MySQL Bugs: #35558: Wrong server metadata blows up the client

Bug #35558	Wrong server metadata blows up the client
Submitted:	25 Mar 2008 19:06	Modified:	21 Jan 2009 16:15
Reporter:	Andrey Hristov	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Data Types	Severity:	S2 (Serious)
Version:	5.0.67, 5.1.28	OS:	Any
Assigned to:	Sergei Glukhov	CPU Architecture:	Any

Description:
The server sends wrong metadata for the result of a call to the FORMAT function which leads to client memory blowup if libmysql is used when prepared statements are used. The problem however is not strictly PS it just manifests in this context.
Whatever number is passed to FORMAT it cannot end up having string representation 1431655771 digits in length. I reproduce it with 5.1, probably affects 5.0 and 6.0 too. There is a PHP bug report because of this issue (http://bugs.php.net/bug.php?id=42378  bind_result memory exhaustion)  
See the example:

How to repeat:
andrey@whirlpool:~/dev/vanilla/php5_3> mysql --column-type-info
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 10542
Server version: 5.1.24-rc-debug Source distribution

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> use test;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> create table format_test(a float);
Query OK, 0 rows affected (0.00 sec)

mysql> insert into format_test values (1.33);
Query OK, 1 row affected (0.00 sec)

mysql> select format(a, 2) from format_test;
Field   1:  `format(a, 2)`
Catalog:    `def`
Database:   ``
Table:      ``
Org_table:  ``
Type:       LONG_BLOB
Collation:  latin1_swedish_ci (8)
Length:     1431655771  <---------------------- 1.4GB for a column??
Max_length: 4
Decimals:   31
Flags:

+--------------+
| format(a, 2) |
+--------------+
| 1.33         |
+--------------+
1 row in set (0.00 sec)

Thank you for a problem report. I need some more details (character sets used etc), as I can not repeat this on 5.1.23 on Windows:

C:\Program Files\MySQL\MySQL Server 5.0\bin>mysql -uroot -proot -P3310 -T test
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 5
Server version: 5.1.23-rc-community-debug MySQL Community Server - Debug (GPL)

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> create table format_test(a float);
Query OK, 0 rows affected (0.17 sec)

mysql> insert into format_test values (1.33);
Query OK, 1 row affected (0.03 sec)

mysql> select format(a, 2) from format_test;
Field   1:  `format(a, 2)`
Catalog:    `def`
Database:   ``
Table:      ``
Org_table:  ``
Type:       VAR_STRING
Collation:  utf8_general_ci (33)
Length:     15
Max_length: 4
Decimals:   31
Flags:

+--------------+
| format(a, 2) |
+--------------+
| 1.33         |
+--------------+
1 row in set (0.06 sec)

So, it can be a recent regression.

No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".

I have the exact same issues with MySQL Server 5.0.67 and 5.0.45 on Windows.  

The character set is latin1.
DB Engine is InnoDB.
If there are any other details you need I can provide them.

C:\Program Files\MySQL\MySQL Server 5.0\bin>mysql --user=root --password  --debu
g-info
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 16
Server version: 5.0.67-community-nt MySQL Community Edition (GPL)

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> use test
Database changed
mysql> create table format_test(a float);
Query OK, 0 rows affected (0.14 sec)

mysql> insert into format_test values (1.33);
Query OK, 1 row affected (0.08 sec)

mysql> select format(a, 2) from format_test;
Field   1:  `format(a, 2)`
Catalog:    `def`
Database:   ``
Table:      ``
Org_table:  ``
Type:       VAR_STRING
Collation:  latin1_swedish_ci (8)
Length:     1431655771
Max_length: 4
Decimals:   2
Flags:

+--------------+
| format(a, 2) |
+--------------+
| 1.33         |
+--------------+
1 row in set (0.00 sec)

mysql>

Verified just as described with 5.0.66a and 5.1.28 on Windows:

C:\Program Files\MySQL\MySQL Server 5.0\bin>mysql -uroot -proot -P3308 -T test
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 16
Server version: 5.0.66a-enterprise-gpl-nt MySQL Enterprise Server (GPL)

