Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41269

SIGSEGV in Item_field::Item_field on plugin aggregate DISTINCT over a constant

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Critical
    • Resolution: Unresolved
    • 13.2
    • 13.2
    • Plugins
    • None
    • Not for Release Notes

    Description

      A pluggable aggregate function called with DISTINCT over any non-NULL constant crashes the server.

      Test case

      INSTALL SONAME 'func_test';
      SELECT test_plugin_count(DISTINCT 1);
      

      Leads to

      MDEV-40672 CS 13.2.0 f1ad15f8cb194728c79b3eb784adb7661773c97c (Debug, Clang 18.1.3-11) Build 13/09/2026

      Core was generated by `/test/mtest/MDEV-40672/MD130926-mariadb-13.2.0-linux-x86_64-dbg/bin/mariadbd --'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x00005824a07469f8 in Item_field::Item_field (this=0x76b65401c170, thd=0x76b654000d60, f=0x0)at /test/mtest/MDEV-40672/13.1_dbg/sql/item.cc:3348
       
      [Current thread is 1 (LWP 1698251)]
      (gdb) bt
      #0  0x00005824a07469f8 in Item_field::Item_field (this=0x76b65401c170, thd=0x76b654000d60, f=0x0)at /test/mtest/MDEV-40672/13.1_dbg/sql/item.cc:3348
      #1  0x00005824a08795c1 in Aggregator_distinct::setup (this=0x76b65401bfd0, thd=0x76b654000d60) at /test/mtest/MDEV-40672/13.1_dbg/sql/item_sum.cc:844
      #2  0x00005824a03848b5 in Item_sum::aggregator_setup (this=0x76b65401abe0, thd=0x76b654000d60) at /test/mtest/MDEV-40672/13.1_dbg/sql/item_sum.h:560
      #3  0x00005824a0337c0d in setup_sum_funcs (thd=0x76b654000d60, func_ptr=0x76b65401bfa8)at /test/mtest/MDEV-40672/13.1_dbg/sql/sql_select.cc:30241
      #4  0x00005824a0333fc7 in JOIN::make_aggr_tables_info (this=0x76b65401b6f0)at /test/mtest/MDEV-40672/13.1_dbg/sql/sql_select.cc:4238
      #5  0x00005824a0322491 in JOIN::optimize_stage2 (this=0x76b65401b6f0)at /test/mtest/MDEV-40672/13.1_dbg/sql/sql_select.cc:3618
      #6  0x00005824a031fca6 in JOIN::optimize_inner (this=0x76b65401b6f0)at /test/mtest/MDEV-40672/13.1_dbg/sql/sql_select.cc:2790
      #7  0x00005824a031d44d in JOIN::optimize (this=0x76b65401b6f0)at /test/mtest/MDEV-40672/13.1_dbg/sql/sql_select.cc:2017
      #8  0x00005824a0315038 in mysql_select (thd=0x76b654000d60, tables=0x0, fields=@0x76b65401a838: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x76b65401ad10, last = 0x76b65401ad10, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x76b65401b6c0, unit=0x76b6540052f8, select_lex=0x76b65401a580)at /test/mtest/MDEV-40672/13.1_dbg/sql/sql_select.cc:5426
      #9  0x00005824a0314bc5 in handle_select (thd=0x76b654000d60, lex=0x76b654005218, result=0x76b65401b6c0, setup_tables_done_option=0)at /test/mtest/MDEV-40672/13.1_dbg/sql/sql_select.cc:637
      #10 0x00005824a02b105d in execute_sqlcom_select (thd=0x76b654000d60, all_tables=0x0) at /test/mtest/MDEV-40672/13.1_dbg/sql/sql_parse.cc:6266
      #11 0x00005824a02a5b86 in mysql_execute_command (thd=0x76b654000d60, is_called_from_prepared_stmt=false)at /test/mtest/MDEV-40672/13.1_dbg/sql/sql_parse.cc:4038
      #12 0x00005824a029dbe4 in mysql_parse (thd=0x76b654000d60, rawbuf=0x76b65401a4d0 "SELECT test_plugin_count(DISTINCT 1)", length=36, parser_state=0x7eb7450b5a80)at /test/mtest/MDEV-40672/13.1_dbg/sql/sql_parse.cc:8005
      #13 0x00005824a029afad in dispatch_command (command=COM_QUERY, thd=0x76b654000d60, packet=0x76b65400b701 "SELECT test_plugin_count(DISTINCT 1)", packet_length=36, blocking=true)at /test/mtest/MDEV-40672/13.1_dbg/sql/sql_parse.cc:1903
      #14 0x00005824a029e793 in do_command (thd=0x76b654000d60, blocking=true)at /test/mtest/MDEV-40672/13.1_dbg/sql/sql_parse.cc:1437
      #15 0x00005824a04a5039 in do_handle_one_connection (connect=0x5824dbe8e390, put_in_cache=true)at /test/mtest/MDEV-40672/13.1_dbg/sql/sql_connect.cc:1514
      #16 0x00005824a04a4dde in handle_one_connection (arg=0x5824dbf77bc0)at /test/mtest/MDEV-40672/13.1_dbg/sql/sql_connect.cc:1426
      #17 0x00007eb76c69cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #18 0x00007eb76c729ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Attachments

        Issue Links

          Activity

            People

              drrtuy Roman
              ramesh Ramesh Sivaraman
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 0.5h
                  0.5h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.