[MDEV-32418] Use-After-Poison at /mariadb-11.3.0/sql/sql_derived.cc:924 Created: 2023-10-10  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: Server
Affects Version/s: 10.4, 10.5, 10.6, 10.9, 10.10, 10.11, 11.0, 11.1, 11.2, 11.3.0
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2

Type: Bug Priority: Major
Reporter: Xin Wen Assignee: Oleksandr Byelkin
Resolution: Unresolved Votes: 0
Labels: None
Environment:

Ubuntu 20.04


 Description   

Run these queries in debug build:

CREATE TABLE x ( x INT ) ;
INSERT INTO x ( x ) VALUES ( 1 ) ;
UPDATE x SET x = 1 IN ( WITH RECURSIVE x ( x ) AS ( WITH x ( x ) AS ( SELECT 1 EXCEPT SELECT x + 1 FROM x WHERE x = 1 AND ( x = 1 OR x = 1 OR x = 1 ) WINDOW x AS ( ORDER BY x ) , x AS ( ORDER BY x ) ) SELECT 1 UNION SELECT x FROM x WHERE x IN ( 1 , 1 , 1 ) ) SELECT 1 ) WHERE x = 1 ;

Will trigger use-after-poison.
ASAN info:
=================================================================
==91329==ERROR: AddressSanitizer: use-after-poison on address 0x6290000b5278 at pc 0x000000a5448a bp 0x7fffd242a790 sp 0x7fffd242a788
READ of size 8 at 0x6290000b5278 thread T15
#0 0xa54489 in mysql_derived_prepare(THD*, LEX*, TABLE_LIST*) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:924:7
#1 0xa578e4 in mysql_handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:123:7
#2 0xe1e19e in Multiupdate_prelocking_strategy::handle_end(THD*) /home/wx/mariadb-11.3.0/sql/sql_update.cc:1549:7
#3 0x9c648f in open_tables(THD*, DDL_options_st const&, TABLE_LIST*, unsigned int, unsigned int, Prelocking_strategy*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:4747:38
#4 0x9cbaf7 in open_tables(THD*, TABLE_LIST*, unsigned int, unsigned int, Prelocking_strategy*) /home/wx/mariadb-11.3.0/sql/sql_base.h:267:10
#5 0x9cbaf7 in open_tables_for_query(THD*, TABLE_LIST*, unsigned int*, unsigned int, DML_prelocking_strategy*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:5746:7
#6 0xcc3b6a in Sql_cmd_dml::prepare(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:33256:7
#7 0xcc3eba in Sql_cmd_dml::execute(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:33318:9
#8 0xb2ce81 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:4361:27
#9 0xb1fe78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734:18
#10 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7
#11 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17
#12 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11
#13 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5
#14 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3
#15 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
#16 0x7ffff770f132 in clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x6290000b5278 is located 4216 bytes inside of 16400-byte region [0x6290000b4200,0x6290000b8210)
allocated by thread T15 here:
#0 0x7ca5fd in malloc (/usr/local/mysql/bin/mariadbd+0x7ca5fd)
#1 0x22a6308 in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89:29
#2 0x228fff9 in root_alloc /home/wx/mariadb-11.3.0/mysys/my_alloc.c:71:10
#3 0x228fff9 in alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:339:29
#4 0x11cc2c7 in Sql_alloc::operator new(unsigned long, st_mem_root*) /home/wx/mariadb-11.3.0/sql/sql_alloc.h:37:12
#5 0x11cc2c7 in base_list::push_back(void*, st_mem_root*) /home/wx/mariadb-11.3.0/sql/sql_list.h:195:18
#6 0x11cc2c7 in List<Item>::push_back(Item*, st_mem_root*) /home/wx/mariadb-11.3.0/sql/sql_list.h:505:23
#7 0x11cc2c7 in add_value_to_list(THD*, Item*) /home/wx/mariadb-11.3.0/sql/sql_class.h:7520:31
#8 0x11cc2c7 in MYSQLparse(THD*) /home/wx/mariadb-11.3.0/sql/sql_yacc.yy:13486:60
#9 0xb47377 in parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:10109:46
#10 0xb1fb8a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7686:15
#11 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7
#12 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17
#13 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11
#14 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5
#15 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3
#16 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8

