Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-458

DNAMES: Server crashes on using an unquoted string as a dynamic column name

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • None
    • 10.0.0
    • None
    • None

    Description

      #4  <signal handler called>
      #5  0x083f4ac9 in Item_field::result_type (this=0x971eae8)
          at sql/item.h:2027
      #6  0x0845170c in Item_func_dyncol_create::fix_fields (this=0x971ec70, thd=0x966f350,
          ref=0x971ed0c) at sql/item_strfunc.cc:3777
      #7  0x081eda26 in setup_fields (thd=0x966f350, ref_pointer_array=0x971f0e0, fields=...,
          mark_used_columns=MARK_COLUMNS_READ, sum_func_list=0x971efdc, allow_sum_func=true)
          at sql/sql_base.cc:8045
      #8  0x08268430 in JOIN::prepare (this=0x971ede0, rref_pointer_array=0x9670f20,
          tables_init=0x0, wild_num=0, conds_init=0x0, og_num=0, order_init=0x0, group_init=0x0,
          having_init=0x0, proc_param_init=0x0, select_lex_arg=0x9670de0, unit_arg=0x9670930)
          at sql/sql_select.cc:707
      #9  0x0826fef6 in mysql_select (thd=0x966f350, rref_pointer_array=0x9670f20, tables=0x0,
          wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0,
          proc_param=0x0, select_options=2147748608, result=0x971edd0, unit=0x9670930,
          select_lex=0x9670de0) at sql/sql_select.cc:3030
      #10 0x08267962 in handle_select (thd=0x966f350, lex=0x96708cc, result=0x971edd0,
          setup_tables_done_option=0) at sql/sql_select.cc:313
      #11 0x082434c8 in execute_sqlcom_select (thd=0x966f350, all_tables=0x0)
          at sql/sql_parse.cc:4621
      #12 0x0823c462 in mysql_execute_command (thd=0x966f350)
          at sql/sql_parse.cc:2189
      #13 0x08245ab9 in mysql_parse (thd=0x966f350,
          rawbuf=0x971ea48 "select COLUMN_CREATE(color, \"black\")", length=36,
          parser_state=0xad22bda4) at sql/sql_parse.cc:5736
      #14 0x08239f04 in dispatch_command (command=COM_QUERY, thd=0x966f350,
          packet=0x9718d19 "select COLUMN_CREATE(color, \"black\")", packet_length=36)
          at sql/sql_parse.cc:1055
      #15 0x082393c9 in do_command (thd=0x966f350)
          at sql/sql_parse.cc:794
      #16 0x083254a1 in do_handle_one_connection (thd_arg=0x966f350)
          at sql/sql_connect.cc:1253
      #17 0x08324fec in handle_one_connection (arg=0x966f350)
          at sql/sql_connect.cc:1168
      #18 0x0854fb93 in pfs_spawn_thread (arg=0x975fae0)
          at storage/perfschema/pfs.cc:1015
      #19 0xb789cb25 in start_thread () from /lib/libpthread.so.0
      #20 0xb766c38e in clone () from /lib/libc.so.6

      Trying to get some variables.
      Some pointers may be invalid and cause the dump to abort.
      Query (0x971ea48): select COLUMN_CREATE(color, "black")
      Connection ID (thread ID): 2
      Status: NOT_KILLED

      bzr version-info

      revision-id: elenst@ubuntu11.home-20120813090607-jtuq5p0umts16h5h
      date: 2012-08-13 13:06:07 +0400
      build-date: 2012-08-16 03:34:01 +0400
      revno: 3490

      Test case:

      select COLUMN_CREATE(color, "black");

      Attachments

        Issue Links

          Activity

            elenst Elena Stepanova created issue -
            elenst Elena Stepanova made changes -
            Field Original Value New Value
            elenst Elena Stepanova made changes -
            elenst Elena Stepanova made changes -
            Description {noformat}
            #4 <signal handler called>
            #5 0x083f4ac9 in Item_field::result_type (this=0x971ef58)
                at sql/item.h:2027
            #6 0x0845170c in Item_func_dyncol_create::fix_fields (this=0x971f0e0, thd=0x966f350,
                ref=0x971f17c) at sql/item_strfunc.cc:3777
            #7 0x081eda26 in setup_fields (thd=0x966f350, ref_pointer_array=0x0, fields=...,
                mark_used_columns=MARK_COLUMNS_READ, sum_func_list=0x0, allow_sum_func=false)
                at sql/sql_base.cc:8045
            #8 0x08222cab in mysql_prepare_insert (thd=0x966f350, table_list=0x971eb28, table=0x0,
                fields=..., values=0x971ef40, update_fields=..., update_values=..., duplic=DUP_ERROR,
                where=0xad17c7a0, select_insert=false, check_fields=false, abort_on_warning=false)
                at sql/sql_insert.cc:1434
            #9 0x082212e4 in mysql_insert (thd=0x966f350, table_list=0x971eb28, fields=...,
                values_list=..., update_fields=..., update_values=..., duplic=DUP_ERROR, ignore=false)
                at sql/sql_insert.cc:751
            #10 0x0823dfcf in mysql_execute_command (thd=0x966f350)
                at sql/sql_parse.cc:2922
            #11 0x08245ab9 in mysql_parse (thd=0x966f350,
                rawbuf=0x971ea48 "insert into t1 values (COLUMN_CREATE(color, \"black\"))", length=53,
                parser_state=0xad17cda4) at sql/sql_parse.cc:5736
            #12 0x08239f04 in dispatch_command (command=COM_QUERY, thd=0x966f350,
                packet=0x9718d19 "insert into t1 values (COLUMN_CREATE(color, \"black\"))",
                packet_length=53) at sql/sql_parse.cc:1055
            #13 0x082393c9 in do_command (thd=0x966f350)
                at sql/sql_parse.cc:794
            #14 0x083254a1 in do_handle_one_connection (thd_arg=0x966f350)
                at sql/sql_connect.cc:1253
            #15 0x08324fec in handle_one_connection (arg=0x966f350)
                at sql/sql_connect.cc:1168
            #16 0x0854fb93 in pfs_spawn_thread (arg=0x975fae0)
                at storage/perfschema/pfs.cc:1015
            #17 0xb77edb25 in start_thread () from /lib/libpthread.so.0
            {noformat}
            {noformat}
            Trying to get some variables.
            Some pointers may be invalid and cause the dump to abort.
            Query (0x971ea48): insert into t1 values (COLUMN_CREATE(color, "black"))
            Connection ID (thread ID): 2
            Status: NOT_KILLED
            {noformat}

