Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-21166

Creating and running a mroonga function causes various crashes, UBSAN member call on null pointer, UBSAN access within null pointer

Details

    Description

      If mroonga is not installed, creating at least the mroonga_escape function and running it results in unexpected problems:

      In 10.1.37

      CREATE FUNCTION mroonga_escape RETURNS STRING SONAME 'ha_mroonga.so';
      		 
      Query OK, 0 rows affected (0.04 sec)
      		 
       
      		 
      select mroonga_escape('10');
      		 
      ERROR 2013 (HY000): Lost connection to MySQL server during query
      		 
       
      		 
      select mroonga_escape('10');
      		 
      ERROR 2006 (HY000): MySQL server has gone away
      		 
      No connection. Trying to reconnect...

      In 10.2.27:

      CREATE FUNCTION mroonga_escape RETURNS STRING SONAME 'ha_mroonga.so';
      		 
      Query OK, 0 rows affected (0.01 sec)
      		 
       
      		 
      SELECT mroonga_escape("+-<>~*()\"\:");
      		 
      ERROR 2013 (HY000): Lost connection to MySQL server during query

      In 10.3.20 and 10.4.10

      CREATE FUNCTION mroonga_escape RETURNS STRING   SONAME 'ha_mroonga.so';
      		 
      ERROR 1041 (HY000): Out of memory.

      Attachments

        Issue Links

          split to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-34415 Mroonga: mroonga_snippet: Unknown charset ID: <0> / <>

          • Major - Major loss of function.
          • Open

          Activity

            Ascending order - Click to sort in descending order
            View 19 older comments
            kou Kouhei Sutou added a comment -

            Did you try it with https://github.com/MariaDB/server/pull/3329 ?

            kou Kouhei Sutou added a comment - Did you try it with https://github.com/MariaDB/server/pull/3329 ?
            Roel Roel Van de Paar added a comment -

            Hi kou!

            I tested https://github.com/MariaDB/server/pull/3329 and in all instances/for all testcases above I now see:

            10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN)

            		 
            10.5.26-dbg>CREATE FUNCTION mroonga_normalize RETURNS STRING SONAME 'ha_mroonga.so';
            		 
            Query OK, 0 rows affected (0.044 sec)
            		 
             
            		 
            10.5.26-dbg>SELECT mroonga_normalize('a');
            		 
            ERROR 1123 (HY000): Can't initialize function 'mroonga_normalize'; mroonga_normalize(): Mroonga isn't initialized

            Which would look to be correct.

            And, when loading the plugin, operation also seems normal:

            10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN)

            		 
            10.5.26-dbg>INSTALL PLUGIN mroonga SONAME 'ha_mroonga';
            		 
            Query OK, 0 rows affected (0.077 sec)
            		 
             
            		 
            10.5.26-dbg>CREATE FUNCTION mroonga_command RETURNS STRING SONAME 'ha_mroonga.so';
            		 
            Query OK, 0 rows affected (0.003 sec)
            		 
             
            		 
            10.5.26-dbg>SELECT mroonga_command ('dump -- dump_plugins no -- dump_schema no');
            		 
            +---------------------------------------------------------------+
            		 
            | mroonga_command ('dump -- dump_plugins no -- dump_schema no') |
            		 
            +---------------------------------------------------------------+
            		 
            | NULL                                                          |
            		 
            +---------------------------------------------------------------+
            		 
            1 row in set (0.051 sec)

            And no UBSAN error was seen, nor any crash in a debug build.

            Perhaps of some interest are these outputs (after loading the plugin):

            10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN)

            		 
            10.5.26-dbg>SELECT mroonga_snippet ('',0,0,'',0,0,'','','','','');  # UBSAN, or
            		 
            ERROR 1123 (HY000): Can't initialize function 'mroonga_snippet'; Unknown charset: <>
            		 
            10.5.26-dbg>SELECT mroonga_snippet ('',0,0, 0,0,0,'','','','','');  # UBSAN + SIGSEGV
            		 
            ERROR 1123 (HY000): Can't initialize function 'mroonga_snippet'; Unknown charset ID: <0>

            10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN)

            		 
            10.5.26-dbg>CREATE FUNCTION mroonga_snippet_html RETURNS STRING SONAME 'ha_mroonga.so';
            		 
            Query OK, 0 rows affected (0.002 sec)
            		 
             
            		 
            10.5.26-dbg>SELECT mroonga_snippet_html('a','','');
            		 
            ERROR 1123 (HY000): Can't initialize function 'mroonga_snippet_html'; mroonga_snippet_html(): failed to add a condition to grn_snip: <>

            Though they are likely correct given the non-sensical input.

