[MDEV-22764] Crash with a stored aggregate function returning INET6 Created: 2020-06-01  Updated: 2020-06-01  Resolved: 2020-06-01

Status: Closed
Project: MariaDB Server
Component/s: Data types, Stored routines
Affects Version/s: 10.5
Fix Version/s: 10.5.4

Type: Bug Priority: Major
Reporter: Alexander Barkov Assignee: Alexander Barkov
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-20280 PERCENTILE_DISC() rejects temporal an... Closed

 Description   

This script craches the server:

DELIMITER $$
CREATE OR REPLACE AGGREGATE FUNCTION aggregate_min_inet6(x INET6) RETURNS INET6
BEGIN
  DECLARE res INET6 DEFAULT NULL;
  DECLARE CONTINUE HANDLER FOR NOT FOUND
    RETURN res;
  LOOP
    FETCH GROUP NEXT ROW;
    IF (res IS NULL) OR (res > x) THEN
      SET res= x;
    END IF;
  END LOOP;
END;
$$
DELIMITER ;
 
CREATE OR REPLACE TABLE t1 (name CHAR(30), val INET6);
INSERT INTO t1 VALUES ('a', '::05');
INSERT INTO t1 VALUES ('a', '::03');
INSERT INTO t1 VALUES ('b', '::01');
INSERT INTO t1 VALUES ('b', '::02');
INSERT INTO t1 VALUES ('b', '::05');
 
CREATE OR REPLACE TABLE t2 (name CHAR(30), val INET6);
INSERT INTO t2 SELECT name, aggregate_min_inet6(val) pc FROM t1 GROUP BY name;

with the following stack trace:

#0  0x00007ffff763c625 in raise () from /lib64/libc.so.6
#1  0x00007ffff76258d9 in abort () from /lib64/libc.so.6
#2  0x00007ffff76257a9 in __assert_fail_base.cold () from /lib64/libc.so.6
#3  0x00007ffff7634a66 in __assert_fail () from /lib64/libc.so.6
#4  0x0000000000752144 in Item::val_native (this=0x7fff98097c70, 
    thd=0x7fff98000d48, to=0x7ffff43962e0)
    at /home/bar/maria-git/server.10.5.vg/sql/item.h:1362
#5  0x0000000001579e07 in Type_handler_inet6::Item_save_in_field (
    this=0x2a671b0 <type_handler_inet6>, item=0x7fff98097c70, 
    field=0x7fffc400a460, no_conversions=false)
    at /home/bar/maria-git/server.10.5.vg/plugin/type_inet/sql_type_inet.h:586
#6  0x0000000000bf7715 in Item::save_in_field (this=0x7fff98097c70, 
    field=0x7fffc400a460, no_conversions=false)
    at /home/bar/maria-git/server.10.5.vg/sql/item.cc:6605
#7  0x00000000007e00b4 in fill_record (thd=0x7fff98000d48, 
    table=0x7fff9809cdc8, ptr=0x7fff9809a890, values=..., ignore_errors=true, 
    use_value=false) at /home/bar/maria-git/server.10.5.vg/sql/sql_base.cc:8719
#8  0x00000000007e023f in fill_record_n_invoke_before_triggers (


Generated at Thu Feb 08 09:17:17 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.