x = 'ffffffffff7fffff' ) ORDER BY x LIMIT 1 ) ) ; SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT * FROM ( SELECT 'test1' AS x UNION SELECT 'test2' ) AS x WHERE ( x = 3 AND x = 2 AND x = 1 ) OR ( x = 2 AND LEAST ( 'c111' , UTC_TIME ( ) ) AND x = 1 ) OR ( CONCAT ( x , '::regclass' ) AND CURRENT_TIME ( 6 ) = x OR hex ( x ) < hex ( lower ( x ) ) AND x = 3 ) OR ( x = elt ( 1 , x , '�' ) AND x = 1 AND x = 3 ) ) SELECT x FROM x WHERE x NOT IN ( SELECT x FROM ( SELECT CASE WHEN CASE WHEN extractvalue ( '<a>A<b>B1</b><b>B2</b></a>' , '/a/b[count(.)=1]' ) NOT IN ( SELECT * FROM ( SELECT 2 UNION SELECT 3 UNION SELECT 'LINESTRING(0 0,-0.00 0)' ) AS x GROUP BY x HAVING NOT NOT ( x ) ) THEN 1 ELSE 1 END THEN 1 WHEN 'x' LIKE 'x' THEN 1 END FROM ( SELECT 1 AS x UNION SELECT 2 UNION SELECT 'GEOMETRYCOLLECTION(POLYGON((0 0,0 10,10 10,10 0,0 0,0 0,0 0)))' ) AS x ) AS x ) ORDER BY x ) ) ;
      ~~~

        1. Expected result
          The server should either execute the query or return a normal SQL error without crashing.
        1. Actual result
          The fuzzing run observed a server crash. The deduplicated stack signature is:
          ~~~
          stack:_ZNK10Item_field11used_tablesEv|_ZL12remove_constP4JOINP8st_orderP4ItembPb|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZN13st_select_lex31optimize_unflattened_subqueriesEb|_ZN4JOIN15optimize_stage2Ev|_ZN13st_select_lex28optimize_constant_subqueriesEv|_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex
          ~~~

      Top frames:
      ~~~
      _ZNK10Item_field11used_tablesEv
      _ZL12remove_constP4JOINP8st_orderP4ItembPb
      _ZN4JOIN14optimize_innerEv
      _ZN4JOIN8optimizeEv
      _ZN13st_select_lex31optimize_unflattened_subqueriesEb
      _ZN4JOIN15optimize_stage2Ev
      _ZN13st_select_lex28optimize_constant_subqueriesEv
      _Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex
      ~~~

      Attachments

        Activity

          People

            psergei Sergei Petrunia
            maohaogang maohaogang
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.