MySQL Server crashes on a (wrong) Query. This is considered a security bug because it can be used as DOS.
See test case and query
Reproduce: mysql -u root < crash.sql
then run query
crash mariadb 10.0.17
not crash mariadb 5.5.34
crashes mariadb 10.1.2 and 10.1.4
disabling mariadb optimizer features did not help. MySQL is not affected.
grant all on *.* to root@'%';
|
use d1
|
UPDATE tab1 t,
|
(
|
SELECT
|
m.PAID,
|
m.aktuelleaktion
|
FROM
|
tab1 t1
|
LEFT JOIN tab2 m ON t1.PAID = m.PAID
|
WHERE
|
t1.PDID = 623
|
AND t1.PAID > 0
|
AND t1.AKTIONSID = 0
|
) sel
|
SET t.AKTIONSID = sel.aktuelleaktion
|
WHERE
|
t.PDID = 623
|
AND t.PAID = sel.PAID
|
;
|
Thread pointer: 0x0x7f72cb2b9008
|
Attempting backtrace. You can use the following information to find out
|
where mysqld died. If you see no messages after this, something went
|
terribly wrong...
|
stack_bottom = 0x7f72db623e50 thread_stack 0x48000
|
mysys/stacktrace.c:247(my_print_stacktrace)[0xbc4eee]
|
sql/signal_handler.cc:153(handle_fatal_signal)[0x71c4dc]
|
/lib/x86_64-linux-gnu/libpthread.so.0(+0x10340)[0x7f72db2cc340]
|
sql/opt_subselect.cc:3294(fix_semijoin_strategies_for_picked_join_order(JOIN*))[0x6ae549]
|
sql/sql_list.h:34(Sql_alloc::operator new(unsigned long))[0x5cbf5a]
|
sql/sql_select.cc:4072(make_join_statistics)[0x5e545b]
|
sql/sql_select.cc:1339(JOIN::optimize_inner())[0x5e7a9a]
|
sql/sql_select.cc:1037(JOIN::optimize())[0x5ea7fb]
|
sql/sql_derived.cc:804(mysql_derived_optimize(THD*, LEX*, TABLE_LIST*))[0x5752bd]
|
sql/sql_derived.cc:192(mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int))[0x574b9a]
|
sql/table.cc:6915(TABLE_LIST::handle_derived(LEX*, unsigned int))[0x638e6a]
|
sql/sql_lex.cc:3550(st_select_lex::handle_derived(LEX*, unsigned int))[0x587090]
|
sql/sql_select.cc:1082(JOIN::optimize_inner())[0x5e7418]
|
sql/sql_select.cc:1037(JOIN::optimize())[0x5eaa22]
|
sql/sql_update.cc:1570(mysql_multi_update(THD*, TABLE_LIST*, List<Item>*, List<Item>*, Item*, unsigned long long, enum_duplicates, bool, st_select_lex_unit*, st_select_lex*, multi_update**))[0x62f64c]
|
sql/sql_parse.cc:3367(mysql_execute_command(THD*))[0x59beb8]
|
sql/sql_parse.cc:6517(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x59d8ea]
|
sql/sql_parse.cc:1302(dispatch_command(enum_server_command, THD*, char*, unsigned int))[0x59f757]
|
sql/sql_parse.cc:996(do_command(THD*))[0x59fe68]
|
sql/sql_connect.cc:1375(do_handle_one_connection(THD*))[0x6692b4]
|
sql/sql_connect.cc:1291(handle_one_connection)[0x6693f2]
|
/lib/x86_64-linux-gnu/libpthread.so.0(+0x8182)[0x7f72db2c4182]
|
/lib/x86_64-linux-gnu/libc.so.6(clone+0x6d)[0x7f72da1a047d]
|
|
Trying to get some variables.
|
Some pointers may be invalid and cause the dump to abort.
