Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-39913

MariaDB crash triggered by recursive CTE with GET_LOCK and JSON path expression

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Duplicate
    • 11.8, 12.3, 12.3.2
    • N/A
    • JSON
    • Linux x86_64, Docker container
    • Not for Release Notes

    Description

      ~~~sql
      SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT 1 EXCEPT SELECT GET_LOCK ( NULL , 0 ) ) SELECT DISTINCT x FROM ( SELECT 1 AS x UNION SELECT 2 ) AS x WHERE x IN ( SELECT JSON_REPLACE ( '1' , UPPER ( CAST( NULL AS CHAR ) ) , 100 ) ) ORDER BY x LIMIT 1 ) ) ;
      ~~~

        1. Expected result
          The server should either execute the query or return a normal SQL error without crashing.
        1. Actual result
          The fuzzing run observed a server crash. The deduplicated stack signature is:
          ~~~
          stack:json_find_path|_ZN21Item_func_json_insert7val_strEP6String|_ZN4Item17save_str_in_fieldEP5Fieldb|_ZN4Item13save_in_fieldEP5Fieldb|_ZN14store_key_item10copy_innerEv|_ZN9store_key4copyEP3THD|_ZL18create_ref_for_keyP4JOINP13st_join_tableP8keyuse_tby|_ZN4JOIN20get_best_combinationEv
          ~~~

      Attachments

        Issue Links

          Activity

            People

              rucha174 Rucha Deodhar
              maohaogang maohaogang
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.