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> set names latin1;
Query OK, 0 rows affected (0.03 sec)

mysql> create table format_test(a float);
Query OK, 0 rows affected (0.14 sec)

mysql>  insert into format_test values (1.33);
Query OK, 1 row affected (0.05 sec)

mysql> select format(a, 2) from format_test;
Field   1:  `format(a, 2)`
Catalog:    `def`
Database:   ``
Table:      ``
Org_table:  ``
Type:       VAR_STRING
Collation:  latin1_swedish_ci (8)
Length:     1431655771
Max_length: 4
Decimals:   2
Flags:

+--------------+
| format(a, 2) |
+--------------+
| 1.33         |
+--------------+
1 row in set (0.00 sec)

mysql> show variables like 'char%';
Field   1:  `Variable_name`
Catalog:    `def`
Database:   ``
Table:      `VARIABLES`
Org_table:  ``
Type:       VAR_STRING
Collation:  latin1_swedish_ci (8)
Length:     80
Max_length: 24
Decimals:   0
Flags:      NOT_NULL

Field   2:  `Value`
Catalog:    `def`
Database:   ``
Table:      `VARIABLES`
Org_table:  ``
Type:       VAR_STRING
Collation:  latin1_swedish_ci (8)
Length:     512
Max_length: 55
Decimals:   0
Flags:      NOT_NULL

+--------------------------+----------------------------------------------------
-----+
| Variable_name            | Value
     |
+--------------------------+----------------------------------------------------
-----+
| character_set_client     | latin1
     |
| character_set_connection | latin1
     |
| character_set_database   | utf8
     |
| character_set_filesystem | binary
     |
| character_set_results    | latin1
     |
| character_set_server     | utf8
     |
| character_set_system     | utf8
     |
| character_sets_dir       | C:\Program Files\MySQL\MySQL Server 5.0\share\chars
ets\ |
+--------------------------+----------------------------------------------------
-----+
8 rows in set (0.00 sec)

So, it depends on latin1, really.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/60731

2732 Sergey Glukhov	2008-12-05
      bug#35558 Wrong server metadata blows up the client
      the problem: FORMAT func max_length value was calculated incorrectly
      the fix: correct calculation of max_length

http://lists.mysql.com/commits/60731 is ok to push.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/61021

2738 Sergey Glukhov	2008-12-09
      bug#35558 Wrong server metadata blows up the client
      the problem: FORMAT func max_length value was calculated incorrectly
      the fix: correct calculation of max_length

Pushed into 5.0.76 (revid:joro@sun.com-20090105160414-8q9j4bi1klkfwiup) (version source revid:azundris@mysql.com-20081230114734-nmsc37ak330zlygn) (merge vers: 5.0.76) (pib:6)

Noted in 5.0.76 changelog.

The max_length metadata value was calculated incorrectly for the
FORMAT() function, which could cause incorrect result set metadata to
be sent to clients.

Setting report to NDI pending push into 5.1.x/6.0.x.

Pushed into 5.1.31 (revid:joro@sun.com-20090115053147-tx1oapthnzgvs1ro) (version source revid:azundris@mysql.com-20081230114838-cn52tu180wcrvh0h) (merge vers: 5.1.31) (pib:6)

Noted in 5.1.31 changelog.

Setting report to NDI pending push into 6.0.x.

Pushed into 5.1.31-ndb-6.2.17 (revid:tomas.ulin@sun.com-20090119095303-uwwvxiibtr38djii) (version source revid:tomas.ulin@sun.com-20090115073240-1wanl85vlvw2she1) (merge vers: 5.1.31-ndb-6.2.17) (pib:6)

Pushed into 5.1.31-ndb-6.3.21 (revid:tomas.ulin@sun.com-20090119104956-guxz190n2kh31fxl) (version source revid:tomas.ulin@sun.com-20090119104956-guxz190n2kh31fxl) (merge vers: 5.1.31-ndb-6.3.21) (pib:6)

Setting status back to NDI pending merge to 6.0 tree.

Pushed into 5.1.31-ndb-6.4.1 (revid:tomas.ulin@sun.com-20090119144033-4aylstx5czzz88i5) (version source revid:tomas.ulin@sun.com-20090119144033-4aylstx5czzz88i5) (merge vers: 5.1.31-ndb-6.4.1) (pib:6)

Pushed into 6.0.10-alpha (revid:joro@sun.com-20090119171328-2hemf2ndc1dxl0et) (version source revid:azundris@mysql.com-20081230114916-c290n83z25wkt6e4) (merge vers: 6.0.9-alpha) (pib:6)

Noted in 6.0.10 changelog.