Details
-
Bug
-
Status: Confirmed (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.11, 11.4, 11.8, 12.3, 13.1
-
MariaDB Server 13.1.0-MariaDB-asan
Source revision: 34dd221590eb9d6dbda701031fcf8a84df9821fd
Build: ASan build, Linux x86_64
Reproducer: Python 3 script using mysql-connector-python plus crafted COM_STMT_PREPARE/COM_STMT_EXECUTE packets.
-
Can result in hang or crash
Description
A crafted binary-protocol prepared-statement execution crashes mariadbd.
Steps to reproduce:
1. Start a disposable MariaDB test server.
2. Install dependency: pip install mysql-connector-python
3. Run the attached reproducer:
python3 reproduce.py -H <host> -P <port> -u <user> -p <password>
The reproducer first executes the embedded setup SQL to recreate database `mydb` and prepare the minimized schema/data required by the crash. It then prepares a statement with COM_STMT_PREPARE and sends crafted COM_STMT_EXECUTE packet(s).
Actual result:
mariadbd crashes.
Crash signature:
storage/maria/ma_blockrec.c:2001 write_tail()
AddressSanitizer CHECK failed while reporting invalid memory access
Expected result:
The server should return an error or reject the malformed/edge-case prepared-statement execution without crashing.
Attachments:
- reproduce.py
- error.log