Bug #19356 Assert on undefined @uservar in prepared statement execute
Submitted: 25 Apr 2006 21:07 Modified: 13 Nov 2006 4:34
Reporter: Kristian Nielsen Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server: Prepared statements Severity:S2 (Serious)
Version:5.0.21/5.0BK/5.1BK OS:Linux (Linux)
Assigned to: Chad MILLER CPU Architecture:Any

[25 Apr 2006 21:07] Kristian Nielsen
Description:
The MySQL server crashes in assert() in a debug build when passing undefined user variable in a prepared statement execute.

How to repeat:
Use a debug build of mysql.

$ cd mysql-test
$ perl mysql-test-run.pl --debug --skip-ndb --start-and-exit alias
$ ../client/mysql --socket=var/tmp/master.sock -uroot test
mysql> create table t1 (   a int, primary key(a) );
mysql> prepare stmt1 from 'insert into t1 values(?)';
mysql> execute stmt1 using @UNDEFINED ;
ERROR 2013 (HY000): Lost connection to MySQL server during query

mysqld: sql_prepare.cc:2895: bool Prepared_statement::execute(String*, bool): Assertion `thd->free_list == __null' failed.
[26 Apr 2006 2:23] MySQL Verification Team
Thank you for the bug report.

miguel@hegel:~/dbs/mysql-5.0/mysql-test> ../client/mysql --socket=var/tmp/master.sock -uroot test
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1 to server version: 5.0.21-debug-log

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> create table t1 (   a int, primary key(a) );
Query OK, 0 rows affected (0.02 sec)

mysql> prepare stmt1 from 'insert into t1 values(?)';
Query OK, 0 rows affected (0.02 sec)
Statement prepared

mysql> execute stmt1 using @UNDEFINED ;
ERROR 2013 (HY000): Lost connection to MySQL server during query
mysql> 

miguel@hegel:~/dbs/mysql-5.1-new/mysql-test> ../client/mysql --socket=var/tmp/master.sock -uroot test
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1 to server version: 5.1.10-beta-debug-log

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> create table t1 (   a int, primary key(a) );
Query OK, 0 rows affected (0.02 sec)

mysql> prepare stmt1 from 'insert into t1 values(?)';
Query OK, 0 rows affected (0.01 sec)
Statement prepared

mysql> execute stmt1 using @UNDEFINED ;
ERROR 2013 (HY000): Lost connection to MySQL server during query
mysql>
[2 Oct 2006 17:19] Bugs System
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/12954

ChangeSet@1.2275, 2006-10-02 13:19:03-04:00, cmiller@zippy.cornsilk.net +4 -0
  Bug#19356: Assert on undefined @uservar in prepared statement execute
  
  The executing code had a safety assertion so that it refused to free Items
  that it didn't create.  However, there is a case, undefined user variables,
  which would put Items into the list to be freed.
  
  Instead, do something that is more risky in expectation that the code will 
  be refactored soon, as Kostja wants to do:  Remove the assertions from 
  prepare() and execute().  Put one assertion at a higher level, before 
  stmt->set_params_from_vars(), which may then create new to-be-freed Items .
[4 Oct 2006 15:19] Bugs System
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/13077

ChangeSet@1.2275, 2006-10-04 11:19:23-04:00, cmiller@zippy.cornsilk.net +4 -0
  Bug#19356: Assert on undefined @uservar in prepared statement execute
  
  The executing code had a safety assertion so that it refused to free Items
  that it didn't create.  However, there is a case, undefined user variables,
  which would put Items into the list to be freed.
  
  Instead, do something that is more risky in expectation that the code will 
  be refactored soon, as Kostja wants to do:  Remove the assertions from 
  prepare() and execute().  Put one assertion at a higher level, before 
  stmt->set_params_from_vars(), which may then create new to-be-freed Items .
[13 Nov 2006 4:34] Paul DuBois
Noted in 5.0.29 (5.0.30), 5.1.13 changelogs.

For a debug server, a reference to an undefined user variable in a 
prepared statment executed with EXECUTE caused an assertion failure.