Thread T15 created by T0 here:
#0 0x7b502a in pthread_create (/usr/local/mysql/bin/mariadbd+0x7b502a)
#1 0x1a00edd in my_thread_create(unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52:10
#2 0x1a00edd in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252:15
#3 0x80e649 in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139:11
#4 0x80e649 in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150:19
#5 0x80f608 in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212:3
#6 0x80f608 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274:5
#7 0x80caa8 in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398:9
#8 0x8051de in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045:3
#9 0x7ffff7614082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: use-after-poison /home/wx/mariadb-11.3.0/sql/sql_derived.cc:924:7 in mysql_derived_prepare(THD*, LEX*, TABLE_LIST*)
Shadow bytes around the buggy address:
0x0c528000e9f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c528000ea00: 00 00 00 00 00 00 00 00 f7 00 00 00 00 00 00 00
0x0c528000ea10: 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00 00
0x0c528000ea20: 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00
0x0c528000ea30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c528000ea40: 00 00 00 00 00 00 00 00 00 f7 00 f7 00 00 f7[f7]
0x0c528000ea50: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c528000ea60: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c528000ea70: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c528000ea80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 00 00 00
0x0c528000ea90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==91329==ABORTING

 Comments   
Comment by Alice Sherepa [ 2023-10-25 ]

Thanks! I repeated as described on 10.4-11.2, 

Version: '10.4.32-MariaDB-debug-log'  socket: '/home/alice/am/_depot/m-branch/m4-10.4-bld/mysql-test/var/tmp/mysqld.1.sock'  port: 16000  Source distribution
 
=================================================================
 
==1205920==ERROR: AddressSanitizer: use-after-poison on address 0x6290002d8200 at pc 0x555cba88a248 bp 0x7f2aaaa64d30 sp 0x7f2aaaa64d20
 
READ of size 8 at 0x6290002d8200 thread T27
 
    #0 0x555cba88a247 in mysql_derived_prepare /10.4/src/sql/sql_derived.cc:916
 
    #1 0x555cba885308 in mysql_handle_derived(LEX*, unsigned int) /10.4/src/sql/sql_derived.cc:123
 
    #2 0x555cbac41b98 in mysql_prepare_update(THD*, TABLE_LIST*, Item**, unsigned int, st_order*) /10.4/src/sql/sql_update.cc:1438
 
    #3 0x555cbac391c9 in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*) /10.4/src/sql/sql_update.cc:481
 
    #4 0x555cba9651ce in mysql_execute_command(THD*) /10.4/src/sql/sql_parse.cc:4451
 
    #5 0x555cba97e25a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:8012
 
    #6 0x555cba954680 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857
 
    #7 0x555cba9511ab in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378
 
    #8 0x555cbad5f56c in do_handle_one_connection(CONNECT*) /10.4/src/sql/sql_connect.cc:1420
 
    #9 0x555cbad5ee10 in handle_one_connection /10.4/src/sql/sql_connect.cc:1324
 
    #10 0x555cbba09d89 in pfs_spawn_thread /10.4/src/storage/perfschema/pfs.cc:1869
 
    #11 0x7f2ac1632608 in start_thread /build/glibc-BHL3KM/glibc-2.31/nptl/pthread_create.c:477
 
    #12 0x7f2ac1203132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
0x6290002d8200 is located 12288 bytes inside of 16460-byte region [0x6290002d5200,0x6290002d924c)
 
allocated by thread T27 here:
 
    #0 0x7f2ac1c30808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
 
    #1 0x555cbc59f758 in sf_malloc /10.4/src/mysys/safemalloc.c:118
 
    #2 0x555cbc56dcbc in my_malloc /10.4/src/mysys/my_malloc.c:101
 
    #3 0x555cbc549c9b in alloc_root /10.4/src/mysys/my_alloc.c:258
 
    #4 0x555cba6be8c9 in Query_arena::calloc(unsigned long) /10.4/src/sql/sql_class.h:1125
 
