MySQL Bugs: #18383: MySQL server segfault when creating view with empty column names on amd64

Bug #18383	MySQL server segfault when creating view with empty column names on amd64
Submitted:	21 Mar 2006 8:10	Modified:	18 Apr 2006 8:54
Reporter:	Bernd Wurst	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server	Severity:	S2 (Serious)
Version:	5.0.19-log	OS:	Linux (gentoo linux (kernel 2.6))
Assigned to:	Evgeny Potemkin	CPU Architecture:	Any

Description:
I use mysql as backend for mailserver authentication and therefore I need so give the columns in the right order. The query contains some columns that always should be empty. So I use a statement like this:
 SELECT a, b, '', '', c FROM foo;
That works like expected.

Now, I put this in a view and mysql internally converts this to something like that:
 CREATE VIEW bar AS SELECT a, b, '' AS ``, '' AS `My_exp_1`, c FROM foo;

So there is one column left with an empty name.
In case of creating a table, this leads to a SQL error, as a VIEW, this is accepted on another mysql server (32bit) around.

On a 64bit machine, this leads to a segfault in the server:

mysql> CREATE VIEW foo AS SELECT '' AS ``;
ERROR 2013 (HY000): Lost connection to MySQL server during query

So at the moment, an ordinary user that has the right to create views may crash our server. :-(

How to repeat:
execute 
 CREATE VIEW foo AS SELECT '' AS ``;
on a mysql server running on amd64.

(gdb) bt
#0  0x0000003243b09657 in pthread_kill () from /lib64/tls/libpthread.so.0
#1  0x000000000073a46c in write_core (sig=11) at stacktrace.c:220
#2  0x00000000005cffc9 in handle_segfault (sig=11) at mysqld.cc:2083
#3  <signal handler called>
#4  0x0000000000525c80 in get_hash_symbol (s=0x1779100 "", len=0, function=false) at lex_hash.h:6534
#5  0x0000000000525e6c in is_keyword (name=0x1779100 "", len=0) at sql_lex.cc:236
#6  0x00000000007021b9 in get_quote_char_for_identifier (thd=0x176ca78, name=0x1779100 "", length=0)
    at sql_show.cc:716
#7  0x0000000000702081 in append_identifier (thd=0x176ca78, packet=0x450c8070, name=0x1779100 "", length=0)
    at sql_show.cc:656
#8  0x000000000052e1af in Item::print_item_w_name (this=0x1779040, str=0x450c8070) at item.cc:370
#9  0x000000000064becf in st_select_lex::print (this=0x176cea0, thd=0x176ca78, str=0x450c8070)
    at sql_select.cc:14350
#10 0x0000000000529075 in st_select_lex_unit::print (this=0x176caf8, str=0x450c8070) at sql_lex.cc:1547
#11 0x000000000073da76 in mysql_register_view (thd=0x176ca78, view=0x1778d88, mode=VIEW_CREATE_NEW)
    at sql_view.cc:580
#12 0x000000000073d886 in mysql_create_view (thd=0x176ca78, mode=VIEW_CREATE_NEW) at sql_view.cc:471
#13 0x00000000005ef7f2 in mysql_execute_command (thd=0x176ca78) at sql_parse.cc:4582
#14 0x00000000005f2143 in mysql_parse (thd=0x176ca78, inBuf=0x1778c78 "CREATE VIEW foo AS SELECT '' AS ``",
    length=34) at sql_parse.cc:5612
#15 0x00000000005e7c7f in dispatch_command (command=COM_QUERY, thd=0x176ca78,
    packet=0x1770be9 "CREATE VIEW foo AS SELECT '' AS ``", packet_length=35) at sql_parse.cc:1719
#16 0x00000000005e73d3 in do_command (thd=0x176ca78) at sql_parse.cc:1515
#17 0x00000000005e64fa in handle_one_connection (arg=0x176ca78) at sql_parse.cc:1158
#18 0x0000003243b060aa in start_thread () from /lib64/tls/libpthread.so.0
#19 0x00000032432c5b43 in clone () from /lib64/tls/libc.so.6
#20 0x0000000000000000 in ?? ()

mysql> show tables;
Empty set (0.00 sec)

mysql> create table t1(f1 int);
Query OK, 0 rows affected (0.02 sec)

