Bug #120570 Raw COM_STMT_PREPARE triggers List<Item_param>::end(): `(*last)->next == &end_of_list`
Submitted: 29 May 7:28
Reporter: Hongbo Feng Email Updates:
Status: Open Impact on me:
None 
Category:MySQL Server: Prepared statements Severity:S6 (Debug Builds)
Version:9.6.0-debug-asan OS:Ubuntu (22.04)
Assigned to: CPU Architecture:x86 (x86_64)
Tags: assertion, com-stmt-prepare, crash, metadata, prepared-statement, protocol

[29 May 7:28] Hongbo Feng
Description:
I found a server-side assertion failure while testing MySQL prepared statements through the classic MySQL protocol.

The reproducer creates the required schema with normal SQL. It then sends one raw `COM_STMT_PREPARE` packet directly to the authenticated socket. The prepared SQL is metadata-heavy and contains many parameter markers.

I expected the server either to prepare the statement or to reject it with a normal SQL/protocol error. Instead, the server aborted with an assertion failure.

The saved server error log starts with:

```text
mysqld: /home/fhb/mysql-server/sql/sql_list.h:614: List<T>::iterator List<T>::end() [with T = Item_param; List<T>::iterator = List_STL_Iterator<Item_param>]: Assertion `(*last)->next == &end_of_list' failed.
```

Backtrace excerpt:

```text
#10 List<Item_param>::end at /home/fhb/mysql-server/sql/sql_list.h:614
#11 send_statement at /home/fhb/mysql-server/sql/sql_prepare.cc:968
#12 Prepared_statement::prepare_query at /home/fhb/mysql-server/sql/sql_prepare.cc:1438
#13 Prepared_statement::prepare at /home/fhb/mysql-server/sql/sql_prepare.cc:2599
#14 mysqld_stmt_prepare at /home/fhb/mysql-server/sql/sql_prepare.cc:1550
```

How to repeat:
1. Start a debug/ASan MySQL server build.
2. Install Python dependencies:

   ```bash
   pip install pymysql mysql-connector-python
   ```

3. Run the attached reproducer against the test server:

   ```bash
   python3 bug_reproduce_5.py -h <host> -P <port> -u <user> -p <password> -d bug5_repro
   ```

4. The script runs the setup SQL and then sends one raw `COM_STMT_PREPARE` packet directly through the socket.

Observed output:

```text
Raw send packet_0_stmt656.bin: COM_STMT_PREPARE payload_len=4108
Connection lost while waiting for packet_0_stmt656.bin: server closed the connection
BUG CONFIRMED: server appears to be down
```