[MDEV-22337] Assertion `Alloced_length >= (str_length + length + net_length_size(length))' failed in Binary_string::q_net_store_data on long MULTIPOLYGON query with session_track_user_variables=1 (optimized builds) - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Blocker
Resolution: Fixed
Affects Version/s: 10.5.2, 10.5.3
Fix Version/s: 10.5.3
Component/s: Variables
Labels:
- not-10.1
- not-10.2
- not-10.3
- not-10.4
- regression

Description

SET @@session.session_track_user_variables=1;

set @a='MULTIPOLYGON(((0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)))';

Leads to:

10.5.3 98003440c2f8d20164a191ced1b7d92b283bb68f
mysqld: /test/10.5_dbg/sql/sql_string.h:725: void Binary_string::q_net_store_data(const uchar*, size_t): Assertion `Alloced_length >= (str_length + length + net_length_size(length))' failed.

10.5.3 98003440c2f8d20164a191ced1b7d92b283bb68f
Core was generated by `/test/MD210420-mariadb-10.5.3-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
[Current thread is 1 (Thread 0x7ff90f206700 (LWP 1139608))]
(gdb) bt
#0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
#1 0x000055cf9881203d in my_write_core (sig=sig@entry=6) at /test/10.5_dbg/mysys/stacktrace.c:518
#2 0x000055cf97fb7d7b in handle_fatal_signal (sig=6) at /test/10.5_dbg/sql/signal_handler.cc:329
#3 <signal handler called>
#4 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#5 0x00007ff90d94a801 in __GI_abort () at abort.c:79
#6 0x00007ff90d93a39a in __assert_fail_base (fmt=0x7ff90dac17d8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55cf98961a20 "Alloced_length >= (str_length + length + net_length_size(length))", file=file@entry=0x55cf98961658 "/test/10.5_dbg/sql/sql_string.h", line=line@entry=725, function=function@entry=0x55cf98963940 <_ZZN13Binary_string16q_net_store_dataEPKhmE19__PRETTY_FUNCTION__> "void Binary_string::q_net_store_data(const uchar*, size_t)") at assert.c:92
#7 0x00007ff90d93a412 in __GI___assert_fail (assertion=assertion@entry=0x55cf98961a20 "Alloced_length >= (str_length + length + net_length_size(length))", file=file@entry=0x55cf98961658 "/test/10.5_dbg/sql/sql_string.h", line=line@entry=725, function=function@entry=0x55cf98963940 <_ZZN13Binary_string16q_net_store_dataEPKhmE19__PRETTY_FUNCTION__> "void Binary_string::q_net_store_data(const uchar*, size_t)") at assert.c:101
#8 0x000055cf97c23514 in Binary_string::q_net_store_data (length=517, from=0x7ff8e1880688 "MULTIPOLYGON(((0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0"..., this=0x7ff90f204e08) at /test/10.5_dbg/sql/sql_string.h:724
#9 User_variables_tracker::store (this=0x7ff8e181afb8, thd=<optimized out>, buf=0x7ff90f204e00) at /test/10.5_dbg/sql/session_tracker.cc:1211
#10 0x000055cf97c25112 in Session_tracker::store (this=this@entry=0x7ff8e181aec0, thd=thd@entry=0x7ff8e1815088, buf=buf@entry=0x7ff90f204e00) at /test/10.5_dbg/sql/session_tracker.cc:1251
#11 0x000055cf97c1b384 in net_send_ok (thd=0x7ff8e1815088, server_status=server_status@entry=16386, statement_warn_count=statement_warn_count@entry=0, affected_rows=affected_rows@entry=0, id=id@entry=0, message=<optimized out>, message@entry=0x7ff8e181aba3 "", is_eof=false, skip_flush=false) at /test/10.5_dbg/sql/protocol.cc:282
#12 0x000055cf97c1b5b0 in Protocol::send_ok (this=0x7ff8e1815650, server_status=16386, statement_warn_count=0, affected_rows=0, last_insert_id=0, message=0x7ff8e181aba3 "", skip_flush=false) at /test/10.5_dbg/sql/protocol.cc:643
#13 0x000055cf97c1bf3b in Protocol::end_statement (this=0x7ff8e1815650) at /test/10.5_dbg/sql/protocol.cc:606
#14 0x000055cf97d0908c in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7ff8e1815088, packet=<optimized out>, packet@entry=0x7ff8e1867089 "set @a='MULTIPOLYGON(((0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0"..., packet_length=<optimized out>, packet_length@entry=526, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:2430
#15 0x000055cf97d0549b in do_command (thd=0x7ff8e1815088) at /test/10.5_dbg/sql/sql_parse.cc:1358
#16 0x000055cf97e60415 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x7ff8ed3c53a8, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1422
#17 0x000055cf97e60744 in handle_one_connection (arg=arg@entry=0x7ff8ed3c53a8) at /test/10.5_dbg/sql/sql_connect.cc:1319
#18 0x000055cf982c0fb0 in pfs_spawn_thread (arg=0x7ff90cc45b08) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201
#19 0x00007ff90e62d6db in start_thread (arg=0x7ff90f206700) at pthread_create.c:463
#20 0x00007ff90da2b88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.5.2 (dbg), 10.5.2 (opt), 10.5.3 (dbg), 10.5.3 (opt)