    #5 0x555cba97fce6 in st_select_lex::add_table_to_list(THD*, Table_ident*, st_mysql_const_lex_string*, unsigned long, thr_lock_type, enum_mdl_type, List<Index_hint>*, List<String>*, st_mysql_lex_string*) /10.4/src/sql/sql_parse.cc:8200
 
    #6 0x555cbafbf57d in MYSQLparse(THD*) /10.4/src/sql/sql_yacc.yy:12514
 
    #7 0x555cba98ce0c in parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool) /10.4/src/sql/sql_parse.cc:10362
 
    #8 0x555cba97dde8 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:7964
 
    #9 0x555cba954680 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857
 
    #10 0x555cba9511ab in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378
 
    #11 0x555cbad5f56c in do_handle_one_connection(CONNECT*) /10.4/src/sql/sql_connect.cc:1420
 
    #12 0x555cbad5ee10 in handle_one_connection /10.4/src/sql/sql_connect.cc:1324
 
    #13 0x555cbba09d89 in pfs_spawn_thread /10.4/src/storage/perfschema/pfs.cc:1869
 
    #14 0x7f2ac1632608 in start_thread /build/glibc-BHL3KM/glibc-2.31/nptl/pthread_create.c:477
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7f2ac1b5d815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
 
    #1 0x555cbba0a17a in spawn_thread_v1 /10.4/src/storage/perfschema/pfs.cc:1919
 
    #2 0x555cba64cf71 in inline_mysql_thread_create /10.4/src/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x555cba665103 in create_thread_to_handle_connection(CONNECT*) /10.4/src/sql/mysqld.cc:6289
 
    #4 0x555cba66589e in create_new_thread(CONNECT*) /10.4/src/sql/mysqld.cc:6359
 
    #5 0x555cba665d84 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.4/src/sql/mysqld.cc:6457
 
    #6 0x555cba666c40 in handle_connections_sockets() /10.4/src/sql/mysqld.cc:6615
 
    #7 0x555cba664808 in mysqld_main(int, char**) /10.4/src/sql/mysqld.cc:5947
 
    #8 0x555cba64af3c in main /10.4/src/sql/main.cc:25
 
    #9 0x7f2ac1108082 in __libc_start_main ../csu/libc-start.c:308
 
 
 
SUMMARY: AddressSanitizer: use-after-poison /10.4/src/sql/sql_derived.cc:916 in mysql_derived_prepare
 
Shadow bytes around the buggy address:
 
  0x0c5280052ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c5280053000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c5280053010: 00 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 00
 
  0x0c5280053020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c5280053030: 00 00 00 00 00 00 00 00 00 00 f7 00 f7 00 00 f7
 
=>0x0c5280053040:[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c5280053050: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c5280053060: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c5280053070: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 00 00 00 00
 
  0x0c5280053080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c5280053090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==1205920==ABORTING
 
----------SERVER LOG END-------------
 



Version: '10.5.23-MariaDB-debug-log'  
mariadbd: /10.5/src/sql/sql_select.cc:18839: TABLE* Create_tmp_table::start(THD*, TMP_TABLE_PARAM*, const LEX_CSTRING*): Assertion `m_alloced_field_count' failed.
 
231025 15:35:43 [ERROR] mysqld got signal 6 ;
 
 
 
Server version: 10.5.23-MariaDB-debug-log source revision: 85751ed81d6cdfffbe2572f401e62884a4e8c8dc
 
 
 
