Details
-
Bug
-
Status: Confirmed (View Workflow)
-
Major
-
Resolution: Unresolved
-
13.0, 12.3.3
-
Linux x86_64; Docker; official image
`mariadb@sha256:dd9b303aed4f4890ed09f766d8ca9ddfd176c0c6f6267feff53b3192ec65a979`;
server reports `12.3.3-MariaDB-ubu2404`, source revision
`83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e`.
Description
`ST_COLLECT` uses the raw `group_concat_max_len` value as its aggregate bound,
while other group aggregates use the effective bound that is also capped by
`max_allowed_packet`. With `max_allowed_packet=1024` and
`group_concat_max_len=65536`, `ST_COLLECT` returns a 5385-byte WKB value without
a warning. `GROUP_CONCAT` over the same 256 rows stops at 1024 and reports
warning 1260.
Steps to reproduce
set -eu
|
IMAGE='mariadb@sha256:dd9b303aed4f4890ed09f766d8ca9ddfd176c0c6f6267feff53b3192ec65a979'
|
C="mdev-mfu08-$$"
|
OWNER="edbf-report-mfu08-$$"
|
cleanup() {
|
if docker inspect --format '{{ index .Config.Labels "io.encryptiondbfuzz.owner" }}' \
|
"$C" 2>/dev/null | grep -Fqx "$OWNER"; then
|
docker rm -f "$C" >/dev/null 2>&1 || true
|
fi
|
}
|
trap cleanup EXIT
|
|
|
docker run --detach --name "$C" \
|
--label "io.encryptiondbfuzz.owner=$OWNER" \
|
--network none --read-only --cap-drop ALL \
|
--security-opt no-new-privileges=true --pids-limit 160 \
|
--memory 1g --cpus 1 --user 999:999 \
|
--tmpfs /var/lib/mysql:rw,nosuid,nodev,size=512m,uid=999,gid=999 \
|
--tmpfs /run/mysqld:rw,nosuid,nodev,size=16m,uid=999,gid=999 \
|
--tmpfs /tmp:rw,nosuid,nodev,size=64m,uid=999,gid=999 \
|
--env MARIADB_ALLOW_EMPTY_ROOT_PASSWORD=1 "$IMAGE" \
|
--max-allowed-packet=1024 >/dev/null
|
|
|
READY=0
|
for I in $(seq 1 90); do
|
if docker exec --user 999:999 "$C" mariadb --protocol=socket \
|
--socket=/run/mysqld/mysqld.sock -uroot -NBe 'SELECT @@port' \
|
2>/dev/null | grep -qx 3306; then
|
READY=1
|
break
|
fi
|
sleep 1
|
done
|
test "$READY" -eq 1
|
|
|
docker exec --user 999:999 "$C" mariadb --protocol=socket \
|
--socket=/run/mysqld/mysqld.sock -uroot --batch --skip-column-names -e '
|
CREATE DATABASE d;
|
CREATE TABLE d.n(i INT);
|
INSERT INTO d.n VALUES (1);
|
INSERT INTO d.n SELECT i FROM d.n;
|
INSERT INTO d.n SELECT i FROM d.n;
|
INSERT INTO d.n SELECT i FROM d.n;
|
INSERT INTO d.n SELECT i FROM d.n;
|
INSERT INTO d.n SELECT i FROM d.n;
|
INSERT INTO d.n SELECT i FROM d.n;
|
INSERT INTO d.n SELECT i FROM d.n;
|
INSERT INTO d.n SELECT i FROM d.n;
|
SET SESSION group_concat_max_len=65536;
|
SELECT @@max_allowed_packet,
|
@@group_concat_max_len,
|
LENGTH(ST_AsWKB(ST_COLLECT(ST_GeomFromText("POINT(1 1)")))),
|
LENGTH(GROUP_CONCAT(REPEAT("x",20)))
|
FROM d.n;
|
SHOW WARNINGS;'
|
Actual result
1024 65536 5385 1024
|
Warning 1260 Row 49 was cut by group_concat()
|
The third column is the `ST_COLLECT` result length. It is more than five times
`@@max_allowed_packet`; there is no `ST_COLLECT` warning. The fourth column and
warning show the `GROUP_CONCAT` control enforcing the effective 1024-byte cap.
The server remained healthy.
Expected result
`ST_COLLECT` should apply the same effective aggregate bound as other group
aggregates: the smaller of `group_concat_max_len` and `max_allowed_packet`. It
should truncate or reject the oversized value with a clear warning/error rather
than returning it silently.
Attachments
Issue Links
- relates to
-
MDEV-34278 Implement the GIS function ST_Collect
-
- Closed
-
-
-
- Closed
-