Bug confirmed not present in:
MariaDB: 10.1.45 (dbg), 10.1.45 (opt), 10.2.32 (dbg), 10.2.32 (opt), 10.3.23 (dbg), 10.3.23 (opt), 10.4.13 (dbg), 10.4.13 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt)

MariaDB 10.4.3 (opt) output:

10.4.13>SET @@session.session_track_user_variables=1;

ERROR 1193 (HY000): Unknown system variable 'session_track_user_variables'

10.4.13>set @a='MULTIPOLYGON(((0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)))';

Query OK, 0 rows affected (0.000 sec)

Attachments

Activity

Ascending order - Click to sort in descending order

Roel Van de Paar created issue - 2020-04-22 10:07

Roel Van de Paar made changes - 2020-04-22 10:10

Field	Original Value	New Value
Description	{noformat} SET @@session.session_track_user_variables=1; set @a='MULTIPOLYGON(((0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)))'; {noformat} Leads to: {noformat:title=10.5.3 98003440c2f8d20164a191ced1b7d92b283bb68f} mysqld: /test/10.5_dbg/sql/sql_string.h:725: void Binary_string::q_net_store_data(const uchar, size_t): Assertion `Alloced_length >= (str_length + length + net_length_size(length))' failed. {noformat} {noformat:title=10.5.3 98003440c2f8d20164a191ced1b7d92b283bb68f} Core was generated by `/test/MD210420-mariadb-10.5.3-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'. Program terminated with signal SIGABRT, Aborted. #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57 [Current thread is 1 (Thread 0x7ff90f206700 (LWP 1139608))] (gdb) bt #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57 #1 0x000055cf9881203d in my_write_core (sig=sig@entry=6) at /test/10.5_dbg/mysys/stacktrace.c:518 #2 0x000055cf97fb7d7b in handle_fatal_signal (sig=6) at /test/10.5_dbg/sql/signal_handler.cc:329 #3 <signal handler called> #4 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #5 0x00007ff90d94a801 in __GI_abort () at abort.c:79 #6 0x00007ff90d93a39a in __assert_fail_base (fmt=0x7ff90dac17d8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55cf98961a20 "Alloced_length >= (str_length + length + net_length_size(length))", file=file@entry=0x55cf98961658 "/test/10.5_dbg/sql/sql_string.h", line=line@entry=725, function=function@entry=0x55cf98963940 <_ZZN13Binary_string16q_net_store_dataEPKhmE19__PRETTY_FUNCTION__> "void Binary_string::q_net_store_data(const uchar, size_t)") at assert.c:92 #7 0x00007ff90d93a412 in __GI___assert_fail (assertion=assertion@entry=0x55cf98961a20 "Alloced_length >= (str_length + length + net_length_size(length))", file=file@entry=0x55cf98961658 "/test/10.5_dbg/sql/sql_string.h", line=line@entry=725, function=function@entry=0x55cf98963940 <_ZZN13Binary_string16q_net_store_dataEPKhmE19__PRETTY_FUNCTION__> "void Binary_string::q_net_store_data(const uchar*, size_t)") at assert.c:101 #8 0x000055cf97c23514 in Binary_string::q_net_store_data (length=517, from=0x7ff8e1880688 "MULTIPOLYGON(((0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0"..., this=0x7ff90f204e08) at /test/10.5_dbg/sql/sql_string.h:724 #9 User_variables_tracker::store (this=0x7ff8e181afb8, thd=<optimized out>, buf=0x7ff90f204e00) at /test/10.5_dbg/sql/session_tracker.cc:1211 #10 0x000055cf97c25112 in Session_tracker::store (this=this@entry=0x7ff8e181aec0, thd=thd@entry=0x7ff8e1815088, buf=buf@entry=0x7ff90f204e00) at /test/10.5_dbg/sql/session_tracker.cc:1251 #11 0x000055cf97c1b384 in net_send_ok (thd=0x7ff8e1815088, server_status=server_status@entry=16386, statement_warn_count=statement_warn_count@entry=0, affected_rows=affected_rows@entry=0, id=id@entry=0, message=<optimized out>, message@entry=0x7ff8e181aba3 "", is_eof=false, skip_flush=false) at /test/10.5_dbg/sql/protocol.cc:282 #12 0x000055cf97c1b5b0 in Protocol::send_ok (this=0x7ff8e1815650, server_status=16386, statement_warn_count=0, affected_rows=0, last_insert_id=0, message=0x7ff8e181aba3 "", skip_flush=false) at /test/10.5_dbg/sql/protocol.cc:643 #13 0x000055cf97c1bf3b in Protocol::end_statement (this=0x7ff8e1815650) at /test/10.5_dbg/sql/protocol.cc:606 #14 0x000055cf97d0908c in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7ff8e1815088, packet=<optimized out>, packet@entry=0x7ff8e1867089 "set @a='MULTIPOLYGON(((0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0"..., packet_length=<optimized out>, packet_length@entry=526, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:2430 #15 0x000055cf97d0549b in do_command (thd=0x7ff8e1815088) at /test/10.5_dbg/sql/sql_parse.cc:1358 #16 0x000055cf97e60415 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x7ff8ed3c53a8, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1422 #17 0x000055cf97e60744 in handle_one_connection (arg=arg@entry=0x7ff8ed3c53a8) at /test/10.5_dbg/sql/sql_connect.cc:1319 #18 0x000055cf982c0fb0 in pfs_spawn_thread (arg=0x7ff90cc45b08) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201 #19 0x00007ff90e62d6db in start_thread (arg=0x7ff90f206700) at pthread_create.c:463 #20 0x00007ff90da2b88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 {noformat} Bug confirmed present in: MariaDB: 10.5.2 (dbg), 10.5.2 (opt), 10.5.3 (dbg), 10.5.3 (opt) Bug confirmed not present in: MariaDB: 10.1.45 (dbg), 10.1.45 (opt), 10.2.32 (dbg), 10.2.32 (opt), 10.3.23 (dbg), 10.3.23 (opt), 10.4.13 (dbg), 10.4.13 (opt) MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt)	{noformat} SET @@session.session_track_user_variables=1; set @a='MULTIPOLYGON(((0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)))'; {noformat} Leads to: {noformat:title=10.5.3 98003440c2f8d20164a191ced1b7d92b283bb68f} mysqld: /test/10.5_dbg/sql/sql_string.h:725: void Binary_string::q_net_store_data(const uchar, size_t): Assertion `Alloced_length >= (str_length + length + net_length_size(length))' failed. {noformat} {noformat:title=10.5.3 98003440c2f8d20164a191ced1b7d92b283bb68f} Core was generated by `/test/MD210420-mariadb-10.5.3-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'. Program terminated with signal SIGABRT, Aborted. #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57 [Current thread is 1 (Thread 0x7ff90f206700 (LWP 1139608))] (gdb) bt #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57 #1 0x000055cf9881203d in my_write_core (sig=sig@entry=6) at /test/10.5_dbg/mysys/stacktrace.c:518 #2 0x000055cf97fb7d7b in handle_fatal_signal (sig=6) at /test/10.5_dbg/sql/signal_handler.cc:329 #3 <signal handler called> #4 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #5 0x00007ff90d94a801 in __GI_abort () at abort.c:79 #6 0x00007ff90d93a39a in __assert_fail_base (fmt=0x7ff90dac17d8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55cf98961a20 "Alloced_length >= (str_length + length + net_length_size(length))", file=file@entry=0x55cf98961658 "/test/10.5_dbg/sql/sql_string.h", line=line@entry=725, function=function@entry=0x55cf98963940 <_ZZN13Binary_string16q_net_store_dataEPKhmE19__PRETTY_FUNCTION__> "void Binary_string::q_net_store_data(const uchar, size_t)") at assert.c:92 #7 0x00007ff90d93a412 in __GI___assert_fail (assertion=assertion@entry=0x55cf98961a20 "Alloced_length >= (str_length + length + net_length_size(length))", file=file@entry=0x55cf98961658 "/test/10.5_dbg/sql/sql_string.h", line=line@entry=725, function=function@entry=0x55cf98963940 <_ZZN13Binary_string16q_net_store_dataEPKhmE19__PRETTY_FUNCTION__> "void Binary_string::q_net_store_data(const uchar*, size_t)") at assert.c:101 #8 0x000055cf97c23514 in Binary_string::q_net_store_data (length=517, from=0x7ff8e1880688 "MULTIPOLYGON(((0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0"..., this=0x7ff90f204e08) at /test/10.5_dbg/sql/sql_string.h:724 #9 User_variables_tracker::store (this=0x7ff8e181afb8, thd=<optimized out>, buf=0x7ff90f204e00) at /test/10.5_dbg/sql/session_tracker.cc:1211 #10 0x000055cf97c25112 in Session_tracker::store (this=this@entry=0x7ff8e181aec0, thd=thd@entry=0x7ff8e1815088, buf=buf@entry=0x7ff90f204e00) at /test/10.5_dbg/sql/session_tracker.cc:1251 #11 0x000055cf97c1b384 in net_send_ok (thd=0x7ff8e1815088, server_status=server_status@entry=16386, statement_warn_count=statement_warn_count@entry=0, affected_rows=affected_rows@entry=0, id=id@entry=0, message=<optimized out>, message@entry=0x7ff8e181aba3 "", is_eof=false, skip_flush=false) at /test/10.5_dbg/sql/protocol.cc:282 #12 0x000055cf97c1b5b0 in Protocol::send_ok (this=0x7ff8e1815650, server_status=16386, statement_warn_count=0, affected_rows=0, last_insert_id=0, message=0x7ff8e181aba3 "", skip_flush=false) at /test/10.5_dbg/sql/protocol.cc:643 #13 0x000055cf97c1bf3b in Protocol::end_statement (this=0x7ff8e1815650) at /test/10.5_dbg/sql/protocol.cc:606 #14 0x000055cf97d0908c in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7ff8e1815088, packet=<optimized out>, packet@entry=0x7ff8e1867089 "set @a='MULTIPOLYGON(((0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0"..., packet_length=<optimized out>, packet_length@entry=526, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:2430 #15 0x000055cf97d0549b in do_command (thd=0x7ff8e1815088) at /test/10.5_dbg/sql/sql_parse.cc:1358 #16 0x000055cf97e60415 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x7ff8ed3c53a8, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1422 #17 0x000055cf97e60744 in handle_one_connection (arg=arg@entry=0x7ff8ed3c53a8) at /test/10.5_dbg/sql/sql_connect.cc:1319 #18 0x000055cf982c0fb0 in pfs_spawn_thread (arg=0x7ff90cc45b08) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201 #19 0x00007ff90e62d6db in start_thread (arg=0x7ff90f206700) at pthread_create.c:463 #20 0x00007ff90da2b88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 {noformat} Bug confirmed present in: MariaDB: 10.5.2 (dbg), 10.5.2 (opt), 10.5.3 (dbg), 10.5.3 (opt) Bug confirmed not present in: MariaDB: 10.1.45 (dbg), 10.1.45 (opt), 10.2.32 (dbg), 10.2.32 (opt), 10.3.23 (dbg), 10.3.23 (opt), 10.4.13 (dbg), 10.4.13 (opt) MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt) MariaDB 10.4.3 (opt) output: {noformat} 10.4.13>SET @@session.session_track_user_variables=1; ERROR 1193 (HY000): Unknown system variable 'session_track_user_variables' 10.4.13>set @a='MULTIPOLYGON(((0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)))'; Query OK, 0 rows affected (0.000 sec) {noformat}