            bzr version-info
            {noformat}
            revision-id: elenst@ubuntu11.home-20120813090607-jtuq5p0umts16h5h
            date: 2012-08-13 13:06:07 +0400
            build-date: 2012-08-16 03:34:01 +0400
            revno: 3490
            {noformat}

            Test case:
            {noformat}
            create table t1 (dynstr mediumblob);
            insert into t1 values (COLUMN_CREATE(color, "black"));
            {noformat}
            {noformat}
            #4 <signal handler called>
            #5 0x083f4ac9 in Item_field::result_type (this=0x971eae8)
                at sql/item.h:2027
            #6 0x0845170c in Item_func_dyncol_create::fix_fields (this=0x971ec70, thd=0x966f350,
                ref=0x971ed0c) at sql/item_strfunc.cc:3777
            #7 0x081eda26 in setup_fields (thd=0x966f350, ref_pointer_array=0x971f0e0, fields=...,
                mark_used_columns=MARK_COLUMNS_READ, sum_func_list=0x971efdc, allow_sum_func=true)
                at sql/sql_base.cc:8045
            #8 0x08268430 in JOIN::prepare (this=0x971ede0, rref_pointer_array=0x9670f20,
                tables_init=0x0, wild_num=0, conds_init=0x0, og_num=0, order_init=0x0, group_init=0x0,
                having_init=0x0, proc_param_init=0x0, select_lex_arg=0x9670de0, unit_arg=0x9670930)
                at sql/sql_select.cc:707
            #9 0x0826fef6 in mysql_select (thd=0x966f350, rref_pointer_array=0x9670f20, tables=0x0,
                wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0,
                proc_param=0x0, select_options=2147748608, result=0x971edd0, unit=0x9670930,
                select_lex=0x9670de0) at sql/sql_select.cc:3030
            #10 0x08267962 in handle_select (thd=0x966f350, lex=0x96708cc, result=0x971edd0,
                setup_tables_done_option=0) at sql/sql_select.cc:313
            #11 0x082434c8 in execute_sqlcom_select (thd=0x966f350, all_tables=0x0)
                at sql/sql_parse.cc:4621
            #12 0x0823c462 in mysql_execute_command (thd=0x966f350)
                at sql/sql_parse.cc:2189
            #13 0x08245ab9 in mysql_parse (thd=0x966f350,
                rawbuf=0x971ea48 "select COLUMN_CREATE(color, \"black\")", length=36,
                parser_state=0xad22bda4) at sql/sql_parse.cc:5736
            #14 0x08239f04 in dispatch_command (command=COM_QUERY, thd=0x966f350,
                packet=0x9718d19 "select COLUMN_CREATE(color, \"black\")", packet_length=36)
                at sql/sql_parse.cc:1055
            #15 0x082393c9 in do_command (thd=0x966f350)
                at sql/sql_parse.cc:794
            #16 0x083254a1 in do_handle_one_connection (thd_arg=0x966f350)
                at sql/sql_connect.cc:1253
            #17 0x08324fec in handle_one_connection (arg=0x966f350)
                at sql/sql_connect.cc:1168
            #18 0x0854fb93 in pfs_spawn_thread (arg=0x975fae0)
                at storage/perfschema/pfs.cc:1015
            #19 0xb789cb25 in start_thread () from /lib/libpthread.so.0
            #20 0xb766c38e in clone () from /lib/libc.so.6
            {noformat}
            {noformat}
            Trying to get some variables.
            Some pointers may be invalid and cause the dump to abort.
            Query (0x971ea48): select COLUMN_CREATE(color, "black")
            Connection ID (thread ID): 2
            Status: NOT_KILLED
            {noformat}

            bzr version-info
            {noformat}
            revision-id: elenst@ubuntu11.home-20120813090607-jtuq5p0umts16h5h
            date: 2012-08-13 13:06:07 +0400
            build-date: 2012-08-16 03:34:01 +0400
            revno: 3490
            {noformat}

            Test case:
            {noformat}
            select COLUMN_CREATE(color, "black");
            {noformat}
            Summary DNAMES: Server crashes on inserting a named dynamic column object into a table DNAMES: Server crashes on using an unquoted string as a dynamic column name

            Fixed

            sanja Oleksandr Byelkin added a comment - Fixed
            sanja Oleksandr Byelkin made changes -
            Resolution Fixed [ 1 ]
            Status Open [ 1 ] Closed [ 6 ]
            serg Sergei Golubchik made changes -
            Workflow defaullt [ 13815 ] MariaDB v2 [ 45237 ]
            ratzpo Rasmus Johansson (Inactive) made changes -
            Workflow MariaDB v2 [ 45237 ] MariaDB v3 [ 62120 ]
            serg Sergei Golubchik made changes -
            Workflow MariaDB v3 [ 62120 ] MariaDB v4 [ 144928 ]

            People

              sanja Oleksandr Byelkin
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.