|
Query (0x7f72b5822020): UPDATE tab1 t, ( SELECT m.PAID, m.aktuelleaktion FROM tab1 t1 LEFT JOIN tab2 m ON t1.PAID = m.PAID WHERE t1.PDID = 623 AND t1.PAID > 0 AND t1.AKTIONSID = 0 ) sel SET t.AKTIONSID = sel.aktuelleaktion WHERE t.PDID = 623 AND t.PAID = sel.PAID
|
Connection ID (thread ID): 5
|
Status: NOT_KILLED
|
|
Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=off,table_elimination=on,extended_keys=on,exists_to_in=on
|
{"report":{"fcp":837.3999998569489,"ttfb":205.59999990463257,"pageVisibility":"visible","entityId":51225,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{},"userDeviceMemory":8,"userDeviceProcessors":64,"apdex":1,"journeyId":"1032c1ea-58d2-4b8f-81e1-e79b512da27d","navigationType":0,"readyForUser":928.7999999523163,"redirectCount":0,"resourceLoadedEnd":543.8999998569489,"resourceLoadedStart":213.69999980926514,"resourceTiming":[{"duration":4,"initiatorType":"link","name":"https://jira.mariadb.org/s/2c21342762a6a02add1c328bed317ffd-CDN/lu2bu7/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/css/_super/batch.css","startTime":213.69999980926514,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":213.69999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":217.69999980926514,"responseStart":0,"secureConnectionStart":0},{"duration":3.8999998569488525,"initiatorType":"link","name":"https://jira.mariadb.org/s/7ebd35e77e471bc30ff0eba799ebc151-CDN/lu2bu7/820016/12ta74/8679b4946efa1a0bb029a3a22206fb5d/_/download/contextbatch/css/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":214,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":214,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":217.89999985694885,"responseStart":0,"secureConnectionStart":0},{"duration":195.59999990463257,"initiatorType":"script","name":"https://jira.mariadb.org/s/fbf975c0cce4b1abf04784eeae9ba1f4-CDN/lu2bu7/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/js/_super/batch.js?locale=en","startTime":214.09999990463257,"connectEnd":220.09999990463257,"connectStart":220.09999990463257,"domainLookupEnd":220.09999990463257,"domainLookupStart":220.09999990463257,"fetchStart":214.09999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":220.29999995231628,"responseEnd":409.69999980926514,"responseStart":236,"secureConnectionStart":220.09999990463257},{"duration":42.40000009536743,"initiatorType":"script","name":"https://jira.mariadb.org/s/94c15bff32baef80f4096a08aceae8bc-CDN/lu2bu7/820016/12ta74/c92c0caa9a024ae85b0ebdbed7fb4bd7/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en","startTime":214.19999980926514,"connectEnd":214.19999980926514,"connectStart":214.19999980926514,"domainLookupEnd":214.19999980926514,"domainLookupStart":214.19999980926514,"fetchStart":214.19999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":221.89999985694885,"responseEnd":256.59999990463257,"responseStart":248.39999985694885,"secureConnectionStart":214.19999980926514},{"duration":329.7000000476837,"initiatorType":"script","name":"https://jira.mariadb.org/s/099b33461394b8015fc36c0a4b96e19f-CDN/lu2bu7/820016/12ta74/8679b4946efa1a0bb029a3a22206fb5d/_/download/contextbatch/js/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true","startTime":214.19999980926514,"connectEnd":214.19999980926514,"connectStart":214.19999980926514,"domainLookupEnd":214.19999980926514,"domainLookupStart":214.19999980926514,"fetchStart":214.19999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":221.09999990463257,"responseEnd":543.8999998569489,"responseStart":250.79999995231628,"secureConnectionStart":214.19999980926514},{"duration":42.60000014305115,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":214.39999985694885,"connectEnd":214.39999985694885,"connectStart":214.39999985694885,"domainLookupEnd":214.39999985694885,"domainLookupStart":214.39999985694885,"fetchStart":214.39999985694885,"redirectEnd":0,"redirectStart":0,"requestStart":222.29999995231628,"responseEnd":257,"responseStart":250,"secureConnectionStart":214.39999985694885},{"duration":47.89999985694885,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":214.5,"connectEnd":214.5,"connectStart":214.5,"domainLookupEnd":214.5,"domainLookupStart":214.5,"fetchStart":214.5,"redirectEnd":0,"redirectStart":0,"requestStart":224.19999980926514,"responseEnd":262.39999985694885,"responseStart":255.5,"secureConnectionStart":214.5},{"duration":9.299999952316284,"initiatorType":"link","name":"https://jira.mariadb.org/s/b04b06a02d1959df322d9cded3aeecc1-CDN/lu2bu7/820016/12ta74/a2ff6aa845ffc9a1d22fe23d9ee791fc/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":214.59999990463257,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":214.59999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":223.89999985694885,"responseStart":0,"secureConnectionStart":0},{"duration":49.80000019073486,"initiatorType":"script