Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-21166

Creating and running a mroonga function causes various crashes, UBSAN member call on null pointer, UBSAN access within null pointer

Details

    Description

      If mroonga is not installed, creating at least the mroonga_escape function and running it results in unexpected problems:

      In 10.1.37

      CREATE FUNCTION mroonga_escape RETURNS STRING SONAME 'ha_mroonga.so';
      Query OK, 0 rows affected (0.04 sec)
       
      select mroonga_escape('10');
      ERROR 2013 (HY000): Lost connection to MySQL server during query
       
      select mroonga_escape('10');
      ERROR 2006 (HY000): MySQL server has gone away
      No connection. Trying to reconnect...
      

      In 10.2.27:

      CREATE FUNCTION mroonga_escape RETURNS STRING SONAME 'ha_mroonga.so';
      Query OK, 0 rows affected (0.01 sec)
       
      SELECT mroonga_escape("+-<>~*()\"\:");
      ERROR 2013 (HY000): Lost connection to MySQL server during query
      

      In 10.3.20 and 10.4.10

      CREATE FUNCTION mroonga_escape RETURNS STRING   SONAME 'ha_mroonga.so';
      ERROR 1041 (HY000): Out of memory.
      

      Attachments

        Issue Links

          Activity

            kou Kouhei Sutou added a comment - Did you try it with https://github.com/MariaDB/server/pull/3329 ?

            Hi kou!

            I tested https://github.com/MariaDB/server/pull/3329 and in all instances/for all testcases above I now see:

            10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN)

            10.5.26-dbg>CREATE FUNCTION mroonga_normalize RETURNS STRING SONAME 'ha_mroonga.so';
            Query OK, 0 rows affected (0.044 sec)
             
            10.5.26-dbg>SELECT mroonga_normalize('a');
            ERROR 1123 (HY000): Can't initialize function 'mroonga_normalize'; mroonga_normalize(): Mroonga isn't initialized
            

            Which would look to be correct.

            And, when loading the plugin, operation also seems normal:

            10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN)

            10.5.26-dbg>INSTALL PLUGIN mroonga SONAME 'ha_mroonga';
            Query OK, 0 rows affected (0.077 sec)
             
            10.5.26-dbg>CREATE FUNCTION mroonga_command RETURNS STRING SONAME 'ha_mroonga.so';
            Query OK, 0 rows affected (0.003 sec)
             
            10.5.26-dbg>SELECT mroonga_command ('dump -- dump_plugins no -- dump_schema no');
            +---------------------------------------------------------------+
            | mroonga_command ('dump -- dump_plugins no -- dump_schema no') |
            +---------------------------------------------------------------+
            | NULL                                                          |
            +---------------------------------------------------------------+
            1 row in set (0.051 sec)
            

            And no UBSAN error was seen, nor any crash in a debug build.

            Perhaps of some interest are these outputs (after loading the plugin):

            10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN)

            10.5.26-dbg>SELECT mroonga_snippet ('',0,0,'',0,0,'','','','','');  # UBSAN, or
            ERROR 1123 (HY000): Can't initialize function 'mroonga_snippet'; Unknown charset: <>
            10.5.26-dbg>SELECT mroonga_snippet ('',0,0, 0,0,0,'','','','','');  # UBSAN + SIGSEGV
            ERROR 1123 (HY000): Can't initialize function 'mroonga_snippet'; Unknown charset ID: <0>
            

            10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN)

            10.5.26-dbg>CREATE FUNCTION mroonga_snippet_html RETURNS STRING SONAME 'ha_mroonga.so';
            Query OK, 0 rows affected (0.002 sec)
             
            10.5.26-dbg>SELECT mroonga_snippet_html('a','','');
            ERROR 1123 (HY000): Can't initialize function 'mroonga_snippet_html'; mroonga_snippet_html(): failed to add a condition to grn_snip: <>
            

            Though they are likely correct given the non-sensical input.

            Roel Roel Van de Paar added a comment - Hi kou ! I tested https://github.com/MariaDB/server/pull/3329 and in all instances/for all testcases above I now see: 10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN) 10.5.26-dbg>CREATE FUNCTION mroonga_normalize RETURNS STRING SONAME 'ha_mroonga.so'; Query OK, 0 rows affected (0.044 sec)   10.5.26-dbg>SELECT mroonga_normalize('a'); ERROR 1123 (HY000): Can't initialize function 'mroonga_normalize'; mroonga_normalize(): Mroonga isn't initialized Which would look to be correct. And, when loading the plugin, operation also seems normal: 10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN) 10.5.26-dbg>INSTALL PLUGIN mroonga SONAME 'ha_mroonga'; Query OK, 0 rows affected (0.077 sec)   10.5.26-dbg>CREATE FUNCTION mroonga_command RETURNS STRING SONAME 'ha_mroonga.so'; Query OK, 0 rows affected (0.003 sec)   10.5.26-dbg>SELECT mroonga_command ('dump -- dump_plugins no -- dump_schema no'); +---------------------------------------------------------------+ | mroonga_command ('dump -- dump_plugins no -- dump_schema no') | +---------------------------------------------------------------+ | NULL | +---------------------------------------------------------------+ 1 row in set (0.051 sec) And no UBSAN error was seen, nor any crash in a debug build. Perhaps of some interest are these outputs (after loading the plugin): 10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN) 10.5.26-dbg>SELECT mroonga_snippet ('',0,0,'',0,0,'','','','',''); # UBSAN, or ERROR 1123 (HY000): Can't initialize function 'mroonga_snippet'; Unknown charset: <> 10.5.26-dbg>SELECT mroonga_snippet ('',0,0, 0,0,0,'','','','',''); # UBSAN + SIGSEGV ERROR 1123 (HY000): Can't initialize function 'mroonga_snippet'; Unknown charset ID: <0> 10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN) 10.5.26-dbg>CREATE FUNCTION mroonga_snippet_html RETURNS STRING SONAME 'ha_mroonga.so'; Query OK, 0 rows affected (0.002 sec)   10.5.26-dbg>SELECT mroonga_snippet_html('a','',''); ERROR 1123 (HY000): Can't initialize function 'mroonga_snippet_html'; mroonga_snippet_html(): failed to add a condition to grn_snip: <> Though they are likely correct given the non-sensical input.
            kou Kouhei Sutou added a comment -

            Thanks for confirming the patch!

            > Perhaps of some interest are these outputs (after loading the plugin):

            How about opening a new issue for the former? (It seems that error handling may be incorrect.)

            The latter is an expected error.

            kou Kouhei Sutou added a comment - Thanks for confirming the patch! > Perhaps of some interest are these outputs (after loading the plugin): How about opening a new issue for the former? (It seems that error handling may be incorrect.) The latter is an expected error.

            TheLinuxJedi The patch has already proved itself in testing. As soon as your review is done, this can be pushed. Thank you!

            Roel Roel Van de Paar added a comment - TheLinuxJedi The patch has already proved itself in testing. As soon as your review is done, this can be pushed. Thank you!

            > How about opening a new issue for the former? (It seems that error handling may be incorrect.)
            Thank you for confirming! Created as: MDEV-34415 Mroonga: mroonga_snippet: Unknown charset ID: <0> / <>

            Roel Roel Van de Paar added a comment - > How about opening a new issue for the former? (It seems that error handling may be incorrect.) Thank you for confirming! Created as: MDEV-34415 Mroonga: mroonga_snippet: Unknown charset ID: <0> / <>

            People

              TheLinuxJedi Andrew Hutchings (Inactive)
              greenman Ian Gilfillan
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.