Bug #120568 Raw COM_STMT_EXECUTE triggers Prepared_statement::check_parameter_types(): `false`
Submitted: 29 May 7:22
Reporter: Hongbo Feng Email Updates:
Status: Open Impact on me:
None 
Category:MySQL Server: Prepared statements Severity:S6 (Debug Builds)
Version:9.6.0-debug-asan OS:Ubuntu (22.04)
Assigned to: CPU Architecture:x86 (x86_64)
Tags: assertion, binary-protocol, com-stmt-execute, crash, prepared-statement, protocol, query-attributes

[29 May 7:22] Hongbo Feng
Description:
I found a server-side assertion failure while testing MySQL prepared statements through the classic MySQL protocol.

The reproducer creates a minimized schema and views with normal SQL. It then sends raw prepared-statement protocol packets directly to the authenticated socket:

1. Raw `COM_STMT_PREPARE` for a minimized multi-table query
2. Raw `COM_STMT_EXECUTE` using `CLIENT_QUERY_ATTRIBUTES` semantics

I expected the server either to execute the prepared statement or to reject the supplied parameter data with a normal SQL/protocol error. Instead, the server aborted with an assertion failure.

The saved server error log starts with:

```text
mysqld: /home/fhb/mysql-server/sql/sql_prepare.cc:3016: bool Prepared_statement::check_parameter_types(): Assertion `false' failed.
```

Backtrace excerpt:

```text
#10 Prepared_statement::check_parameter_types at /home/fhb/mysql-server/sql/sql_prepare.cc:3016
#11 Prepared_statement::execute_loop at /home/fhb/mysql-server/sql/sql_prepare.cc:3137
#12 mysqld_stmt_execute at /home/fhb/mysql-server/sql/sql_prepare.cc:1902
#13 dispatch_command at /home/fhb/mysql-server/sql/sql_parse.cc:2032
```

How to repeat:
1. Start a debug/ASan MySQL server build.
2. Install Python dependencies:

   ```bash
   pip install pymysql mysql-connector-python
   ```

3. Run the attached reproducer against the test server:

   ```bash
   python3 bug_reproduce_3.py -h <host> -P <port> -u <user> -p <password> -d bug3_repro
   ```

4. The script runs the setup SQL, sends a raw `COM_STMT_PREPARE`, and then sends the raw `COM_STMT_EXECUTE` packet directly through the socket.

Observed output:

```text
Raw send packet_1_stmt668.bin: COM_STMT_EXECUTE payload_len=2880
Connection lost while waiting for packet_1_stmt668.bin: server closed the connection
Crash/assertion reproduced after raw COM_STMT_EXECUTE
```