Roel Van de Paar added a comment - 2020-04-22 10:12 - edited

It is not a real "regression" other than the fact that a previously working query now fails.
I suspect there are other cases that this Alloced_length length check may apply to.

Roel Van de Paar added a comment - 2020-04-22 10:12 - edited It is not a real "regression" other than the fact that a previously working query now fails. I suspect there are other cases that this Alloced_length length check may apply to.

Alexey Botchkov made changes - 2020-04-22 11:29

Component/s		Variables [ 13903 ]
Component/s	GIS [ 10105 ]

Alexey Botchkov made changes - 2020-04-22 13:12

Status

Open [ 1 ]

In Progress [ 3 ]

Alexey Botchkov added a comment - 2020-04-22 13:14

Proposed fix.
https://github.com/MariaDB/server/commit/1b11f3a54c498b8676e091e7aecf5a6b7b9f0dd5

Alexey Botchkov added a comment - 2020-04-22 13:14 Proposed fix. https://github.com/MariaDB/server/commit/1b11f3a54c498b8676e091e7aecf5a6b7b9f0dd5

Alexey Botchkov made changes - 2020-04-22 13:14

Assignee	Alexey Botchkov [ holyfoot ]	Oleksandr Byelkin [ sanja ]
Status	In Progress [ 3 ]	In Review [ 10002 ]

Oleksandr Byelkin added a comment - 2020-04-28 15:41

OK to push! Thanks!

Oleksandr Byelkin added a comment - 2020-04-28 15:41 OK to push! Thanks!

Oleksandr Byelkin made changes - 2020-04-28 15:41

Assignee	Oleksandr Byelkin [ sanja ]	Alexey Botchkov [ holyfoot ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Oleksandr Byelkin added a comment - 2020-04-28 15:47

I think at least second part of the patch shoud be moved to 10.2

Oleksandr Byelkin added a comment - 2020-04-28 15:47 I think at least second part of the patch shoud be moved to 10.2

Alexey Botchkov made changes - 2020-04-29 08:30

issue.field.resolutiondate

2020-04-29 08:30:13.0

2020-04-29 08:30:13.559

Alexey Botchkov made changes - 2020-04-29 08:30

Fix Version/s		10.5.3 [ 24263 ]
Fix Version/s	10.5 [ 23123 ]
Resolution		Fixed [ 1 ]
Status	Stalled [ 10000 ]	Closed [ 6 ]

Roel Van de Paar added a comment - 2020-05-04 04:02

Saw a testcase in an previous run today which causes stack smashing (before the fix was introduced, works fine now). Adding it for completeness.

SET @@session.session_track_user_variables=1;

SET @b='?k;E1S={]8u?yV_ta=Gg"0N:pU,ENpD"/Gg.7N?A4Z0n=AF"$Yxw=y@-ESk$H0g390[]Fm]1JyD&X=_MlwGd"Mrh,VB[)S:mY].G/0OPo&kkAbuhI-_Opg&N:om$=~yTcR%E^ld{:PJcDx{cT,W1_w=[})u-"kY:bE9:NZO8zhb=J"OOZp?+@=l{0D$dL"2"R)TnwW+J-3b1}%gh$rQ4-WU=%r,SI-INq[+%b(^7ON5=[fDoy9uDD;xSV%@%qGh.YRwb]Ef=wNrg]wMn8FeSY;VIsnhh=FszZMQTFwhBXWv/HZE{4_gps_L~TndPl_B8^8[SDQ:?$:/91vn6WGd=bTO#=s=~ylr:){9%BuL,Hg=n&D?sCKXBF+iy_7;N(W#=9QtQKIYapEY@.mro)vu=rQVV6/Q/$ji7R0K{dy~*@~kD:&#%#&[G,LS^6=ZeJD5Wd9^x^#o+qP^x6+~U*(?PguiAeE1AM=tQE.Qzq~X{"~%WKC}[9p=wfTx6=dg#=q%k3p=Ym=24=6f@2(G$*zf1_fCYV[muJo3EhM=;CE&M,89-fQp/=pVYCWzd"YF]7=KjbV=ECSx4s#[i10~Ar:,PFL=7JnN_4gM1B^vA@(1s;*fn#5R-8VHtM&&QBCWf?tEg19S5mO)k.w+gR0UT-e6t}7.OfSck8#u~wN_PehioD;rKpn=pr[gex/=vad~"Lz=7TtB^[DoAL5F{+BNJ%LC3d(EX"92DlVtaj={CPDpKQ=CnE@xw5eX:f}gu5DRYy4Prv[Z=YXKi]Je0fifDMWjB0nb,QKPEf,f}e=tWpoE/v^i?KHI4Qv&;-:I';

