[MDEV-5689] ExtractValue(xml, 'substring(/x,/y)') crashes Created: 2014-02-17  Updated: 2014-03-23  Resolved: 2014-03-23

Status: Closed
Project: MariaDB Server
Component/s: None
Affects Version/s: 5.3.12, 5.5.33a, 10.0.6
Fix Version/s: 10.0.10

Type: Bug Priority: Major
Reporter: Alexander Barkov Assignee: Alexander Barkov
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-5652 5.5.36 merge Closed
relates to MDEV-5709 ExtractValue() with XPath variable re... Closed

 Description   

This query crashes the server:

SELECT ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,..)');

Notice '..' in the 'position' argument to XPath substring() function,
which obviously goes above the root XML element.

If I change the position argument to something inside the XML tree,
it works fine:

mysql> SELECT ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,/a/c)');
+--------------------------------------------------------------------------+
| ExtractValue('<a><b>abc</b><c>2</c><d>1</d></a>','substring(/a/b,/a/c)') |
+--------------------------------------------------------------------------+
| bc                                                                       |
+--------------------------------------------------------------------------+
1 row in set (0.00 sec)



 Comments   
Comment by Sergei Golubchik [ 2014-03-18 ]

5.5 crash is already fixed, so this patch is considered for 10.0 only

Comment by Alexander Barkov [ 2014-03-23 ]

Pushed into 10.0

Generated at Thu Feb 08 07:06:17 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.