Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-6883

ST_WITHIN crashes server if (0,0) is matched to POLYGON((0 0))

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • 5.3.12, 5.5.40, 10.0.12, 10.0.14
    • 5.5.41, 10.0.15, 5.3.13
    • GIS
    • None
    • Linux CentOS 6.5 x64

    Description

      > create table a (area polygon) engine=aria;
      Query OK, 0 rows affected (0.00 sec)
       
      > set @poly='Polygon((0 0))';
      Query OK, 0 rows affected (0.00 sec)
       
      > insert into a values (GeomFromText(@poly));
      Query OK, 1 row affected (0.00 sec)
       
      > select * from a where st_within(point(0,0),area);
      ERROR 2013 (HY000): Lost connection to MySQL server during query

      Stack trace

      stack_bottom = 0x7f77e0915d30 thread_stack 0x48000
      /usr/sbin/mysqld(my_print_stacktrace+0x2b)[0xb6b85b]
      /usr/sbin/mysqld(handle_fatal_signal+0x398)[0x723f08]
      /lib64/libpthread.so.0[0x351680f710]
      /usr/sbin/mysqld(_ZNK11Gis_polygon12store_shapesEP23Gcalc_shape_transporter+0xf6)[0x81ef96]
      /usr/sbin/mysqld(_ZN21Item_func_spatial_rel7val_intEv+0x39a)[0x78657a]
      /usr/sbin/mysqld[0x5f6ad9]
      /usr/sbin/mysqld(_Z10sub_selectP4JOINP13st_join_tableb+0x1d9)[0x5f6f79]
      /usr/sbin/mysqld[0x60e04d]
      /usr/sbin/mysqld(_ZN4JOIN10exec_innerEv+0xa3d)[0x62117d]
      /usr/sbin/mysqld(_ZN4JOIN4execEv+0x11)[0x622ff1]
      /usr/sbin/mysqld(_Z12mysql_selectP3THDPPP4ItemP10TABLE_LISTjR4ListIS1_ES2_jP8st_orderSB_S2_SB_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x1dd)[0x61fbbd]
      /usr/sbin/mysqld(_Z13handle_selectP3THDP3LEXP13select_resultm+0x28d)[0x62334d]
      /usr/sbin/mysqld[0x5cac06]
      /usr/sbin/mysqld(_Z21mysql_execute_commandP3THD+0x4c97)[0x5d58d7]
      /usr/sbin/mysqld[0x5d7402]
      /usr/sbin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x1b20)[0x5d95c0]
      /usr/sbin/mysqld(_Z24do_handle_one_connectionP3THD+0x453)[0x6946a3]
      /usr/sbin/mysqld(handle_one_connection+0x42)[0x694772]
      /lib64/libpthread.so.0[0x35168079d1]
      /lib64/libc.so.6(clone+0x6d)[0x35164e8b6d]

      Attachments

        Activity

          Thanks for the report and the test case.

          Debug stack trace from 10.0 revno 4427

          #3  <signal handler called>
          #4  __memcpy_ssse3 () at ../sysdeps/x86_64/multiarch/memcpy-ssse3.S:1816
          #5  0x00000000009affdc in get_point (x=0x7fb7814f1d90, y=0x7fb7814f1d88, data=0x7fb7783ffff1 "") at 10.0/sql/spatial.cc:133
          #6  0x00000000009b2db2 in Gis_polygon::store_shapes (this=0x7fb7814f1ec0, trn=0x7fb7814f1e70) at 10.0/sql/spatial.cc:1248
          #7  0x00000000008e5a05 in Item_func_spatial_rel::val_int (this=0x7fb777814bf8) at 10.0/sql/item_geofunc.cc:717
          #8  0x00000000008c82be in eval_const_cond (cond=0x7fb777814bf8) at 10.0/sql/item_func.cc:79
          #9  0x00000000006d34bc in internal_remove_eq_conds (thd=0x7fb77a32f070, cond=0x7fb777814bf8, cond_value=0x7fb7778152c0) at 10.0/sql/sql_select.cc:14944
          #10 0x00000000006d380f in remove_eq_conds (thd=0x7fb77a32f070, cond=0x7fb777814bf8, cond_value=0x7fb7778152c0) at 10.0/sql/sql_select.cc:15036
          #11 0x00000000006b9966 in make_join_statistics (join=0x7fb777814f98, tables_list=..., conds=0x7fb777814bf8, keyuse_array=0x7fb7778152a0) at 10.0/sql/sql_select.cc:3838
          #12 0x00000000006b1257 in JOIN::optimize_inner (this=0x7fb777814f98) at 10.0/sql/sql_select.cc:1339
          #13 0x00000000006b01ee in JOIN::optimize (this=0x7fb777814f98) at 10.0/sql/sql_select.cc:1024
          #14 0x00000000006b7d73 in mysql_select (thd=0x7fb77a32f070, rref_pointer_array=0x7fb77a3336e0, tables=0x7fb7778142a8, wild_num=1, fields=..., conds=0x7fb777814bf8, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7fb777814f78, unit=0x7fb77a332d80, select_lex=0x7fb77a333468) at 10.0/sql/sql_select.cc:3294
          #15 0x00000000006ae3fd in handle_select (thd=0x7fb77a32f070, lex=0x7fb77a332cb8, result=0x7fb777814f78, setup_tables_done_option=0) at 10.0/sql/sql_select.cc:373
          #16 0x00000000006830ed in execute_sqlcom_select (thd=0x7fb77a32f070, all_tables=0x7fb7778142a8) at 10.0/sql/sql_parse.cc:5269
          #17 0x000000000067b3eb in mysql_execute_command (thd=0x7fb77a32f070) at 10.0/sql/sql_parse.cc:2552
          #18 0x0000000000685877 in mysql_parse (thd=0x7fb77a32f070, rawbuf=0x7fb777814088 "select * from a where st_within(point(0,0),area)", length=48, parser_state=0x7fb7814f3630) at 10.0/sql/sql_parse.cc:6415
          #19 0x000000000067868c in dispatch_command (command=COM_QUERY, thd=0x7fb77a32f070, packet=0x7fb77b3f6071 "select * from a where st_within(point(0,0),area)", packet_length=48) at 10.0/sql/sql_parse.cc:1307
          #20 0x0000000000677a31 in do_command (thd=0x7fb77a32f070) at 10.0/sql/sql_parse.cc:1004
          #21 0x00000000007942a6 in do_handle_one_connection (thd_arg=0x7fb77a32f070) at 10.0/sql/sql_connect.cc:1379
          #22 0x0000000000793ff9 in handle_one_connection (arg=0x7fb77a32f070) at 10.0/sql/sql_connect.cc:1293
          #23 0x0000000000cc9d06 in pfs_spawn_thread (arg=0x7fb779767bf0) at 10.0/storage/perfschema/pfs.cc:1860
          #24 0x00007fb7810dfb50 in start_thread (arg=<optimized out>) at pthread_create.c:304
          #25 0x00007fb77f5d720d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112

