Bug #24891 Server Crash on bad column name in SELECT with SQLEXCEPTION handler

• Submitted: 7 Dec 2006 16:21
• Modified: 7 Dec 2006 17:12
• Reporter: Arthur M.
• Status: Can't repeat
• Category: MySQL Server: Stored Routines
• Severity: S1 (Critical)
• Version: 5.0.27-community-nt
• OS: Windows (WinXP)
• CPU Architecture: Any
• Tags: clause, column, crash, field, invalid, SELECT, server

[7 Dec 2006 16:21] Arthur M.

Description:
The server will crash with memory read violation if an invalid column/field is a part of a select statement within stored procedure with SQLEXCEPTION handler defined.

If SQLEXCEPTION handler is removed, a proper error message will be displayed.

How to repeat:
 `crash_test`.CREATE DATABASE `crash_test` /*!40100 DEFAULT CHARACTER SET latin1 */;

DELIMITER $$

DROP PROCEDURE IF EXISTS `crash_test`.`crashme` $$
CREATE PROCEDURE `crash_test`.`crashme` ()
BEGIN
             declare exit handler for sqlexception
             begin
                  select "an exception has occured" as status;
             end;

             SELECT a FROM crashtbl;
END $$

DELIMITER ;

[7 Dec 2006 16:25] Arthur M.

forgotten table create statement:

DROP TABLE IF EXISTS `crash_test`.`crashtbl`;
CREATE TABLE  `crash_test`.`crashtbl` (
  `id` int(10) unsigned NOT NULL auto_increment,
  PRIMARY KEY  (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=latin1;

[7 Dec 2006 17:12] MySQL Verification Team

Thank you for the bug report. I was unable to repeat with the test case
provided:

mysql> call crashme();
+--------------------------+
| status                   |
+--------------------------+
| an exception has occured |
+--------------------------+
1 row in set (0.02 sec)

Query OK, 0 rows affected (0.02 sec)

mysql> select version();
+---------------------+
| version()           |
+---------------------+
| 5.0.27-community-nt |
+---------------------+
1 row in set (0.03 sec)

mysql>