[MDEV-25631] Crash executing query with VIEW, aggregate and subquery Created: 2021-05-10 Updated: 2022-11-29 Resolved: 2022-01-11 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Optimizer |
| Affects Version/s: | 5.5, 10.0, 10.1, 10.5.9, 10.2, 10.3, 10.4, 10.5 |
| Fix Version/s: | 10.2.42, 10.3.33, 10.4.23, 10.5.14, 10.6.6, 10.7.2 |
| Type: | Bug | Priority: | Major |
| Reporter: | Zuming Jiang | Assignee: | Igor Babaev |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | crash, fuzzer | ||
| Environment: |
Ubuntu 18.04 |
||
| Attachments: |
|
||||||||||||||||||||||||
| Issue Links: |
|
||||||||||||||||||||||||
| Description |
|
I used my fuzzing tool to test Mariadb , and found a bug that can result in an abortion. Mariadb installation: How to Repeat: I have simplified the content of fuzz.sql, and I hope fuzz.sql can help you reproduce the bug and fix it. In addition, I attach the abortion report (which has its stack trace). |
| Comments |
| Comment by Alice Sherepa [ 2021-05-10 ] | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Thanks!
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Sergei Petrunia [ 2021-05-15 ] | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
So, it is crashing when trying to find which select the COUNT() function View v1 has column i1, so
should be aggregated locally.
nest_level=1 looks to be correct. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Sergei Petrunia [ 2021-05-15 ] | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Looking where Item_sum::max_arg_level is changed. It happens here:
https://gist.github.com/spetrunia/50ca57bb94867ee1ce8a2ec4557303cc
The code is doing fix_fields for the "t1.i1" of the subquery in the ON
It has located the field in the right select:
But the select has
I think this is depth value that's "local to the view we are in". Another odd thing, why is it touching the IN subquery? the reference is made But the code is looking at thd->lex->in_sum_func and that one indeed is
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Sergei Petrunia [ 2021-05-16 ] | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Right, SELECT_LEX has nest_level_base pointer to indicate which "base" the nest_level variable refers to. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Sergei Petrunia [ 2021-05-16 ] | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
A patch demonstrating the approach this can be fixed: http://lists.askmonty.org/pipermail/commits/2021-May/014606.html . Need to discuss it with sanja and [igor. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Oleksandr Byelkin [ 2021-06-28 ] | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
What do you think about such change?
(as well in other places where in_sum_func used. All other places shoud be not affected, bacuse only thd->lex break borders of name resolution contexts chains. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Oleksandr Byelkin [ 2021-06-28 ] | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
also why it is 10.5 not 10.2? | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Igor Babaev [ 2022-01-11 ] | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
A fix for this bug was pushed into 10.2 It should be merged upstream as it is. |