          elenst Elena Stepanova added a comment - Thanks for the report and the test case. Debug stack trace from 10.0 revno 4427 #3 <signal handler called> #4 __memcpy_ssse3 () at ../sysdeps/x86_64/multiarch/memcpy-ssse3.S:1816 #5 0x00000000009affdc in get_point (x=0x7fb7814f1d90, y=0x7fb7814f1d88, data=0x7fb7783ffff1 "") at 10.0/sql/spatial.cc:133 #6 0x00000000009b2db2 in Gis_polygon::store_shapes (this=0x7fb7814f1ec0, trn=0x7fb7814f1e70) at 10.0/sql/spatial.cc:1248 #7 0x00000000008e5a05 in Item_func_spatial_rel::val_int (this=0x7fb777814bf8) at 10.0/sql/item_geofunc.cc:717 #8 0x00000000008c82be in eval_const_cond (cond=0x7fb777814bf8) at 10.0/sql/item_func.cc:79 #9 0x00000000006d34bc in internal_remove_eq_conds (thd=0x7fb77a32f070, cond=0x7fb777814bf8, cond_value=0x7fb7778152c0) at 10.0/sql/sql_select.cc:14944 #10 0x00000000006d380f in remove_eq_conds (thd=0x7fb77a32f070, cond=0x7fb777814bf8, cond_value=0x7fb7778152c0) at 10.0/sql/sql_select.cc:15036 #11 0x00000000006b9966 in make_join_statistics (join=0x7fb777814f98, tables_list=..., conds=0x7fb777814bf8, keyuse_array=0x7fb7778152a0) at 10.0/sql/sql_select.cc:3838 #12 0x00000000006b1257 in JOIN::optimize_inner (this=0x7fb777814f98) at 10.0/sql/sql_select.cc:1339 #13 0x00000000006b01ee in JOIN::optimize (this=0x7fb777814f98) at 10.0/sql/sql_select.cc:1024 #14 0x00000000006b7d73 in mysql_select (thd=0x7fb77a32f070, rref_pointer_array=0x7fb77a3336e0, tables=0x7fb7778142a8, wild_num=1, fields=..., conds=0x7fb777814bf8, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7fb777814f78, unit=0x7fb77a332d80, select_lex=0x7fb77a333468) at 10.0/sql/sql_select.cc:3294 #15 0x00000000006ae3fd in handle_select (thd=0x7fb77a32f070, lex=0x7fb77a332cb8, result=0x7fb777814f78, setup_tables_done_option=0) at 10.0/sql/sql_select.cc:373 #16 0x00000000006830ed in execute_sqlcom_select (thd=0x7fb77a32f070, all_tables=0x7fb7778142a8) at 10.0/sql/sql_parse.cc:5269 #17 0x000000000067b3eb in mysql_execute_command (thd=0x7fb77a32f070) at 10.0/sql/sql_parse.cc:2552 #18 0x0000000000685877 in mysql_parse (thd=0x7fb77a32f070, rawbuf=0x7fb777814088 "select * from a where st_within(point(0,0),area)", length=48, parser_state=0x7fb7814f3630) at 10.0/sql/sql_parse.cc:6415 #19 0x000000000067868c in dispatch_command (command=COM_QUERY, thd=0x7fb77a32f070, packet=0x7fb77b3f6071 "select * from a where st_within(point(0,0),area)", packet_length=48) at 10.0/sql/sql_parse.cc:1307 #20 0x0000000000677a31 in do_command (thd=0x7fb77a32f070) at 10.0/sql/sql_parse.cc:1004 #21 0x00000000007942a6 in do_handle_one_connection (thd_arg=0x7fb77a32f070) at 10.0/sql/sql_connect.cc:1379 #22 0x0000000000793ff9 in handle_one_connection (arg=0x7fb77a32f070) at 10.0/sql/sql_connect.cc:1293 #23 0x0000000000cc9d06 in pfs_spawn_thread (arg=0x7fb779767bf0) at 10.0/storage/perfschema/pfs.cc:1860 #24 0x00007fb7810dfb50 in start_thread (arg=<optimized out>) at pthread_create.c:304 #25 0x00007fb77f5d720d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
          holyfoot Alexey Botchkov added a comment - Fixing patch: http://lists.askmonty.org/pipermail/commits/2014-November/007012.html

          People

            holyfoot Alexey Botchkov
            Frank_VID Frank Maas
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.