MySQL Bugs: #32376: MySQL crash with simple select combining variables, column alias and 'order by'

Bug #32376	MySQL crash with simple select combining variables, column alias and 'order by'
Submitted:	14 Nov 2007 15:28	Modified:	16 Nov 2007 12:45
Reporter:	Shlomo Priymak	Email Updates:
Status:	Duplicate	Impact on me:	None
Category:	MySQL Server	Severity:	S2 (Serious)
Version:	5.1.22	OS:	Any
Assigned to:	Assigned Account	CPU Architecture:	Any

Description:
By issuing a simple select statement, the MySQL process crashes, and fails to perform the query requested.
Although a workaround is quite easy - this is a significant vulnerability, since it makes it trivial to bring down a server.

How to repeat:
create table test.t(c int) engine = innodb;

select @var := c as c
from t
order by c asc;

If the query is changed to 

select @var := c as d
from 
order by c asc;

It works well.

This is probably a MySQL server bug. InnoDB does not process @-variables.

Thank you for the bug report. Verified as described (this bug not affects 5.0).

create table test.t(c int) engine = innodb;
select @var := c as c
from t
order by c asc;

ChangeSet@1.2614, 2007-11-13 11:12:53+01:00, istruewing@stella.local +3 -0
  Bug#32091: Security breach via directory changes
  
  Post pushbuild fix
  
  Disabled test on windows due to bug#30459
  (DATA/INDEX DIR for partitions not working on windows)
  
  Patch from Mattias Jonsson.

[miguel@skybr 5.1]$ bin/mysql -uroot test
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1
Server version: 5.1.23-rc-debug Source distribution

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> create table test.t(c int) engine = innodb;
Query OK, 0 rows affected (0.03 sec)

mysql> 
mysql> select @var := c as c
    -> from t
    -> order by c asc;
ERROR 2013 (HY000): Lost connection to MySQL server during query

I marked this as InnoDB at the start, since when creating the table as MyISAM, the problem does not repeat itself.

Verified this crash on Ubuntu Server 6.06 as well.

Duplicate of bug #32260.