Bug #121675 Prepared bitwise aggregates accept 512-byte binary parameters

Submitted: 5 Nov 8:02
Reporter: QiFan Liu Email Updates:
Status: Open Impact on me:
None 
Category:MySQL Server: Optimizer Severity:S3 (Non-critical)
Version:9.7.2 OS:Linux
Assigned to: CPU Architecture:x86
Tags: bit_and, bit_or, bit_xor, operand validation, prepared statements

[5 Nov 8:02] QiFan Liu
Description:
Prepared grouped BIT_AND(), BIT_OR(), and BIT_XOR(), as well as windowed BIT_XOR(), accept a 512-byte binary parameter and return a 512-byte result. The equivalent expressions with a statically known 512-byte operand are rejected with error 3514.

Decisive observation:
For each affected prepared statement, bindings of 511, 512, and 1 bytes returned these result lengths in order:

511
512
1

The corresponding static 512-byte expression failed with:

ERROR 3514 (HY000): Aggregate bitwise functions cannot accept arguments longer than 511 bytes; consider using the SUBSTRING() function

Semantic mismatch:
Binary operands to BIT_AND(), BIT_OR(), and BIT_XOR() may not exceed 511 bytes. That limit should apply regardless of whether the operand length is known when the statement is prepared or supplied when it is executed. The 511-byte and rebound 1-byte values should succeed, while the 512-byte execution should raise error 3514.

Impact:
Affected prepared statements bypass the documented operand-size limit and produce a result that the equivalent static expression rejects. No persistent database state is involved; deallocating the statement and clearing the bound variable is sufficient cleanup.

Tested versions:
MySQL 9.7.2, source revision 561753af986c3c006c4b6c7caa8359748fb55b22.

Environment and configuration:
Linux on amd64. No relevant non-default configuration was recorded.

Additional information:
This occurs when a grouped BIT_AND, BIT_OR, or BIT_XOR aggregate, or a windowed BIT_XOR aggregate, is prepared and executed with a 512-byte binary parameter.

How to repeat:
Save the following as reproducer.sql and run:

mysql --force < reproducer.sql

-- Grouped BIT_AND
PREPARE s FROM 'SELECT OCTET_LENGTH(BIT_AND(?)) AS result_length';
SET @arg = REPEAT(_binary 'x', 511);
EXECUTE s USING @arg;
SET @arg = REPEAT(_binary 'x', 512);
EXECUTE s USING @arg;
SET @arg = REPEAT(_binary 'x', 1);
EXECUTE s USING @arg;
DEALLOCATE PREPARE s;

SELECT OCTET_LENGTH(BIT_AND(REPEAT(_binary 'x', 512)));

-- Grouped BIT_OR
PREPARE s FROM 'SELECT OCTET_LENGTH(BIT_OR(?)) AS result_length';
SET @arg = REPEAT(_binary 'x', 511);
EXECUTE s USING @arg;
SET @arg = REPEAT(_binary 'x', 512);
EXECUTE s USING @arg;
SET @arg = REPEAT(_binary 'x', 1);
EXECUTE s USING @arg;
DEALLOCATE PREPARE s;

SELECT OCTET_LENGTH(BIT_OR(REPEAT(_binary 'x', 512)));

-- Grouped BIT_XOR
PREPARE s FROM 'SELECT OCTET_LENGTH(BIT_XOR(?)) AS result_length';
SET @arg = REPEAT(_binary 'x', 511);
EXECUTE s USING @arg;
SET @arg = REPEAT(_binary 'x', 512);
EXECUTE s USING @arg;
SET @arg = REPEAT(_binary 'x', 1);
EXECUTE s USING @arg;
DEALLOCATE PREPARE s;

SELECT OCTET_LENGTH(BIT_XOR(REPEAT(_binary 'x', 512)));

-- Windowed BIT_XOR
PREPARE s FROM 'SELECT OCTET_LENGTH(BIT_XOR(?) OVER ()) AS result_length';
SET @arg = REPEAT(_binary 'x', 511);
EXECUTE s USING @arg;
SET @arg = REPEAT(_binary 'x', 512);
EXECUTE s USING @arg;
SET @arg = REPEAT(_binary 'x', 1);
EXECUTE s USING @arg;
DEALLOCATE PREPARE s;
SET @arg = NULL;

SELECT OCTET_LENGTH(BIT_XOR(REPEAT(_binary 'x', 512)) OVER ());

Each prepared block returns result_length values 511, 512, and 1. Each static 512-byte control raises error 3514 instead. The --force option allows the client to proceed to the next block after each expected static-control error.

Suggested fix:
Apply the execution-time 511-byte operand-size validation consistently to grouped BIT_AND(), BIT_OR(), and BIT_XOR(), and to windowed BIT_XOR(), when the operand length is supplied through a parameter marker.

Portions of this website are copyright © 2001, 2002 The PHP Group

Page generated in 0.050 sec. using MySQL 8.4.7-u6-cloud

Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the respective copyright holders.
It is not reviewed in advance by Oracle and does not necessarily represent the opinion of Oracle or any other party.