Description
Submitted by: @mrotteveel
I have found a reliable way to crash Firebird 2.5.x (and probably earlier versions as well, but I haven't tested this). I have only tested with Firebird SuperServer (x64), version 2.5.5, 2.5.7 and 2.5.8.27089 (snapshot of the 27th of December) on Windows (x64), but I assume other platforms may be affected as well.
The problem occurs when a table has been incorrectly 'renamed' by modifying the system tables, and then applying a select distinct *. I assume this either has to do with a lack of columns, or other missing metadata.
I am fully aware that this is improper use of the system tables, but this is quite an easy way to crash a server (denial of service). All you need is to be able to create a table, modify the system tables and then select from in it, in any database on the server.
Short reproduction:
```
create table stepone (
dummy integer
);
commit;
update rdb$relations set rdb$relation_name = 'CRASH' where rdb$relation_name = 'STEPONE';
commit;
select distinct * from crash;
```
The distinct is necessary, a `select * from crash` either is handled as a statement without result set (Jaybird, FlameRobin), or it crashes ISQL (which I'll be reporting separately).
Executing this from ISQL will crash both Firebird and ISQL (presumably the same problem as when using select *), executing this from FlameRobin will only crash Firebird.
I have a crash dump for 2.5.8.27089-0_x64 if you need it: https://www.dropbox.com/s/9qbp76tk2z5wg1u/fbserver.exe.11212.7z?dl=0 (+/- 20MB compressed)
====== Test Details ======
Reproduced on 2.5.8.27086, special (private) build, Linux.
Sent stack trace to dimitr, letter 16.01.2017 08:52.