Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Duplicate
-
12.3.3
-
None
-
Linux/amd64
-
Not for Release Notes
Description
The following SQL reproduced the failure on MariaDB 12.3.3 (12.3.3-MariaDB-ubu2404) on Linux/amd64:
DROP DATABASE IF EXISTS nested_geometry; |
CREATE DATABASE nested_geometry; |
USE nested_geometry; |
|
|
DELIMITER $$
|
CREATE PROCEDURE render_nested_collection() |
BEGIN
|
DECLARE text_length BIGINT; |
SELECT LENGTH( |
ST_AsText(
|
CONCAT(
|
x'00000000', |
REPEAT(x'010700000001000000', 100000), |
x'010100000000000000000000000000000000000000' |
)
|
)
|
)
|
INTO text_length; |
SELECT text_length; |
END$$ |
DELIMITER ;
|
|
|
CALL render_nested_collection();
|
The CALL terminated mariadbd with exit code 139. The server was no longer running immediately afterward and required recovery. The process was not terminated by an out-of-memory condition. The server log ended before the fatal event and contained no stack trace.
ST_AsText should return a value or reject the excessively nested geometry with a controlled SQL error. Processing the input must not terminate the database server.
Source inspection indicates that Gis_geometry_collection::get_data_as_wkt() recursively calls geom->as_wkt() without a stack-overrun check. This is an inference from the inspected source because no crash backtrace was recorded.
This occurs when ST_AsText deparses a GeometryCollection containing 100,000 nested collections inside a stored procedure.
Attachments
Issue Links
- duplicates
-
MDEV-41043 MariaDB Server stack overflow when ST_AsText() is used on a deeply nested GeometryCollection inside a stored procedure
-
- Confirmed
-