Details
-
Bug
-
Status: Closed (View Workflow)
-
Blocker
-
Resolution: Fixed
-
10.5.4, 10.5.2, 10.5.3
Description
SOURCE in.sql # attached to this report, 2 lines
|
Leads to:
|
10.5.3 cfe5ee90c8e4b9dfa98a41fcd299197a59261be7 |
Core was generated by `/test/MD110520-mariadb-10.5.3-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
|
at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
|
[Current thread is 1 (Thread 0x1522efa56700 (LWP 1258888))]
|
(gdb) bt
|
#0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
|
#1 0x000055e9164d1c11 in my_write_core (sig=sig@entry=11) at /test/10.5_dbg/mysys/stacktrace.c:518
|
#2 0x000055e915c76f8d in handle_fatal_signal (sig=11) at /test/10.5_dbg/sql/signal_handler.cc:329
|
#3 <signal handler called>
|
#4 0x000055e9158e8558 in intern_find_sys_var (str=str@entry=0x0, length=length@entry=0) at /test/10.5_dbg/sql/set_var.cc:702
|
#5 0x000055e9159e4a2c in find_sys_var (thd=0x1522cc815088, str=0x0, length=0, throw_error=throw_error@entry=false) at /test/10.5_dbg/sql/sql_plugin.cc:2885
|
#6 0x000055e9159ad72d in LEX::set_system_variable (this=this@entry=0x1522cc818fd0, var_type=SHOW_OPT_SESSION, name=name@entry=0x1522efa545a0, val=val@entry=0x1522cc874130) at /test/10.5_dbg/sql/sql_lex.cc:8297
|
#7 0x000055e9159ad891 in LEX::set_variable (this=0x1522cc818fd0, name=name@entry=0x1522efa545a0, item=0x1522cc874130) at /test/10.5_dbg/sql/sql_lex.cc:8237
|
#8 0x000055e915c02da0 in MYSQLparse (thd=thd@entry=0x1522cc815088) at /test/10.5_dbg/sql/sql_yacc.yy:16245
|
#9 0x000055e9159e0086 in parse_sql (thd=thd@entry=0x1522cc815088, parser_state=parser_state@entry=0x1522efa553e0, creation_ctx=creation_ctx@entry=0x0, do_pfs_digest=do_pfs_digest@entry=true) at /test/10.5_dbg/sql/sql_parse.cc:10263
|
#10 0x000055e9159da60a in mysql_parse (thd=thd@entry=0x1522cc815088, rawbuf=<optimized out>, length=8, parser_state=parser_state@entry=0x1522efa553e0, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7910
|
#11 0x000055e9159c6ffd in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1522cc815088, packet=packet@entry=0x1522cc867089 "SET \320=''", packet_length=packet_length@entry=8, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1839
|
#12 0x000055e9159c58cc in do_command (thd=0x1522cc815088) at /test/10.5_dbg/sql/sql_parse.cc:1358
|
#13 0x000055e915b1f99d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x1522ce4433a8, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1411
|
#14 0x000055e915b200b9 in handle_one_connection (arg=arg@entry=0x1522ce4433a8) at /test/10.5_dbg/sql/sql_connect.cc:1313
|
#15 0x000055e915f7e10a in pfs_spawn_thread (arg=0x1522ed445888) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201
|
#16 0x00001522eee7d6db in start_thread (arg=0x1522efa56700) at pthread_create.c:463
|
#17 0x00001522ee27b88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
Bug confirmed present in:
MariaDB: 10.5.2 (dbg), 10.5.2 (opt), 10.5.3 (dbg), 10.5.3 (opt), 10.5.4 (dbg), 10.5.4 (opt)
Bug confirmed not present in:
MariaDB: 10.1.45 (dbg), 10.1.45 (opt), 10.2.32 (dbg), 10.2.32 (opt), 10.3.23 (dbg), 10.3.23 (opt), 10.4.13 (dbg), 10.4.13 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt)
MariaDB 10.4.13 gives:
ERROR 1300 (HY000) at line 2 in file: 'in.sql': Invalid dec8 character string: '\xD0'
|
Attachments
Activity
| Field | Original Value | New Value |
|---|---|---|
| Description |
{noformat}
