| Bug #60121 | MySQL server crashes when updating a VARCHAR field to contain the string "%s" | ||
|---|---|---|---|
| Submitted: | 14 Feb 2011 15:34 | Modified: | 15 Feb 2011 15:32 |
| Reporter: | Aaron Kennedy | Email Updates: | |
| Status: | Can't repeat | Impact on me: | |
| Category: | MySQL Server | Severity: | S3 (Non-critical) |
| Version: | 5.1.31 | OS: | Linux (Ubuntu 9.04) |
| Assigned to: | CPU Architecture: | Any | |
| Tags: | crash, trigger, UPDATE | ||
[14 Feb 2011 15:40]
MySQL Verification Team
Could you please try latest released version. I couldn't repeat with today source tree.
[14 Feb 2011 16:06]
Aaron Kennedy
Miguel, Did you try this in 5.5.x or 5.1.x?
[14 Feb 2011 16:10]
MySQL Verification Team
I tried with 5.1.56.
[14 Feb 2011 18:00]
Aaron Kennedy
I installed 5.1.55 from the TAR package and tried this again. This time the server does not crash but produces an error: ERROR 1436 (HY000): Thread stack overrun: 6464 bytes used of a 131072 byte stack, and 128000 bytes needed. Use 'mysqld -O thread_stack=#' to specify a bigger stack.
[14 Feb 2011 19:13]
Aaron Kennedy
I increased the thread stack to 256K and re-tested, and the bug is no longer present.
[15 Feb 2011 4:27]
Valeriy Kravchuk
So, can we assume there is no bug (just a need to increase stack size, as requested by server) with 5.1.55?
[15 Feb 2011 15:12]
Aaron Kennedy
Correct, as of 5.1.55 the "%s" crash no longer happens.
[15 Feb 2011 15:32]
Valeriy Kravchuk
Not repeatable with recent version, 5.1.55.
Description: The MySQL server crashes when: 1) A table has an AFTER UPDATE trigger containing/using the function "USER()" 2) Any VARCHAR column for a record in that table is updated to contain a percent sign ("%") followed by zero or more other characters followed by a letter "s". Ex: ("%s", "%1s", "%whatevers") What Happens: The update and trigger complete successfully but the whole MySQL server crashes and restarts afterward with no error message or anything written to the log. What I Wanted to Happen: The update and trigger complete successfully without the server crashing afterwards. The reason I marked this as a security vulnerability is that it could be used by a malicious party to make the server unavailable indefinitely using a simple update query. How to repeat: I am using innodb as the default storage engine, so you may have to use it to reproduce this error, but I'm not sure because I haven't tested this bug with MyISAM. 1) Open a mysql console and select any database. 2) CREATE TABLE test (a VARCHAR(255)) 3) DELIMITER $$ 4) CREATE TRIGGER test_trigger AFTER UPDATE ON `test` FOR EACH ROW BEGIN SET @whatever = USER(); END; $$ 5) INSERT INTO `test` VALUES ('example') 5) Update the record you just inserted to contain a percent sign ("%") followed by a letter "s". Ex: ("%s", "%1s", "%whatevers")