[MDEV-27080] Malicious data type overflow in joint query leads to service coredump Created: 2021-11-18 Updated: 2022-06-22 Resolved: 2022-06-22 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Server |
| Affects Version/s: | 10.3.30, 10.3.31, 10.3.32, 10.2, 10.3, 10.4, 10.5, 10.6, 10.7 |
| Fix Version/s: | 10.3.36, 10.4.26, 10.5.17, 10.6.9, 10.7.5, 10.8.4, 10.9.2 |
| Type: | Bug | Priority: | Critical |
| Reporter: | willcao | Assignee: | Oleksandr Byelkin |
| Resolution: | Duplicate | Votes: | 0 |
| Labels: | None | ||
| Environment: |
x86 mariadb server环境 |
||
| Issue Links: |
|
||||||||||||||||
| Description |
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
| Comments |
| Comment by willcao [ 2021-11-18 ] | |||||||||||||||||||||||||||
|
Incorporating the following patches can solve this problem
| |||||||||||||||||||||||||||
| Comment by Anel Husakovic [ 2021-11-18 ] | |||||||||||||||||||||||||||
|
Hi willcao, thanks for reporting the bug. | |||||||||||||||||||||||||||
| Comment by Alice Sherepa [ 2021-11-18 ] | |||||||||||||||||||||||||||
|
THank you! I repeated as described on 10.2-10.7
| |||||||||||||||||||||||||||
| Comment by Oleksandr Byelkin [ 2022-06-22 ] | |||||||||||||||||||||||||||
|
For me it return an error:
| |||||||||||||||||||||||||||
| Comment by Oleksandr Byelkin [ 2022-06-22 ] | |||||||||||||||||||||||||||
|
with fixed query:
it return an error
| |||||||||||||||||||||||||||
| Comment by Oleksandr Byelkin [ 2022-06-22 ] | |||||||||||||||||||||||||||
|
I rewind to the point when it was repeatable and found that cause of the bug is that a field which can not be NULL get a NULL value due to a bug fixed in https://jira.mariadb.org/browse/MDEV-25994. Of course the code can be done more robust with a patch like this:
but IMHO it is overkill to check for NULL where NULL is impossible. |