Bug #11088 Crash on query
| Submitted: | 3 Jun 2005 22:34 | Modified: | 21 Jun 2005 12:18 |
|---|---|---|---|
| Reporter: | Bara Mustafa | Email Updates: | |
| Status: | Closed | Impact on me: | |
| Category: | MySQL Server: Optimizer | Severity: | S1 (Critical) |
| Version: | 4.1.12 & 5.0.6 | OS: | Linux (Linux & Windows) |
| Assigned to: | Igor Babaev | CPU Architecture: | Any |
[3 Jun 2005 22:37]
Bara Mustafa
I forgot to mention the returned message I get when using PHP is: #2006 - MySQL server has gone away
[3 Jun 2005 23:37]
MySQL Verification Team
Thank you for the bug report I was able to repeat with current BK source
5.0 server.
050604 2:29:38 [Note] /home/miguel/dbs/5.0/libexec/mysqld: ready for connections.
Version: '5.0.7-beta-debug' socket: '/tmp/mysql.sock' port: 3306 Source distribution
[New Thread 180236 (LWP 11539)]
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 180236 (LWP 11539)]
0x081ca927 in String::real_alloc (this=0x8e98d9c, arg_length=0) at sql_string.cc:57
warning: Source file is more recent than executable.
57 }
(gdb) backtrace full
#0 0x081ca927 in String::real_alloc (this=0x8e98d9c, arg_length=0) at sql_string.cc:57
No locals.
#1 0x0815fb01 in String (this=0x8e98d9c, length_arg=4294967295) at sql_string.h:48
No locals.
#2 0x0815f825 in Item_str_buff (this=0x8e98d90, arg=0x8e971e8) at item.h:1502
No locals.
#3 0x0815eef9 in new_Item_buff (item=0x8e971e8) at item_buff.cc:33
No locals.
#4 0x0823cfd2 in alloc_group_fields (join=0x8e97920, group=0x8e978d8) at sql_select.cc:12247
tmp = (class Item_buff *) 0xbe3fefcc
#5 0x0823cf73 in make_group_fields (main_join=0x8e97920, curr_join=0x8e97920) at sql_select.cc:12227
No locals.
#6 0x082235d1 in JOIN::exec (this=0x8e97920) at sql_select.cc:1481
tmp_error = -2138813952
_db_func_ = 0x8e7b634 " ré\b@té\b\002"
_db_file_ = 0x8e7b390 "H×a\b(ï\177\b,ï\177\bX×a\b(xé\b qé\b"
_db_level_ = 149518624
---Type <return> to continue, or q <return> to quit---
_db_framep_ = (char **) 0x8e7b5c4
curr_join = (JOIN *) 0x8e97920
curr_all_fields = (List<Item> *) 0x8e9864c
curr_fields_list = (List<Item> *) 0x8e7b634
curr_tmp_table = (TABLE *) 0x0
#7 0x08224e31 in mysql_select (thd=0x8e7b390, rref_pointer_array=0x8e7b6d4, tables=0x8e97488, wild_num=0,
fields=@0x8e7b634, conds=0x8e97718, og_num=1, order=0x0, group=0x8e978d8, having=0x0, proc_param=0x0,
select_options=2156153344, result=0x8e97910, unit=0x8e7b3e0, select_lex=0x8e7b5c4) at sql_select.cc:2042
err = false
free_join = true
_db_func_ = 0x8e7b5c4 "\2104_\b"
_db_file_ = 0xbe3ff10c "ĵç\bĵç\bà³ç\b\020yé\b,ñ?¾I9\037\b\020yé\b\001"
_db_level_ = 4294967295
_db_framep_ = (char **) 0xffffffff
join = (JOIN *) 0x8e97920
#8 0x0821f325 in handle_select (thd=0x8e7b390, lex=0x8e7b3d0, result=0x8e97910, setup_tables_done_option=0)
at sql_select.cc:242
---Type <return> to continue, or q <return> to quit---
unit = (SELECT_LEX_UNIT *) 0x8e7b3e0
res = false
select_lex = (SELECT_LEX *) 0x8e7b5c4
_db_func_ = 0x8e97910 "ÈÖa\b\220³ç\bà³ç\b\217\217\217\217\030\212é\bÄí?¾è\210é\b"
_db_file_ = 0x81f3949 "\213E\bÇ"
_db_level_ = 3191861548
_db_framep_ = (char **) 0x8e97910
#9 0x081e6e56 in mysql_execute_command (thd=0x8e7b390) at sql_parse.cc:2400
result = (class select_result *) 0x8e97910
res = false
result = 0
lex = (LEX *) 0x8e7b3d0
select_lex = (SELECT_LEX *) 0x8e7b5c4
slave_fake_lock = false
fake_prev_lock = (MYSQL_LOCK *) 0x0
first_table = (TABLE_LIST *) 0x8e97488
all_tables = (TABLE_LIST *) 0x8e97488
---Type <return> to continue, or q <return> to quit---
unit = (SELECT_LEX_UNIT *) 0x8e7b3e0
_db_func_ = 0x0
_db_file_ = 0x0
_db_level_ = 0
_db_framep_ = (char **) 0x8e7b3d0