Version: '10.5.3-MariaDB'  socket: '/test/MD300420-mariadb-10.5.3-linux-x86_64-opt/socket.sock'  port: 10419  MariaDB Server

*** stack smashing detected ***: <unknown> terminated

200504  4:02:15 [ERROR] mysqld got signal 6 ;

Roel Van de Paar added a comment - 2020-05-04 04:02 Saw a testcase in an previous run today which causes stack smashing (before the fix was introduced, works fine now). Adding it for completeness. SET @@session.session_track_user_variables=1; SET @b='?k;E1S={]8u?yV_ta=Gg"0N:pU,ENpD"/Gg.7N?A4Z0n=AF"$Yxw=y@-ESk$H0g390[]Fm]1JyD&X=_MlwGd"Mrh,VB[)S:mY].G/0OPo&kkAbuhI-_Opg&N:om$=~yTcR%E^ld{:PJcDx{cT,W1_w=[})u-"kY:bE9:NZO8zhb=J"OOZp?+@=l{0D$dL"2"R)TnwW+J-3b1}%gh$rQ4-WU=%r,SI-INq[+%b(^7ON5=[fDoy9uDD;xSV%@%qGh.YRwb]Ef=wNrg]wMn8FeSY;VIsnhh=FszZMQTFwhBXWv/HZE{4_gps_L~TndPl_B8^8[SDQ:?$:/91vn6WGd=bTO#=s=~ylr:){9%BuL,Hg=n&D?sCKXBF+iy_7;N(W#=9QtQKIYapEY@.mro)vu=rQVV6/Q/$ji7R0K{dy~*@~kD:&#%#&[G,LS^6=ZeJD5Wd9^x^#o+qP^x6+~U*(?PguiAeE1AM=tQE.Qzq~X{"~%WKC}[9p=wfTx6=dg#=q%k3p=Ym=24=6f@2(G$*zf1_fCYV[muJo3EhM=;CE&M,89-fQp/=pVYCWzd"YF]7=KjbV=ECSx4s#[i10~Ar:,PFL=7JnN_4gM1B^vA@(1s;*fn#5R-8VHtM&&QBCWf?tEg19S5mO)k.w+gR0UT-e6t}7.OfSck8#u~wN_PehioD;rKpn=pr[gex/=vad~"Lz=7TtB^[DoAL5F{+BNJ%LC3d(EX"92DlVtaj={CPDpKQ=CnE@xw5eX:f}gu5DRYy4Prv[Z=YXKi]Je0fifDMWjB0nb,QKPEf,f}e=tWpoE/v^i?KHI4Qv&;-:I'; Version: '10.5.3-MariaDB' socket: '/test/MD300420-mariadb-10.5.3-linux-x86_64-opt/socket.sock' port: 10419 MariaDB Server *** stack smashing detected ***: <unknown> terminated 200504 4:02:15 [ERROR] mysqld got signal 6 ;

Sergei Golubchik made changes - 2021-12-06 21:51

Workflow

MariaDB v3 [ 107571 ]

MariaDB v4 [ 157656 ]

People

Assignee:: Alexey Botchkov

Reporter:: Roel Van de Paar

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 2020-04-22 10:07

Updated:: 2020-05-04 04:03

Resolved:: 2020-04-29 08:30

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.