","name":"https://jira.mariadb.org/rest/api/1.0/shortcuts/820016/47140b6e0a9bc2e4913da06536125810/shortcuts.js?context=issuenavigation&context=issueaction","startTime":214.69999980926514,"connectEnd":214.69999980926514,"connectStart":214.69999980926514,"domainLookupEnd":214.69999980926514,"domainLookupStart":214.69999980926514,"fetchStart":214.69999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":227.59999990463257,"responseEnd":264.5,"responseStart":258.89999985694885,"secureConnectionStart":214.69999980926514},{"duration":11.200000047683716,"initiatorType":"link","name":"https://jira.mariadb.org/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/lu2bu7/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.css?jira.create.linked.issue=true","startTime":214.79999995231628,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":214.79999995231628,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":226,"responseStart":0,"secureConnectionStart":0},{"duration":51,"initiatorType":"script","name":"https://jira.mariadb.org/s/3339d87fa2538a859872f2df449bf8d0-CDN/lu2bu7/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.js?jira.create.linked.issue=true&locale=en","startTime":214.89999985694885,"connectEnd":214.89999985694885,"connectStart":214.89999985694885,"domainLookupEnd":214.89999985694885,"domainLookupStart":214.89999985694885,"fetchStart":214.89999985694885,"redirectEnd":0,"redirectStart":0,"requestStart":228,"responseEnd":265.89999985694885,"responseStart":257.2999999523163,"secureConnectionStart":214.89999985694885},{"duration":254.79999995231628,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":222.29999995231628,"connectEnd":222.29999995231628,"connectStart":222.29999995231628,"domainLookupEnd":222.29999995231628,"domainLookupStart":222.29999995231628,"fetchStart":222.29999995231628,"redirectEnd":0,"redirectStart":0,"requestStart":235.79999995231628,"responseEnd":477.09999990463257,"responseStart":468.09999990463257,"secureConnectionStart":222.29999995231628},{"duration":255.59999990463257,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":222.29999995231628,"connectEnd":222.29999995231628,"connectStart":222.29999995231628,"domainLookupEnd":222.29999995231628,"domainLookupStart":222.29999995231628,"fetchStart":222.29999995231628,"redirectEnd":0,"redirectStart":0,"requestStart":255.39999985694885,"responseEnd":477.89999985694885,"responseStart":471,"secureConnectionStart":222.29999995231628},{"duration":102.79999995231628,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":551.7999999523163,"connectEnd":551.7999999523163,"connectStart":551.7999999523163,"domainLookupEnd":551.7999999523163,"domainLookupStart":551.7999999523163,"fetchStart":551.7999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":622.5999999046326,"responseEnd":654.5999999046326,"responseStart":653,"secureConnectionStart":551.7999999523163},{"duration":151.40000009536743,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":756.6999998092651,"connectEnd":756.6999998092651,"connectStart":756.6999998092651,"domainLookupEnd":756.6999998092651,"domainLookupStart":756.6999998092651,"fetchStart":756.6999998092651,"redirectEnd":0,"redirectStart":0,"requestStart":876.1999998092651,"responseEnd":908.0999999046326,"responseStart":906.8999998569489,"secureConnectionStart":756.6999998092651},{"duration":90.90000009536743,"initiatorType":"script","name":"https://www.google-analytics.com/analytics.js","startTime":828.6999998092651,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":828.6999998092651,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":919.5999999046326,"responseStart":0,"secureConnectionStart":0}],"fetchStart":0,"domainLookupStart":10,"domainLookupEnd":36,"connectStart":36,"connectEnd":56,"secureConnectionStart":45,"requestStart":57,"responseStart":206,"responseEnd":222,"domLoading":209,"domInteractive":993,"domContentLoadedEventStart":993,"domContentLoadedEventEnd":1040,"domComplete":1404,"loadEventStart":1404,"loadEventEnd":1404,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[{"name":"bigPipe.sidebar-id.start","time":974.6999998092651},{"name":"bigPipe.sidebar-id.end","time":975.2999999523163},{"name":"bigPipe.activity-panel-pipe-id.start","time":975.5},{"name":"bigPipe.activity-panel-pipe-id.end","time":976.3999998569489},{"name":"activityTabFullyLoaded","time":1058.5999999046326}],"measures":[],"correlationId":"e0d29d44e9a21b","effectiveType":"4g","downlink":9.6,"rtt":0,"serverDuration":78,"dbReadsTimeInMs":12,"dbConnsTimeInMs":18,"applicationHash":"9d11dbea5f4be3d4cc21f03a88dd11d8c8687422","experiments":[]}}
It's the bug
MDEV-7613which was fixed in 5.5.43 and the bugfix will be merged into next releases of 10.0 and 10.1.I checked that the provided test case fails on 5.5.42, and stops failing after applying the patch for
MDEV-7613.