[MDEV-12846] sql_mode=ORACLE: using Oracle-style placeholders in direct query execution makes the server crash Created: 2017-05-19  Updated: 2017-12-12  Resolved: 2017-11-15

Status: Closed
Project: MariaDB Server
Component/s: Parser, Prepared Statements
Affects Version/s: 10.3
Fix Version/s: 10.3.3

Type: Bug Priority: Critical
Reporter: Alexander Barkov Assignee: Alexander Barkov
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Blocks
blocks MDEV-10142 PL/SQL parser Closed

 Description   

This problem is repeatable in bb-10.2-ext and 10.3.

This query correctly returns an error:

SET sql_mode=DEFAULT; SELECT ?;


ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '?' at line 1

This query makes the server crash on DBUG_ASSERT:

SET sql_mode=ORACLE; SELECT :a;

with the following stack trace:

#0  0x00007ffff5ddaa28 in raise () from /lib64/libc.so.6
 
#1  0x00007ffff5ddc62a in abort () from /lib64/libc.so.6
 
#2  0x00007ffff5dd3227 in __assert_fail_base () from /lib64/libc.so.6
 
#3  0x00007ffff5dd32d2 in __assert_fail () from /lib64/libc.so.6
 
#4  0x0000555555e41753 in Item_param::val_str (this=0x7ffe6c0119a0, 
    str=0x7ffff4197bd0) at /home/bar/maria-git/server.10.2-ext/sql/item.cc:4085
 
#5  0x0000555555d36e0d in Type_handler::Item_send_str (
 
    this=0x5555571fcce8 <type_handler_varchar>, item=0x7ffe6c0119a0, protocol=
 
    0x7ffe6c001030, buf=0x7ffff4197ba0)
 
    at /home/bar/maria-git/server.10.2-ext/sql/sql_type.cc:4963
 
#6  0x0000555555d39ac6 in Type_handler_string_result::Item_send (
 
    this=0x5555571fcce8 <type_handler_varchar>, item=0x7ffe6c0119a0, 
    protocol=0x7ffe6c001030, buf=0x7ffff4197ba0)
 
    at /home/bar/maria-git/server.10.2-ext/sql/sql_type.h:1593
 
#7  0x0000555555a97ea2 in Item::send (this=0x7ffe6c0119a0, 
    protocol=0x7ffe6c001030, buffer=0x7ffff4197ba0)



 Comments   
Comment by Alexander Barkov [ 2017-11-15 ]

As of 2017-11-15 the above script does not crash, however it still crashes if I use a param marker in an expression:

SET sql_mode=ORACLE;
 
SELECT 1+:a;

Generated at Thu Feb 08 08:00:56 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.