mysql> create view v1 as select f1, '', '' as '123' from t1;
Query OK, 0 rows affected (0.00 sec)

mysql> create view v2 as select '' as ``;
Query OK, 0 rows affected (0.01 sec)

mysql> select * from v1;
Empty set (0.00 sec)

mysql> select * from v2;
+--+
|  |
+--+
|  |
+--+
1 row in set (0.00 sec)

mysql> select version();
+--------------+
| version()    |
+--------------+
| 5.0.21-debug |
+--------------+
1 row in set (0.00 sec)

mysql> \q
Bye

Tested on Red Hat Enterprise Linux AS 4.0 x86_64 gcc 3.4.4
build script BUILD/compile-amd64-debug-max

mysql> show tables;
ERROR 1046 (3D000): No database selected
mysql> create database foo;
Query OK, 1 row affected (0.11 sec)

mysql> use foo;
Database changed
mysql> show tables;
Empty set (0.00 sec)

mysql> create table t1(f1 int);
Query OK, 0 rows affected (0.02 sec)

mysql> create view v1 as select f1, '', '' as '123' from t1;
ERROR 2013 (HY000): Lost connection to MySQL server during query
mysql> create view v2 as select '' as ``;
ERROR 2006 (HY000): MySQL server has gone away
No connection. Trying to reconnect...
ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (111)
ERROR:
Can't connect to the server

mysql> select * from v1;
No connection. Trying to reconnect...
ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (111)
ERROR:
Can't connect to the server

mysql> quit

Can reproduce this.

Can you clarify: what is the OS/platform, compiler version, with what options the mysqld was built, what is the mysqld version?

reporter's system:

mysql> select version();
+------------+
| version()  |
+------------+
| 5.0.19-log |
+------------+

running on (current) gentoo linux.

Excerpt from `emerge info`:
System uname: 2.6.14.7-grsec x86_64 AMD Athlon(tm) 64 Processor 3500+
Gentoo Base System version 1.6.14
ccache version 2.3 [enabled]
dev-lang/python:     2.4.2
sys-apps/sandbox:    1.2.12
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -march=athlon64 -fstack-protector -pipe"
CXXFLAGS="-O2 -march=athlon64 -fstack-protector -pipe"
CHOST="x86_64-pc-linux-gnu"

sorry, occasionaly set wrong status, wasn't my intention. :)
But now I cannot set it back! :-(

I tested it on version 5.0.21. It is possible that the bug was fixed somewhere between 5.0.19 and 5.0.21. Try the latest version of mysql.

mysqld --version
mysqld  Ver 5.0.19 for pc-linux-gnu on x86_64 (Gentoo Linux mysql-5.0.19)

configure-options:
./configure --prefix=/usr --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --libexecdir=/usr/sbin --sysconfdir=/etc/mysql --localstatedir=/var/lib/mysql --sharedstatedir=/usr/share/mysql --libdir=/usr/lib64/mysql$ --includedir=/usr/include/mysql --with-low-memory --enable-local-infile --with-mysqld-user=mysql --with-client-ldflags=-lstdc++ --enable-thread-safe-client --with-comment=Gentoo Linux mysql-5.0.19 --with-unix-socket-path=/var/run/mysqld/mysqld.sock --without-readline --without-docs --enable-shared --enable-static --without-libwrap --with-openssl --without-debug --with-server --with-extra-tools --without-raid --with-innodb --with-extra-charsets=all --without-berkeley-db --with-geometry --without-ndbcluster --without-big-tables --without-embedded-privilege-control --without-embedded-server --with-bench --enable-assembler --build=x86_64-pc-linux-gnu

Distribution: Gentoo Linux

gcc --version
gcc (GCC) 3.4.4 (Gentoo 3.4.4-r1, ssp-3.4.4-1.0, pie-8.7.8)
Copyright (C) 2004 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

/lib/libc.so.6
GNU C Library stable release version 2.3.5, by Roland McGrath et al.
Copyright (C) 2005 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
Compiled by GNU CC version 3.4.4 (Gentoo 3.4.4-r1, ssp-3.4.4-1.0, pie-8.7.8).
Compiled on a Linux 2.6.11 system on 2006-03-23.

This bug seems to be fixed in 5.0.20.

Sorry for the delay, but Gentoo does not provide packages for 5.0.20, so I had to build one by myself.

I upgraded to 5.0.20 and the bug disappeared.