Uploaded image for project: 'MariaDB ColumnStore'
  1. MariaDB ColumnStore
  2. MCOL-5438

Math over widedecimal that includes count() causes SEGV

Details

    • 2023-4, 2023-5

    Description

      Plz see my last comment int MCOL-5310 to get the idea of what happens.
      dataconvert::strtoll128 gets count() as a widedecimal column and its precision is 9999. The precision is used as an index in an array of 38 elements thus it is either out-of-bounds access and SEGV is called or a unexpected math result.

      Attachments

        Issue Links

          Activity

            drrtuy Roman added a comment -

            Here is a call stack for SEGV I had seen in the wild.

            #0  0x00007f037515406c in dataconvert::strtoll128 (data=0x401f0f00000156 <error: Cannot access memory at address 0x401f0f00000156>, saturate=@0x7efa208024d0: false, ep=ep@entry=0x7efa208024d8) at ./storage/columnstore/columnstore/utils/dataconvert/./dataconvert.h:1518
            1518	./storage/columnstore/columnstore/utils/dataconvert/./dataconvert.h: No such file or directory.
            [Current thread is 1 (Thread 0x7efa20803700 (LWP 1723826))]
            (gdb) bt
            #0  0x00007f037515406c in dataconvert::strtoll128 (data=0x401f0f00000156 <error: Cannot access memory at address 0x401f0f00000156>, saturate=@0x7efa208024d0: false, ep=ep@entry=0x7efa208024d8)
                at ./storage/columnstore/columnstore/utils/dataconvert/./dataconvert.h:1518
            #1  0x00007f037515a0cc in dataconvert::number_int_value<__int128> (data=“1”, typeCode=typeCode@entry=datatypes::SystemCatalog::DECIMAL, ct=...,
                pushwarning=pushwarning@entry=@0x7efa2080260f: false, noRoundup=noRoundup@entry=false, intVal=@0x7efa20802610: 1, saturate=0x0) at /usr/include/c++/9/bits/basic_string.h:2300
            #2  0x00007f0374fc9c77 in datatypes::SystemCatalog::TypeAttributesStd::decimal128FromString (this=this@entry=0x7efa20802650, value=“1", saturate=saturate@entry=0x0)
                at ./storage/columnstore/columnstore/datatypes/mcs_datatype.cpp:64
            #3  0x00007f03754abc45 in rowgroup::RowAggregationUM::doNotNullConstantAggregate (this=0x7efa601537f0, aggData=..., i=2)
                at ./storage/columnstore/columnstore/utils/rowgroup/rowaggregation.cpp:3670
            #4  0x00007f037549f0de in rowgroup::RowAggregationUM::fixConstantAggregate (this=0x7efa601537f0) at ./storage/columnstore/columnstore/utils/rowgroup/rowaggregation.cpp:3286
            #5  0x00007f03754a983d in rowgroup::RowAggregationUM::finalize (this=0x7efa601537f0) at ./storage/columnstore/columnstore/utils/rowgroup/rowaggregation.cpp:2461
            #6  0x00007f0375d3fc37 in joblist::TupleAggregateStep::doThreadedAggregate (this=0x7efa60149400, bs=..., dlp=0x7efa6014bf20)
                at ./builddir/storage/columnstore/columnstore/.boost/boost-lib/include/boost/smart_ptr/shared_ptr.hpp:784
            #7  0x00007f0375d404b7 in joblist::TupleAggregateStep::doAggregate (this=0x7efa60149400) at ./storage/columnstore/columnstore/dbcon/joblist/tupleaggregatestep.cpp:5658
            #8  0x00007f0374b051cf in boost::function0<void>::operator() (this=0x7efb28002b98) at ./builddir/storage/columnstore/columnstore/.boost/boost-lib/include/boost/function/function_template.hpp:677
            #9  threadpool::ThreadPool::beginThread (this=0x55ea39dc00c0 <joblist::JobStep::jobstepThreadPool>) at ./storage/columnstore/columnstore/utils/threadpool/threadpool.cpp:382
            #10 0x000055ea39c5942b in thread_proxy ()
            #11 0x00007f0374b7a609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #12 0x00007f0374665133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            