/lib/x86_64-linux-gnu/libc.so.6(+0x33fd6)[0x7fbed3b25fd6]
 
sql/sql_select.cc:18840(Create_tmp_table::start(THD*, TMP_TABLE_PARAM*, st_mysql_const_lex_string const*))[0x55b706f4a9e9]
 
sql/sql_select.cc:19697(create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool))[0x55b706f56361]
 
sql/sql_union.cc:351(select_unit::create_result_table(THD*, List<Item>*, bool, unsigned long long, st_mysql_const_lex_string const*, bool, bool, bool, unsigned int))[0x55b707105206]
 
sql/sql_derived.cc:697(mysql_derived_prepare(THD*, LEX*, TABLE_LIST*))[0x55b706d28c73]
 
sql/sql_derived.cc:200(mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int))[0x55b706d26113]
 
sql/table.cc:9312(TABLE_LIST::handle_derived(LEX*, unsigned int))[0x55b70719e8eb]
 
sql/sql_lex.h:4455(LEX::handle_list_of_derived(TABLE_LIST*, unsigned int))[0x55b706d70444]
 
sql/sql_lex.cc:4922(st_select_lex::handle_derived(LEX*, unsigned int))[0x55b706d969d7]
 
sql/table.cc:9309(TABLE_LIST::handle_derived(LEX*, unsigned int))[0x55b70719e85d]
 
sql/sql_lex.h:4455(LEX::handle_list_of_derived(TABLE_LIST*, unsigned int))[0x55b706d70444]
 
sql/sql_lex.cc:4922(st_select_lex::handle_derived(LEX*, unsigned int))[0x55b706d969d7]
 
sql/sql_select.cc:1250(JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x55b706ec3221]
 
sql/sql_union.cc:1103(st_select_lex_unit::prepare_join(THD*, st_select_lex*, select_result*, unsigned long long, bool))[0x55b70710beb9]
 
sql/sql_union.cc:1576(st_select_lex_unit::prepare(TABLE_LIST*, select_result*, unsigned long long))[0x55b7071106cd]
 
sql/sql_derived.cc:824(mysql_derived_prepare(THD*, LEX*, TABLE_LIST*))[0x55b706d29d46]
 
sql/sql_derived.cc:200(mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int))[0x55b706d26113]
 
sql/table.cc:9312(TABLE_LIST::handle_derived(LEX*, unsigned int))[0x55b70719e8eb]
 
sql/sql_lex.h:4455(LEX::handle_list_of_derived(TABLE_LIST*, unsigned int))[0x55b706d70444]
 
sql/sql_lex.cc:4922(st_select_lex::handle_derived(LEX*, unsigned int))[0x55b706d969d7]
 
sql/sql_derived.cc:778(mysql_derived_prepare(THD*, LEX*, TABLE_LIST*))[0x55b706d2968f]
 
sql/sql_derived.cc:123(mysql_handle_derived(LEX*, unsigned int))[0x55b706d258ce]
 
sql/sql_update.cc:1440(mysql_prepare_update(THD*, TABLE_LIST*, Item**, unsigned int, st_order*))[0x55b70712c7c7]
 
sql/sql_update.cc:479(mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*))[0x55b7071239d4]
 
sql/sql_parse.cc:4484(mysql_execute_command(THD*))[0x55b706e1215d]
 
sql/sql_parse.cc:8120(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55b706e2b977]
 
sql/sql_parse.cc:1894(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55b706e013a5]
 
sql/sql_parse.cc:1375(do_command(THD*))[0x55b706dfdd0d]
 
sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x55b70725c95b]
 
sql/sql_connect.cc:1320(handle_one_connection)[0x55b70725c2bf]
 
perfschema/pfs.cc:2203(pfs_spawn_thread)[0x55b707ee8aba]
 
nptl/pthread_create.c:478(start_thread)[0x7fbed4040609]
 
 
 
Query (0x62b0000852a8): UPDATE x SET x = 1 IN ( WITH RECURSIVE x ( x ) AS ( WITH x ( x ) AS ( SELECT 1 EXCEPT SELECT x + 1 FROM x WHERE x = 1 AND ( x = 1 OR x = 1 OR x = 1 ) WINDOW x AS ( ORDER BY x ) , x AS ( ORDER BY x ) ) SELECT 1 UNION SELECT x FROM x WHERE x IN ( 1 , 1 , 1 ) ) SELECT 1 ) WHERE x = 1

Generated at Thu Feb 08 10:31:12 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.