Bug #69682 mysqld crashes after uninstall of plugin with "first" status var
Submitted: 5 Jul 2013 22:12 Modified: 11 Jul 2013 16:58
Reporter: Guy Lichtman Email Updates:
Status: Verified Impact on me:
None 
Category:MySQL Server: Options Severity:S3 (Non-critical)
Version:5.6.12 OS:Any
Assigned to: CPU Architecture:Any

[5 Jul 2013 22:12] Guy Lichtman
Description:
If you uninstall a plugin which has a status var which is first in the status var lists and then issues a "show status" statement mysqld will crash.

I reproduced this with a simple plugin (attached) which all that does is register a status var named: AASTAT_example. After uninstall the plugin and issuing a "show status" command mysqld will crash:

mysql> install plugin aastat_example soname 'libaastat_example.so';
Query OK, 0 rows affected (0.02 sec)

mysql> show status like 'AA%';
+----------------+-------+
| Variable_name  | Value |
+----------------+-------+
| AASTAT_example | demo  |
+----------------+-------+
1 row in set (0.00 sec)

mysql> uninstall plugin aastat_example;
Query OK, 0 rows affected (0.00 sec)

mysql> show status like 'AA%';
ERROR 2013 (HY000): Lost connection to MySQL server during query

How to repeat:
Compile the attached plugin (aastat_example) by adding to the mysql source tree under the "plugin" dir. 

Install the plugin then do an uninstall of the plugin.

Then run the command: "show status;".

mysqld will crash.

Suggested fix:
From looking at the source code of sql_show.cc and the function: remove_status_vars it looks like the problem is with the for loop:

for (a= 0, b= all_status_vars.elements; b-a > 1; c= (a+b)/2)

From what I can see "b-a > 1" should be "b-a > 0" 

Additionally, it seems there is need to add an assignment to "c" either before the for loop or as part of the for initialization clause.
[5 Jul 2013 22:16] Guy Lichtman
plugin example which will cause a crash after uninstall and "show status"

Attachment: aastat_example.tar.gz (application/x-gzip, text), 1.64 KiB.

[11 Jul 2013 16:58] MySQL Verification Team
Hello Guy,

Thank you for the bug report. 
Verified as described.

Thanks,
Umesh