            drrtuy Roman added a comment - Here is a call stack for SEGV I had seen in the wild. #0 0x00007f037515406c in dataconvert::strtoll128 (data=0x401f0f00000156 <error: Cannot access memory at address 0x401f0f00000156>, saturate=@0x7efa208024d0: false, ep=ep@entry=0x7efa208024d8) at ./storage/columnstore/columnstore/utils/dataconvert/./dataconvert.h:1518 1518 ./storage/columnstore/columnstore/utils/dataconvert/./dataconvert.h: No such file or directory. [Current thread is 1 (Thread 0x7efa20803700 (LWP 1723826))] (gdb) bt #0 0x00007f037515406c in dataconvert::strtoll128 (data=0x401f0f00000156 <error: Cannot access memory at address 0x401f0f00000156>, saturate=@0x7efa208024d0: false, ep=ep@entry=0x7efa208024d8) at ./storage/columnstore/columnstore/utils/dataconvert/./dataconvert.h:1518 #1 0x00007f037515a0cc in dataconvert::number_int_value<__int128> (data=“1”, typeCode=typeCode@entry=datatypes::SystemCatalog::DECIMAL, ct=..., pushwarning=pushwarning@entry=@0x7efa2080260f: false, noRoundup=noRoundup@entry=false, intVal=@0x7efa20802610: 1, saturate=0x0) at /usr/include/c++/9/bits/basic_string.h:2300 #2 0x00007f0374fc9c77 in datatypes::SystemCatalog::TypeAttributesStd::decimal128FromString (this=this@entry=0x7efa20802650, value=“1", saturate=saturate@entry=0x0) at ./storage/columnstore/columnstore/datatypes/mcs_datatype.cpp:64 #3 0x00007f03754abc45 in rowgroup::RowAggregationUM::doNotNullConstantAggregate (this=0x7efa601537f0, aggData=..., i=2) at ./storage/columnstore/columnstore/utils/rowgroup/rowaggregation.cpp:3670 #4 0x00007f037549f0de in rowgroup::RowAggregationUM::fixConstantAggregate (this=0x7efa601537f0) at ./storage/columnstore/columnstore/utils/rowgroup/rowaggregation.cpp:3286 #5 0x00007f03754a983d in rowgroup::RowAggregationUM::finalize (this=0x7efa601537f0) at ./storage/columnstore/columnstore/utils/rowgroup/rowaggregation.cpp:2461 #6 0x00007f0375d3fc37 in joblist::TupleAggregateStep::doThreadedAggregate (this=0x7efa60149400, bs=..., dlp=0x7efa6014bf20) at ./builddir/storage/columnstore/columnstore/.boost/boost-lib/include/boost/smart_ptr/shared_ptr.hpp:784 #7 0x00007f0375d404b7 in joblist::TupleAggregateStep::doAggregate (this=0x7efa60149400) at ./storage/columnstore/columnstore/dbcon/joblist/tupleaggregatestep.cpp:5658 #8 0x00007f0374b051cf in boost::function0<void>::operator() (this=0x7efb28002b98) at ./builddir/storage/columnstore/columnstore/.boost/boost-lib/include/boost/function/function_template.hpp:677 #9 threadpool::ThreadPool::beginThread (this=0x55ea39dc00c0 <joblist::JobStep::jobstepThreadPool>) at ./storage/columnstore/columnstore/utils/threadpool/threadpool.cpp:382 #10 0x000055ea39c5942b in thread_proxy () #11 0x00007f0374b7a609 in start_thread (arg=<optimized out>) at pthread_create.c:477 #12 0x00007f0374665133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            drrtuy Roman added a comment -

            Here is the repro case;

            create table cs1(d decimal(38))engine=columnstore;
            insert into cs1 values (42);
            select count(CASE WHEN 3 IN(42,4) THEN 1 ELSE 0 END) * 100/SUM(1) from cs1;
            

            drrtuy Roman added a comment - Here is the repro case; create table cs1(d decimal(38))engine=columnstore; insert into cs1 values (42); select count(CASE WHEN 3 IN(42,4) THEN 1 ELSE 0 END) * 100/SUM(1) from cs1;
            drrtuy Roman added a comment - - edited

            Plz take a look.

            drrtuy Roman added a comment - - edited Plz take a look.

            Build verified: 23.02.2 (Jenkins RC)

            Verified test case. No crash and result match of InnoDB

            MariaDB [mytest]> create table cs1(d decimal(38))engine=columnstore;
            Query OK, 0 rows affected (0.316 sec)
             
            MariaDB [mytest]> insert into cs1 values (42);
            Query OK, 1 row affected (0.237 sec)
             
            MariaDB [mytest]> select count(CASE WHEN 3 IN(42,4) THEN 1 ELSE 0 END) * 100/SUM(1) from cs1;
            +------------------------------------------------------------+
            | count(CASE WHEN 3 IN(42,4) THEN 1 ELSE 0 END) * 100/SUM(1) |
            +------------------------------------------------------------+
            |                                                   100.0000 |
            +------------------------------------------------------------+
            1 row in set (0.085 sec)
            

            dleeyh Daniel Lee (Inactive) added a comment - Build verified: 23.02.2 (Jenkins RC) Verified test case. No crash and result match of InnoDB MariaDB [mytest]> create table cs1(d decimal(38))engine=columnstore; Query OK, 0 rows affected (0.316 sec)   MariaDB [mytest]> insert into cs1 values (42); Query OK, 1 row affected (0.237 sec)   MariaDB [mytest]> select count(CASE WHEN 3 IN(42,4) THEN 1 ELSE 0 END) * 100/SUM(1) from cs1; +------------------------------------------------------------+ | count(CASE WHEN 3 IN(42,4) THEN 1 ELSE 0 END) * 100/SUM(1) | +------------------------------------------------------------+ | 100.0000 | +------------------------------------------------------------+ 1 row in set (0.085 sec)

            People

              drrtuy Roman
              drrtuy Roman
              Denis Khalikov Denis Khalikov (Inactive)
              Kirill Perov Kirill Perov (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.