SOURCE in.sql # attached to this report, 2 lines {noformat} Leads to: {noformat:title=10.5.3 cfe5ee90c8e4b9dfa98a41fcd299197a59261be7} Core was generated by `/test/MD110520-mariadb-10.5.3-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'. Program terminated with signal SIGSEGV, Segmentation fault. #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57 [Current thread is 1 (Thread 0x1522efa56700 (LWP 1258888))] (gdb) bt #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57 #1 0x000055e9164d1c11 in my_write_core (sig=sig@entry=11) at /test/10.5_dbg/mysys/stacktrace.c:518 #2 0x000055e915c76f8d in handle_fatal_signal (sig=11) at /test/10.5_dbg/sql/signal_handler.cc:329 #3 <signal handler called> #4 0x000055e9158e8558 in intern_find_sys_var (str=str@entry=0x0, length=length@entry=0) at /test/10.5_dbg/sql/set_var.cc:702 #5 0x000055e9159e4a2c in find_sys_var (thd=0x1522cc815088, str=0x0, length=0, throw_error=throw_error@entry=false) at /test/10.5_dbg/sql/sql_plugin.cc:2885 #6 0x000055e9159ad72d in LEX::set_system_variable (this=this@entry=0x1522cc818fd0, var_type=SHOW_OPT_SESSION, name=name@entry=0x1522efa545a0, val=val@entry=0x1522cc874130) at /test/10.5_dbg/sql/sql_lex.cc:8297 #7 0x000055e9159ad891 in LEX::set_variable (this=0x1522cc818fd0, name=name@entry=0x1522efa545a0, item=0x1522cc874130) at /test/10.5_dbg/sql/sql_lex.cc:8237 #8 0x000055e915c02da0 in MYSQLparse (thd=thd@entry=0x1522cc815088) at /test/10.5_dbg/sql/sql_yacc.yy:16245 #9 0x000055e9159e0086 in parse_sql (thd=thd@entry=0x1522cc815088, parser_state=parser_state@entry=0x1522efa553e0, creation_ctx=creation_ctx@entry=0x0, do_pfs_digest=do_pfs_digest@entry=true) at /test/10.5_dbg/sql/sql_parse.cc:10263 #10 0x000055e9159da60a in mysql_parse (thd=thd@entry=0x1522cc815088, rawbuf=<optimized out>, length=8, parser_state=parser_state@entry=0x1522efa553e0, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7910 #11 0x000055e9159c6ffd in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1522cc815088, packet=packet@entry=0x1522cc867089 "SET \320=''", packet_length=packet_length@entry=8, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1839 #12 0x000055e9159c58cc in do_command (thd=0x1522cc815088) at /test/10.5_dbg/sql/sql_parse.cc:1358 #13 0x000055e915b1f99d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x1522ce4433a8, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1411 #14 0x000055e915b200b9 in handle_one_connection (arg=arg@entry=0x1522ce4433a8) at /test/10.5_dbg/sql/sql_connect.cc:1313 #15 0x000055e915f7e10a in pfs_spawn_thread (arg=0x1522ed445888) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201 #16 0x00001522eee7d6db in start_thread (arg=0x1522efa56700) at pthread_create.c:463 #17 0x00001522ee27b88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 {noformat} Bug confirmed present in: MariaDB: 10.5.2 (dbg), 10.5.2 (opt), 10.5.3 (dbg), 10.5.3 (opt), 10.5.4 (dbg), 10.5.4 (opt) Bug confirmed not present in: MariaDB: 10.1.45 (dbg), 10.1.45 (opt), 10.2.32 (dbg), 10.2.32 (opt), 10.3.23 (dbg), 10.3.23 (opt), 10.4.13 (dbg), 10.4.13 (opt), 10.6.0 (dbg), 10.6.0 (opt) MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt) MariaDB 10.4.13 gives: {noformat} ERROR 1300 (HY000) at line 2 in file: 'in.sql': Invalid dec8 character string: '\xD0' {noformat} |
{noformat}
SOURCE in.sql # attached to this report, 2 lines {noformat} Leads to: {noformat:title=10.5.3 cfe5ee90c8e4b9dfa98a41fcd299197a59261be7} Core was generated by `/test/MD110520-mariadb-10.5.3-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'. Program terminated with signal SIGSEGV, Segmentation fault. #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57 [Current thread is 1 (Thread 0x1522efa56700 (LWP 1258888))] (gdb) bt #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57 #1 0x000055e9164d1c11 in my_write_core (sig=sig@entry=11) at /test/10.5_dbg/mysys/stacktrace.c:518 #2 0x000055e915c76f8d in handle_fatal_signal (sig=11) at /test/10.5_dbg/sql/signal_handler.cc:329 #3 <signal handler called> #4 0x000055e9158e8558 in intern_find_sys_var (str=str@entry=0x0, length=length@entry=0) at /test/10.5_dbg/sql/set_var.cc:702 #5 0x000055e9159e4a2c in find_sys_var (thd=0x1522cc815088, str=0x0, length=0, throw_error=throw_error@entry=false) at /test/10.5_dbg/sql/sql_plugin.cc:2885 #6 