            Roel Roel Van de Paar added a comment - Hi kou ! I tested https://github.com/MariaDB/server/pull/3329 and in all instances/for all testcases above I now see: 10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN) 10.5.26-dbg>CREATE FUNCTION mroonga_normalize RETURNS STRING SONAME 'ha_mroonga.so'; Query OK, 0 rows affected (0.044 sec)   10.5.26-dbg>SELECT mroonga_normalize('a'); ERROR 1123 (HY000): Can't initialize function 'mroonga_normalize'; mroonga_normalize(): Mroonga isn't initialized Which would look to be correct. And, when loading the plugin, operation also seems normal: 10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN) 10.5.26-dbg>INSTALL PLUGIN mroonga SONAME 'ha_mroonga'; Query OK, 0 rows affected (0.077 sec)   10.5.26-dbg>CREATE FUNCTION mroonga_command RETURNS STRING SONAME 'ha_mroonga.so'; Query OK, 0 rows affected (0.003 sec)   10.5.26-dbg>SELECT mroonga_command ('dump -- dump_plugins no -- dump_schema no'); +---------------------------------------------------------------+ | mroonga_command ('dump -- dump_plugins no -- dump_schema no') | +---------------------------------------------------------------+ | NULL | +---------------------------------------------------------------+ 1 row in set (0.051 sec) And no UBSAN error was seen, nor any crash in a debug build. Perhaps of some interest are these outputs (after loading the plugin): 10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN) 10.5.26-dbg>SELECT mroonga_snippet ('',0,0,'',0,0,'','','','',''); # UBSAN, or ERROR 1123 (HY000): Can't initialize function 'mroonga_snippet'; Unknown charset: <> 10.5.26-dbg>SELECT mroonga_snippet ('',0,0, 0,0,0,'','','','',''); # UBSAN + SIGSEGV ERROR 1123 (HY000): Can't initialize function 'mroonga_snippet'; Unknown charset ID: <0> 10.5-mroonga-udf-initialized-check github.com/kou/server.git 10.5.26 ed9fa5c22266bb7dbc39870825694d880b4ad953 (Debug, UBASAN) 10.5.26-dbg>CREATE FUNCTION mroonga_snippet_html RETURNS STRING SONAME 'ha_mroonga.so'; Query OK, 0 rows affected (0.002 sec)   10.5.26-dbg>SELECT mroonga_snippet_html('a','',''); ERROR 1123 (HY000): Can't initialize function 'mroonga_snippet_html'; mroonga_snippet_html(): failed to add a condition to grn_snip: <> Though they are likely correct given the non-sensical input.
            kou Kouhei Sutou added a comment -

            Thanks for confirming the patch!

            > Perhaps of some interest are these outputs (after loading the plugin):

            How about opening a new issue for the former? (It seems that error handling may be incorrect.)

            The latter is an expected error.

            kou Kouhei Sutou added a comment - Thanks for confirming the patch! > Perhaps of some interest are these outputs (after loading the plugin): How about opening a new issue for the former? (It seems that error handling may be incorrect.) The latter is an expected error.
            Roel Roel Van de Paar added a comment -

            TheLinuxJedi The patch has already proved itself in testing. As soon as your review is done, this can be pushed. Thank you!

            Roel Roel Van de Paar added a comment - TheLinuxJedi The patch has already proved itself in testing. As soon as your review is done, this can be pushed. Thank you!
            Roel Roel Van de Paar added a comment -

            > How about opening a new issue for the former? (It seems that error handling may be incorrect.)
            Thank you for confirming! Created as: MDEV-34415 Mroonga: mroonga_snippet: Unknown charset ID: <0> / <>

            Roel Roel Van de Paar added a comment - > How about opening a new issue for the former? (It seems that error handling may be incorrect.) Thank you for confirming! Created as: MDEV-34415 Mroonga: mroonga_snippet: Unknown charset ID: <0> / <>

            People

              TheLinuxJedi Andrew Hutchings (Inactive)
              greenman Ian Gilfillan
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.