Date: 2020-06-11 09:43:34 +0200
From: @PedroTadim
To: SQL devs <>
Version: 11.37.7 (Jun2020)

Last updated: 2020-07-27 09:30:11 +0200

Comment 27820

Date: 2020-06-11 09:43:34 +0200
From: @PedroTadim

User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36
Build Identifier:

Run the query below for a double free error

Reproducible: Always

Steps to Reproduce:

1. SELECT "sys"."replace"(cast(cast(0.8009925043335998 as clob) as clob(169)),cast("sys"."replace"('!','','wtkg춑5,I}楘') as clob),"sys"."concat"("sys"."concat"('?dMHr펔2!FU4Rᔎ%',-1194732688),0.7566860950241294));

Actual Results:

A double-free error.

Expected Results:

Something besides a double-free error.

Comment 27821

Date: 2020-06-11 10:28:54 +0200
From: MonetDB Mercurial Repository <>

Changeset 1dcaa2b1e5cb made by Pedro Ferreira pedro.ferreira@monetdbsolutions.com in the MonetDB repo, refers to this bug.

For complete details, see https//devmonetdborg/hg/MonetDB?cmd=changeset;node=1dcaa2b1e5cb

Changeset description:

Fix for bug #6887, handle NULL and empty strings properly at replace(string) function