#10 0x081ef6b1 in mysql_parse (thd=0x8e7b390,
inBuf=0x8e97130 "SELECT hostname AS name, COUNT(DISTINCT user_id) AS no FROM log_logins WHERE hostname LIKE '%aol%' GROUP BY hostname", length=116) at sql_parse.cc:5303
lex = (LEX *) 0x8e7b3d0
_db_func_ = 0x8e8f145 ""
_db_file_ = 0x0
_db_level_ = 12
_db_framep_ = (char **) 0x40051530
#11 0x081e4f72 in dispatch_command (command=COM_QUERY, thd=0x8e7b390,
packet=0x8e8f0d1 "SELECT hostname AS name, COUNT(DISTINCT user_id) AS no FROM log_logins WHERE hostname LIKE '%aol%' GROUP BY hostname", packet_length=117) at sql_parse.cc:1653
packet_end = 0x8e971a4 ""
---Type <return> to continue, or q <return> to quit---
net = (NET *) 0x8e7bb04
error = false
_db_func_ = 0x0
_db_file_ = 0x0
_db_level_ = 0
_db_framep_ = (char **) 0x0
#12 0x081e4782 in do_command (thd=0x8e7b390) at sql_parse.cc:1456
packet = 0x8e8f0d0 "\003SELECT hostname AS name, COUNT(DISTINCT user_id) AS no FROM log_logins WHERE hostname LIKE '%aol%' GROUP BY hostname"
old_timeout = 30
packet_length = 117
net = (NET *) 0x8e7bb04
command = COM_QUERY
_db_func_ = 0x8e7cb50 "ÿÿÿÿ"
_db_file_ = 0x81bbd44 "ÉÃU\211å\203ì(\213E\b\211\004$è¡"
_db_level_ = 3191863788
_db_framep_ = (char **) 0x1010
---Type <return> to continue, or q <return> to quit---
#13 0x081e38d7 in handle_one_connection (arg=0x8e7b390) at sql_parse.cc:1114
error = 0
net = (NET *) 0x8e7bb04
thd = (class THD *) 0x8e7b390
launch_time = 0
set = {__val = {0 <repeats 32 times>}}
#14 0x40187e51 in pthread_start_thread () from /lib/libpthread.so.0
No symbol table info available.
#15 0x40187ecf in pthread_start_thread_event () from /lib/libpthread.so.0
No symbol table info available.
#16 0x4030f92a in clone () from /lib/libc.so.6
No symbol table info available.
(gdb)
[4 Jun 2005 0:18]
MySQL Verification Team
Below call stack for server 4.1.13 BK on Windows:
/sql/sql_string.cpp
--53--
if (!(Ptr=(char*) my_malloc(arg_length,MYF(MY_WME))))
return TRUE;
Alloced_length=arg_length;
alloced=1;
}
Ptr[0]=0;
^^^^^^^^^^^^^^^^^^^^^crashes here
return FALSE;
}
> mysqld-debug.exe!String::real_alloc(unsigned long arg_length=0) Line 58 + 0x5 C++
mysqld-debug.exe!String::String(unsigned long length_arg=4294967295) Line 49 C++
mysqld-debug.exe!Item_str_buff::Item_str_buff(Item * arg=0x02fb8b08) Line 1121 + 0x2a C++
mysqld-debug.exe!new_Item_buff(Item * item=0x02fb8b08) Line 32 + 0x1f C++
mysqld-debug.exe!alloc_group_fields(JOIN * join=0x02fb9130, st_order * group=0x02fb90e8) Line 8637 + 0xe C++
mysqld-debug.exe!make_group_fields(JOIN * main_join=0x02fb9130, JOIN * curr_join=0x02fb9130) Line 8617 + 0x13 C++
mysqld-debug.exe!JOIN::exec() Line 1352 + 0xd C++
mysqld-debug.exe!mysql_select(THD * thd=0x00efced0, Item * * * rref_pointer_array=0x00efd108, st_table_list * tables=0x02fb8e38, unsigned int wild_num=0, List<Item> & fields={...}, Item * conds=0x02fb8fa8, unsigned int og_num=1, st_order * order=0x00000000, st_order * group=0x02fb90e8, Item * having=0x00000000, st_order * proc_param=0x00000000, unsigned long select_options=2189707776, select_result * result=0x02fb9120, st_select_lex_unit * unit=0x00efcf1c, st_select_lex * select_lex=0x00efd01c) Line 1607 C++
mysqld-debug.exe!handle_select(THD * thd=0x00efced0, st_lex * lex=0x00efcf10, select_result * result=0x02fb9120) Line 195 + 0x87 C++
mysqld-debug.exe!mysql_execute_command(THD * thd=0x00efced0) Line 2087 + 0x11 C++
mysqld-debug.exe!mysql_parse(THD * thd=0x00efced0, char * inBuf=0x02fb8a58, unsigned int length=116) Line 4222 + 0x9 C++
mysqld-debug.exe!dispatch_command(enum_server_command command=COM_QUERY, THD * thd=0x00efced0, char * packet=0x02fb0899, unsigned int packet_length=117) Line 1503 + 0x1d C++
