Bug #120567 Raw COM_STMT_EXECUTE triggers set_parameter_value(): `len == 0 || len == 4 || len == 7 || len == 11 || len == 13`
Submitted: 29 May 7:18
Reporter: Hongbo Feng Email Updates:
Status: Open Impact on me:
None 
Category:MySQL Server: Prepared statements Severity:S6 (Debug Builds)
Version:9.6.0-debug-asan OS:Ubuntu (22.04)
Assigned to: CPU Architecture:x86 (x86_64)
Tags: assertion, binary-protocol, com-stmt-execute, crash, prepared-statement, protocol, stored-routine

[29 May 7:18] Hongbo Feng
Description:
I found a server-side assertion failure while testing MySQL prepared statements through the classic MySQL protocol.

The reproducer creates a deterministic stored function with normal SQL. It then sends raw prepared-statement protocol packets directly to the authenticated socket:

1. Raw `COM_STMT_PREPARE`
2. Raw `COM_STMT_EXECUTE` using `CLIENT_QUERY_ATTRIBUTES` semantics

I expected the server either to execute the prepared statement or to reject the supplied parameter data with a normal error response. Instead, the server aborted with an assertion failure.

The saved server error log starts with:

```text
mysqld: /home/fhb/mysql-server/sql/sql_prepare.cc:552: bool set_parameter_value(...): Assertion `len == 0 || len == 4 || len == 7 || len == 11 || len == 13' failed.
```

Backtrace excerpt:

```text
#10 set_parameter_value at /home/fhb/mysql-server/sql/sql_prepare.cc:552
#11 Prepared_statement::insert_parameters at /home/fhb/mysql-server/sql/sql_prepare.cc:714
#12 Prepared_statement::set_parameters at /home/fhb/mysql-server/sql/sql_prepare.cc:2806
#13 Prepared_statement::set_parameters at /home/fhb/mysql-server/sql/sql_prepare.cc:2796
#14 mysqld_stmt_execute at /home/fhb/mysql-server/sql/sql_prepare.cc:1900
```

How to repeat:
1. Start a debug/ASan MySQL server build.
2. Install Python dependencies:

   ```bash
   pip install pymysql mysql-connector-python
   ```

3. Run the attached reproducer against the test server:

   ```bash
   python3 bug_reproduce_2.py -h <host> -P <port> -u <user> -p <password> -d bug2_repro
   ```

4. The script creates the stored function, prepares the statement through a raw packet, and sends the raw `COM_STMT_EXECUTE` packet directly through the socket.

Observed output:

```text
Raw send packet_2_stmt39.bin: COM_STMT_EXECUTE payload_len=27
Connection lost while waiting for packet_2_stmt39.bin: server closed the connection
BUG CONFIRMED: server appears to be down
```