Bug #553 group_concat crashes with empty result set
Submitted: 31 May 2003 3:53 Modified: 18 Aug 2003 12:58
Reporter: Pieter Ennes Email Updates:
Status: Closed Impact on me:
Category:MySQL Server Severity:S3 (Non-critical)
Version:4.1 OS:Linux (Linux GNU/Debian Kernel 2.4.20)
Assigned to: Bugs System CPU Architecture:Any

[31 May 2003 3:53] Pieter Ennes
Using the new group_concat function with something that doesn't return rows results in a server crash.

How to repeat:
Executing the following query will probably crash the server:

create table test (name	varchar(16));
select group_concat(name) from test;

Suggested fix:
[31 May 2003 10:04] Alexander Keremidarski
The problem is that in item_sum.cc:1591

bool Item_func_group_concat::add()

At this point tmp_table_param->copy_field is 0x0 which causes crash later.

(gdb) bt 
#0  0x08184d37 in copy_fields(TMP_TABLE_PARAM*) (param=0x8b13e88) at sql_select.cc:7687
#1  0x080e71c9 in Item_func_group_concat::add() (this=0x8b13220) at item_sum.cc:1591
#2  0x080e71ab in Item_func_group_concat::reset() (this=0x8b13220) at item_sum.cc:1585
#3  0x080e82d0 in Item_sum::no_rows_in_result() (this=0x8b13e88) at item_sum.h:79
#4  0x0817bb76 in return_zero_rows (join=0x8b13e88, result=0x8b13468, tables=0x8b13410, fields=@0x8b0872c, send_row=true, select_options=0, info=0x8b13e88 "
#5  0x08174d43 in JOIN::exec() (this=0x8b13478) at sql_select.cc:953
#6  0x081763a8 in mysql_select(THD*, Item***, st_table_list*, unsigned, List<Item>&, Item*, unsigned, st_order*, st_order*, Item*, st_order*, unsigned long, select_result*, st_select_lex_unit*, st_select_lex*, bool) (thd=0x8b08310, rref_pointer_array=0x8b13e88, tables=0x8b13e88, wild_num=145833608, fields=@0x8b13e88, conds=0x8b13e88, og_num=145833608, order=0x8b13e88, group=0x8b13e88, having=0x8b13e88, proc_param=0x8b13e88, select_options=17339392, result=0x8b13468, unit=0x8b08594, select_lex=0x8b08690, tables_and_fields_initied=false) at sql_select.cc:1387
#7  0x08172bb0 in handle_select(THD*, st_lex*, select_result*) (thd=0x8b08310, lex=0x8b08588, result=0x8b13468) at sql_select.cc:174
#8  0x08151cb6 in mysql_execute_command(THD*) (thd=0x8b08310) at sql_parse.cc:2026
#9  0x08155fcb in mysql_parse(THD*, char*, unsigned) (thd=0x8b08310, inBuf=0x8b13160 "select group_concat(t) from t", length=145786248) at sql_parse.cc:3563
#10 0x0814fdc4 in dispatch_command(enum_server_command, THD*, char*, unsigned) (command=COM_QUERY, thd=0x8b08310, packet=0x8b09b81 "", packet_length=30) at sql_parse.cc:1284
#11 0x0814f644 in do_command(THD*) (thd=0x8b08310) at sql_parse.cc:1084
#12 0x0814eb67 in handle_one_connection (arg=0x8b13e88) at sql_parse.cc:873
#13 0x40047332 in start_thread () from /lib/tls/libpthread.so.0
[25 Jun 2003 3:16] Pieter Ennes
BTW. A workaround is to add a group by clause, like

group by
[26 Jun 2003 10:57] Vasily Kishkin
Thank you for this bug report. To properly diagnose the problem, we
need a backtrace to see what is happening behind the scenes. To
find out how to generate a backtrace, please read

Once you have generated a backtrace, please submit it to this bug
report and change the status back to 'Open'. Thank you for helping
us make our products better.
[27 Jun 2003 1:12] Lenz Grimmer
I change the status of this bug from "Closed" to "Need Feedack", as it's not
closed yet.
[27 Jun 2003 2:01] Pieter Ennes
Changed to non-critical, because there is a workaround...
[27 Jun 2003 2:02] Pieter Ennes
About the backtrace, i can try to provide it, but didn't Alexander already reproduce it including the trace?
[27 Jun 2003 2:33] Sergei Golubchik
no there is no need for backtrace.
thank you
[18 Aug 2003 12:58] Vasily Kishkin
Thank you for your bug report. This issue has been committed to our
source repository of that product and will be incorporated into the
next release.

If necessary, you can access the source repository and build the latest
available version, including the bugfix, yourself. More information 
about accessing the source trees is available at