0x000055e9159ad72d in LEX::set_system_variable (this=this@entry=0x1522cc818fd0, var_type=SHOW_OPT_SESSION, name=name@entry=0x1522efa545a0, val=val@entry=0x1522cc874130) at /test/10.5_dbg/sql/sql_lex.cc:8297 #7 0x000055e9159ad891 in LEX::set_variable (this=0x1522cc818fd0, name=name@entry=0x1522efa545a0, item=0x1522cc874130) at /test/10.5_dbg/sql/sql_lex.cc:8237 #8 0x000055e915c02da0 in MYSQLparse (thd=thd@entry=0x1522cc815088) at /test/10.5_dbg/sql/sql_yacc.yy:16245 #9 0x000055e9159e0086 in parse_sql (thd=thd@entry=0x1522cc815088, parser_state=parser_state@entry=0x1522efa553e0, creation_ctx=creation_ctx@entry=0x0, do_pfs_digest=do_pfs_digest@entry=true) at /test/10.5_dbg/sql/sql_parse.cc:10263 #10 0x000055e9159da60a in mysql_parse (thd=thd@entry=0x1522cc815088, rawbuf=<optimized out>, length=8, parser_state=parser_state@entry=0x1522efa553e0, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7910 #11 0x000055e9159c6ffd in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1522cc815088, packet=packet@entry=0x1522cc867089 "SET \320=''", packet_length=packet_length@entry=8, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1839 #12 0x000055e9159c58cc in do_command (thd=0x1522cc815088) at /test/10.5_dbg/sql/sql_parse.cc:1358 #13 0x000055e915b1f99d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x1522ce4433a8, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1411 #14 0x000055e915b200b9 in handle_one_connection (arg=arg@entry=0x1522ce4433a8) at /test/10.5_dbg/sql/sql_connect.cc:1313 #15 0x000055e915f7e10a in pfs_spawn_thread (arg=0x1522ed445888) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201 #16 0x00001522eee7d6db in start_thread (arg=0x1522efa56700) at pthread_create.c:463 #17 0x00001522ee27b88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 {noformat} Bug confirmed present in: MariaDB: 10.5.2 (dbg), 10.5.2 (opt), 10.5.3 (dbg), 10.5.3 (opt), 10.5.4 (dbg), 10.5.4 (opt) Bug confirmed not present in: MariaDB: 10.1.45 (dbg), 10.1.45 (opt), 10.2.32 (dbg), 10.2.32 (opt), 10.3.23 (dbg), 10.3.23 (opt), 10.4.13 (dbg), 10.4.13 (opt) MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt) MariaDB 10.4.13 gives: {noformat} ERROR 1300 (HY000) at line 2 in file: 'in.sql': Invalid dec8 character string: '\xD0' {noformat} |
| Attachment | in2.sql [ 51819 ] |
The same crash happens with the following scripts:
SET NAMES dec8; |
EXECUTE IMMEDIATE CONCAT('SET ', 0xD0, '=1'); |
SET NAMES big5; |
EXECUTE IMMEDIATE CONCAT('SET ', 0xA3C0, '=1'); |
SET NAMES cp932; |
EXECUTE IMMEDIATE CONCAT('SET ', 0x81AD, '=1'); |
SET NAMES eucjpms; |
EXECUTE IMMEDIATE CONCAT('SET ', 0x8FA1A1, '=1'); |
SET NAMES euckr; |
EXECUTE IMMEDIATE CONCAT('SET ', 0xA2E8, '=1'); |
SET NAMES gb2312; |
EXECUTE IMMEDIATE CONCAT('SET ', 0xA2A1, '=1'); |
SET NAMES gbk; |
EXECUTE IMMEDIATE CONCAT('SET ', 0xAAA1, '=1'); |
SET NAMES sjis; |
EXECUTE IMMEDIATE CONCAT('SET ', 0x81AD, '=1'); |
SET NAMES sjis; |
EXECUTE IMMEDIATE CONCAT('SET ', 0x8EA8, '=1'); |
More scripts:
SET NAMES dec8; |
SET sql_mode=ORACLE; |
EXECUTE IMMEDIATE CONCAT(0xD0, ':=1'); |
SET NAMES dec8; |
SET sql_mode=ORACLE; |
EXECUTE IMMEDIATE CONCAT('BEGIN ',0xD0, '(1); END;'); |
More scripts:
SET NAMES dec8; |
EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',0xD0, '=1 SELECT 1'); |
| issue.field.resolutiondate | 2020-05-29 07:21:37.0 | 2020-05-29 07:21:37.77 |
| Fix Version/s | 10.5.4 [ 24264 ] | |
| Fix Version/s | 10.5 [ 23123 ] | |
| Resolution | Fixed [ 1 ] | |
| Status | Open [ 1 ] | Closed [ 6 ] |
| Workflow | MariaDB v3 [ 108881 ] | MariaDB v4 [ 157806 ] |
Additional testcase added.
Note to self; needs bit more research on why this shows two different unique bug ID's (__strlen_avx2 ?)
SIGSEGV|__strlen_avx2|intern_find_sys_var|find_sys_var|LEX::set_system_variableSIGSEGV|intern_find_sys_var|find_sys_var|LEX::set_system_variable|LEX::set_variable