mysqld-debug.exe!do_command(THD * thd=0x00efced0) Line 1316 + 0x31 C++
mysqld-debug.exe!handle_one_connection(void * arg=0x00efced0) Line 1048 + 0x9 C++
mysqld-debug.exe!pthread_start(void * param=0x00f0f520) Line 63 + 0x7 C
mysqld-debug.exe!_threadstart(void * ptd=0x00f0fde0) Line 173 + 0xd C
kernel32.dll!7c80b50b()
kernel32.dll!7c8399f3()
[7 Jun 2005 10:15]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/internals/25685
[7 Jun 2005 10:56]
Igor Babaev
The crash can be demonstrated with a simpler script:
CREATE TABLE t1 (id int PRIMARY KEY, user_id int, hostname longtext);
INSERT INTO t1 VALUES
(1, 7, 'cache-dtc-af05.proxy.aol.com'),
(2, 3, 'what.ever.com'),
(3, 7, 'cache-dtc-af05.proxy.aol.com'),
(4, 7, 'cache-dtc-af05.proxy.aol.com');
SELECT hostname, COUNT(DISTINCT user_id) as no FROM t1
WHERE hostname LIKE '%aol%'
GROUP BY hostname;
The crash happens due to an attempt to allocate a buffer of size 4294967295 bytes for the group value. Now the size of this buffer is limited by the value of max_sort_length.
[7 Jun 2005 14:23]
Igor Babaev
ChangeSet
1.2317 05/06/07 03:05:57 igor@rurik.mysql.com +5 -0
sql_select.cc, item_buff.cc, item.h:
Fixed bug #11088: a crash for queries with GROUP BY a BLOB column
+ COUNT(DISTINCT...) due to an attempt to allocate a too large
buffer for the BLOB field.
Now the size of the buffer is limited by max_sort_length.
group_by.test, group_by.result:
Added a test case for bug #11088.
The fix will appear in 4.1.13 and 5.0.7.
[10 Jun 2005 18:08]
Paul DuBois
Noted in 4.1.13, 5.0.7 changelogs.
[21 Jun 2005 11:24]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/internals/26234
Portions of this website are copyright © 2001, 2002 The PHP Group
Page generated in 0.044 sec. using MySQL 8.4.7-u6-cloud
Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the
respective copyright holders.
It is not reviewed in advance
by Oracle and does not necessarily represent the opinion of
Oracle or any other party.
Description: I have a table with 1709 rows in it. When I tried to do a query on it, the database died and had to be restarted. I have tested this with MySQl v4.1.12 on Linux & v5.0.6-beta on Windows. I will try to include all the data possible. How to repeat: CREATE TABLE `log_logins` ( `idd` int(11) NOT NULL auto_increment, `user_id` int(11) NOT NULL default '0', `datetime` int(11) NOT NULL default '0', `ipaddress` varchar(16) NOT NULL default '', `browser` varchar(250) NOT NULL default '', `country` varchar(20) NOT NULL default '', `hostname` longtext NOT NULL, PRIMARY KEY (`idd`), KEY `ipaddress` (`ipaddress`), KEY `browser` (`browser`), KEY `country` (`country`), KEY `user_id` (`user_id`) ) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=1710; INSERT INTO `log_logins` VALUES (15, 7, 1117282312, '205.188.117.69', 'Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1; iebar; .NET CLR 1.1.4322)', 'US', 'cache-dtc-af05.proxy.aol.com'); INSERT INTO `log_logins` VALUES (16, 3, 1117282438, '192.168.1.1', 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Hotbar4.5.3.0)', 'AU', 'what.ever.com'); INSERT INTO `log_logins` VALUES (17, 7, 1117282522, '205.188.117.69', 'Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1; iebar; .NET CLR 1.1.4322)', 'US', 'cache-dtc-af05.proxy.aol.com'); INSERT INTO `log_logins` VALUES (18, 7, 1117282542, '205.188.117.69', 'Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1; iebar; .NET CLR 1.1.4322)', 'US', 'cache-dtc-af05.proxy.aol.com'); SELECT hostname AS name, COUNT(DISTINCT user_id) AS no FROM log_logins WHERE hostname LIKE '%aol%' GROUP BY hostname