Bug #62064 Embedded group by query with CURSOR_TYPE_READ_ONLY crashes the server

• Submitted: 2 Aug 2011 22:41
• Modified: 3 Aug 2011 22:35
• Reporter: Vyacheslav Brover
• Status: Closed
• Category: MySQL Server: General
• Severity: S1 (Critical)
• Version: 5.5.11-log
• OS: Linux
• CPU Architecture: Any
• Tags: CURSOR_TYPE_READ_ONLY, GROUP BY, prepared statement

[2 Aug 2011 22:41] Vyacheslav Brover

Description:
An execution of prepared select-statement containing embedded "group by" and having the attribute CURSOR_TYPE_READ_ONLY causes the server to crash with the message "mysqld got signal 11" in the error log.

How to repeat:
Choose any appropriate values for HOST, USER, PASSWORD, SCHEMA, PORT.

Run these SQL statements on the server HOST at port PORT:

use SCHEMA;
create table TEST (Col int) engine='MyISAM';
insert into TEST (Col) values (1);
insert into TEST (Col) values (1);
insert into TEST (Col) values (2);
insert into TEST (Col) values (3);

Run the below C++ code. 
At mysql_stmt_execute(stmt) the server crashes with the message "mysqld got signal 11" in the error log.

#include <stdio.h>
#include <mysql.h>
int main (int argc, const char* argv[])
{
  #define CHECK(cond)  if (cond) { printf ("%s\n", mysql_error (& mysql)); return 1; }
  MYSQL mysql;
  memset (& mysql, 0, sizeof (mysql));
  MYSQL* m = mysql_real_connect (& mysql, HOST, USER, PASSWORD, SCHEMA, PORT, NULL, 0);
  if (! m) return;
  MYSQL_STMT* stmt = mysql_stmt_init (& mysql);
  CHECK (! stmt);
  int status;
  const unsigned long cursorType = (unsigned long) CURSOR_TYPE_READ_ONLY;
  status = mysql_stmt_attr_set (stmt, STMT_ATTR_CURSOR_TYPE, & cursorType);
  CHECK (status);
  const char* str = "select T.`C` from (select count(*) \"C\" from `TEST` group by `Col`) T";
  status = mysql_stmt_prepare (stmt, str, (unsigned long) strlen (str)); 
  CHECK (status);
  status = mysql_stmt_execute (stmt);  /* Error log: "mysqld got signal 11" */
  CHECK (status);
  mysql_stmt_close (stmt);  
  mysql_close (& mysql);
  return 0;
}

[3 Aug 2011 1:19] Vyacheslav Brover

C++ code

Attachment: bug62064.cpp (text/plain), 1014 bytes.

[3 Aug 2011 1:35] MySQL Verification Team

Could you please try with latest version 5.5.15. I couldn't repeat with today source server. If the crash continues on your side please provide the back trace. Thanks.

[3 Aug 2011 22:35] Vyacheslav Brover

Does not reproduce on version 5.5.15.