Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41794

ST_AsText on a deeply nested GeometryCollection crashes mariadbd

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Critical
    • Resolution: Duplicate
    • 12.3.3
    • N/A
    • GIS
    • None
    • Linux/amd64
    • Not for Release Notes

    Description

      The following SQL reproduced the failure on MariaDB 12.3.3 (12.3.3-MariaDB-ubu2404) on Linux/amd64:

      DROP DATABASE IF EXISTS nested_geometry;
      CREATE DATABASE nested_geometry;
      USE nested_geometry;
       
      DELIMITER $$
      CREATE PROCEDURE render_nested_collection()
      BEGIN
        DECLARE text_length BIGINT;
        SELECT LENGTH(
                 ST_AsText(
                   CONCAT(
                     x'00000000',
                     REPEAT(x'010700000001000000', 100000),
                     x'010100000000000000000000000000000000000000'
                   )
                 )
               )
          INTO text_length;
        SELECT text_length;
      END$$
      DELIMITER ;
       
      CALL render_nested_collection();

      The CALL terminated mariadbd with exit code 139. The server was no longer running immediately afterward and required recovery. The process was not terminated by an out-of-memory condition. The server log ended before the fatal event and contained no stack trace.

      ST_AsText should return a value or reject the excessively nested geometry with a controlled SQL error. Processing the input must not terminate the database server.

      Source inspection indicates that Gis_geometry_collection::get_data_as_wkt() recursively calls geom->as_wkt() without a stack-overrun check. This is an inference from the inspected source because no crash backtrace was recorded.

      This occurs when ST_AsText deparses a GeometryCollection containing 100,000 nested collections inside a stored procedure.

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              Milo liu
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.