Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-5689

ExtractValue(xml, 'substring(/x,/y)') crashes

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • 5.3.12, 5.5.33a, 10.0.6
    • 10.0.10
    • None
    • None

    Description

      This query crashes the server:

      SELECT ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,..)');

      Notice '..' in the 'position' argument to XPath substring() function,
      which obviously goes above the root XML element.

      If I change the position argument to something inside the XML tree,
      it works fine:

      mysql> SELECT ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,/a/c)');
      		 
      +--------------------------------------------------------------------------+
      		 
      | ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,/a/c)') |
      		 
      +--------------------------------------------------------------------------+
      		 
      | bc                                                                       |
      		 
      +--------------------------------------------------------------------------+
      		 
      1 row in set (0.00 sec)

      Attachments

        Issue Links

          relates to

          Task - A task that needs to be done. MDEV-5652 5.5.36 merge

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5709 ExtractValue() with XPath variable references returns wrong result

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            bar Alexander Barkov created issue -
            bar Alexander Barkov made changes -
            Field Original Value New Value
            Description This query crashes the server:
            {code}
            SELECT ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,..)');
            {code}

            Notice '..' in the 'position' argument to XPath's substring() function,
            which obviously goes outside of the root XML element.

            If I change the position argument to something inside the XML tree,
            it works fine:

            {code}
            mysql> SELECT ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,/a/c)');
            +--------------------------------------------------------------------------+
            | ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,/a/c)') |
            +--------------------------------------------------------------------------+
            | bc |
            +--------------------------------------------------------------------------+
            1 row in set (0.00 sec)
            {code}             		This query crashes the server:
            {code}
            SELECT ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,..)');
            {code}

            Notice '..' in the 'position' argument to XPath substring() function,
            which obviously goes outside of the root XML element.

            If I change the position argument to something inside the XML tree,
            it works fine:

            {code}
            mysql> SELECT ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,/a/c)');
            +--------------------------------------------------------------------------+
            | ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,/a/c)') |
            +--------------------------------------------------------------------------+
            | bc |
            +--------------------------------------------------------------------------+
            1 row in set (0.00 sec)
            {code}
            bar Alexander Barkov made changes -
            Description This query crashes the server:
            {code}
            SELECT ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,..)');
            {code}

            Notice '..' in the 'position' argument to XPath substring() function,
            which obviously goes outside of the root XML element.

            If I change the position argument to something inside the XML tree,
            it works fine:

            {code}
            mysql> SELECT ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,/a/c)');
            +--------------------------------------------------------------------------+
            | ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,/a/c)') |
            +--------------------------------------------------------------------------+
            | bc |
            +--------------------------------------------------------------------------+
            1 row in set (0.00 sec)
            {code}             		This query crashes the server:
            {code}
            SELECT ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,..)');
            {code}

            Notice '..' in the 'position' argument to XPath substring() function,
            which obviously goes above the root XML element.

            If I change the position argument to something inside the XML tree,
            it works fine:

            {code}
            mysql> SELECT ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,/a/c)');
            +--------------------------------------------------------------------------+
            | ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,/a/c)') |
            +--------------------------------------------------------------------------+
            | bc |
            +--------------------------------------------------------------------------+
            1 row in set (0.00 sec)
            {code}
            serg Sergei Golubchik made changes -
            Fix Version/s 10.0.9 [ 14400 ]
            Fix Version/s 5.5.36 [ 14600 ]
            serg Sergei Golubchik made changes -
            serg Sergei Golubchik made changes -
            Fix Version/s 5.5.37 [ 15000 ]
            Fix Version/s 5.5.36 [ 14600 ]
            serg Sergei Golubchik made changes -
            Fix Version/s 10.0.10 [ 14500 ]
            Fix Version/s 10.0.9 [ 14400 ]
            serg Sergei Golubchik made changes -
            Assignee Alexander Barkov [ bar ] Sergei Golubchik [ serg ]
            serg Sergei Golubchik made changes -
            Fix Version/s 5.5.37 [ 15000 ]
            serg Sergei Golubchik added a comment -

            5.5 crash is already fixed, so this patch is considered for 10.0 only

            serg Sergei Golubchik added a comment - 5.5 crash is already fixed, so this patch is considered for 10.0 only
            serg Sergei Golubchik made changes -
            Status Open [ 1 ] In Progress [ 3 ]
            serg Sergei Golubchik made changes -
            serg Sergei Golubchik made changes -
            Assignee Sergei Golubchik [ serg ] Alexander Barkov [ bar ]
            serg Sergei Golubchik made changes -
            Assignee Alexander Barkov [ bar ] Sergei Golubchik [ serg ]
            serg Sergei Golubchik made changes -
            Status In Progress [ 3 ] Stalled [ 10000 ]
            serg Sergei Golubchik made changes -
            Assignee Sergei Golubchik [ serg ] Alexander Barkov [ bar ]
            bar Alexander Barkov added a comment -

            Pushed into 10.0

            bar Alexander Barkov added a comment - Pushed into 10.0
            bar Alexander Barkov made changes -
            Resolution Fixed [ 1 ]
            Status Stalled [ 10000 ] Closed [ 6 ]
            serg Sergei Golubchik made changes -
            Workflow defaullt [ 34734 ] MariaDB v2 [ 43070 ]
            ratzpo Rasmus Johansson (Inactive) made changes -
            Workflow MariaDB v2 [ 43070 ] MariaDB v3 [ 62115 ]
            serg Sergei Golubchik made changes -
            Workflow MariaDB v3 [ 62115 ] MariaDB v4 [ 147519 ]

            People

              bar Alexander Barkov
              bar Alexander Barkov
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.