Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Duplicate
-
11.8, 12.3, 12.3.2
-
Linux x86_64, Docker container
-
Not for Release Notes
Description
~~~sql
SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT 1 EXCEPT SELECT GET_LOCK ( NULL , 0 ) ) SELECT DISTINCT x FROM ( SELECT 1 AS x UNION SELECT 2 ) AS x WHERE x IN ( SELECT JSON_REPLACE ( '1' , UPPER ( CAST( NULL AS CHAR ) ) , 100 ) ) ORDER BY x LIMIT 1 ) ) ;
~~~
-
- Expected result
The server should either execute the query or return a normal SQL error without crashing.
- Expected result
-
- Actual result
The fuzzing run observed a server crash. The deduplicated stack signature is:
~~~
stack:json_find_path|_ZN21Item_func_json_insert7val_strEP6String|_ZN4Item17save_str_in_fieldEP5Fieldb|_ZN4Item13save_in_fieldEP5Fieldb|_ZN14store_key_item10copy_innerEv|_ZN9store_key4copyEP3THD|_ZL18create_ref_for_keyP4JOINP13st_join_tableP8keyuse_tby|_ZN4JOIN20get_best_combinationEv
~~~
- Actual result
Attachments
Issue Links
- duplicates
-
MDEV-32331 Server crashes at json_string_set_cs
-
- Stalled
-
- relates to
-
MDEV-37640 Crash at String::append during JSON_NORMALIZE
-
- Closed
-