Crash in Copy_field::set in maria-5.3
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
MariaDB |
Fix Released
|
Critical
|
Igor Babaev |
Bug Description
The following query:
SELECT alias2.f2
FROM t5 AS alias1
LEFT JOIN t4 AS alias2 JOIN t3 AS alias3 ON alias2.f3 = alias3.f3 ON alias1.f1 = alias3.f1
LEFT JOIN t2 AS alias4
RIGHT JOIN t5 AS alias6 JOIN t1 AS alias7 ON alias6.f3 = alias7.f1 ON alias4.f4 JOIN t4 AS alias8 ON alias4.f3 ON alias3.f1 = alias4.f3
WHERE alias8.f1 ;
causes various valgrind warnings and the following crash:
# 2011-01-25T18:42:48 #5 0x08402edd in Copy_field:
# 2011-01-25T18:42:48 #6 0x08402eb1 in Copy_field::set (this=0x912d8454, to=0x912d8460, from=0x9106d250, save=false) at field_conv.cc:632
# 2011-01-25T18:42:48 #7 0x08334e1f in store_key_
# 2011-01-25T18:42:48 #8 0x08305664 in JOIN::optimize (this=0x912d1ea8) at sql_select.cc:1075
# 2011-01-25T18:42:48 #9 0x0830a722 in mysql_select (thd=0xbd96fa8, rref_pointer_
# 2011-01-25T18:42:48 order=0x912d04f0, group=0x912d0418, having=0x0, proc_param=0x0, select_
# 2011-01-25T18:42:48 at sql_select.cc:2635
# 2011-01-25T18:42:48 #10 0x08332ba9 in mysql_explain_union (thd=0xbd96fa8, unit=0xbd986a4, result=0x912d0908) at sql_select.cc:19652
# 2011-01-25T18:42:48 #11 0x082a0ab2 in execute_
# 2011-01-25T18:42:48 #12 0x08297c3f in mysql_execute_
# 2011-01-25T18:42:48 #13 0x082a31c8 in mysql_parse (thd=0xbd96fa8,
# 2011-01-25T18:42:48 rawbuf=0xa75f0730 "EXPLAIN SELECT alias2 . `col_int` AS field1 FROM G AS alias1 LEFT JOIN C AS alias2 LEFT JOIN B AS alias3 ON alias2 . `col_int_key` = alias3 . `col_int_key` ON alias1 . `pk` = alias3 . `pk` LEFT JOIN E AS alias4 RIGHT OUTER JOIN K AS alias5 LEFT JOIN G AS alias6 ON alias5 . `col_varchar_
# 2011-01-25T18:42:48 #14 0x082958d7 in dispatch_command (command=COM_QUERY, thd=0xbd96fa8, packet=0xbd98fb1 "", packet_length=786) at sql_parse.cc:1210
# 2011-01-25T18:42:48 #15 0x08294d84 in do_command (thd=0xbd96fa8) at sql_parse.cc:903
# 2011-01-25T18:42:48 #16 0x08291e62 in handle_
# 2011-01-25T18:42:48 #17 0x00821919 in start_thread () from /lib/libpthread
# 2011-01-25T18:42:48 #18 0x0076acce in clone () from /lib/libc.so.6
test case:
CREATE TABLE t1 ( f1 int(11), PRIMARY KEY (f1)) ;
INSERT IGNORE INTO t1 VALUES ('100');
CREATE TABLE t2 ( f3 int(11), f4 varchar(1024) COLLATE utf8_general_ci, KEY (f3)) ;
INSERT IGNORE INTO t2 VALUES (NULL,'
CREATE TABLE t3 ( f1 int(11), f3 int(11), PRIMARY KEY (f1), KEY (f3)) ;
INSERT IGNORE INTO t3 VALUES ('1','494862336');
CREATE TABLE t4 ( f1 int(11), f3 int(11), f2 int(11), KEY (f3)) ;
INSERT IGNORE INTO t4 VALUES ('1',NULL,
CREATE TABLE t5 ( f1 int(11), f3 int(11), PRIMARY KEY (f1), KEY (f3)) ;
INSERT IGNORE INTO t5 VALUES ('1',NULL)
SELECT alias2.f2
FROM t5 AS alias1
LEFT JOIN t4 AS alias2 JOIN t3 AS alias3 ON alias2.f3 = alias3.f3 ON alias1.f1 = alias3.f1
LEFT JOIN t2 AS alias4
RIGHT JOIN t5 AS alias6 JOIN t1 AS alias7 ON alias6.f3 = alias7.f1 ON alias4.f4 JOIN t4 AS alias8 ON alias4.f3 ON alias3.f1 = alias4.f3
WHERE alias8.f1 ;
Changed in maria: | |
status: | New → Confirmed |
importance: | Undecided → Critical |
assignee: | nobody → Igor Babaev (igorb-seattle) |
Changed in maria: | |
status: | Confirmed → In Progress |
Changed in maria: | |
status: | In Progress → Fix Committed |
Changed in maria: | |
status: | Fix Committed → Fix Released |
Not repeatable with maria-5.2 or mysql 5.5