Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-24524

Assertion `ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))' failed in String::append on SELECT from I_S

Details

    Description

      SET character_set_connection=utf16;
      INSERT INTO mysql.proc (db, name, type, specific_name, language, sql_data_access, is_deterministic, security_type, param_list, returns, body, definer, CREATEd, modified, sql_mode, COMMENT, character_set_client, collation_connection, db_collation, body_utf8) VALUES ('test', 'bug14233_1', 'FUNCTION', 'bug14233_1', 'SQL', 'reads_sql_data', 'NO', 'DEFINER', '', 'INT (10)', 'SELECT COUNT (*) FROM mysql.user', 'root@localhost', NOW(), '0000-00-00 00:00:00', '', '', '', '', '', 'SELECT COUNT (*) FROM mysql.user'), ('test', 'bug14233_2', 'FUNCTION', 'bug14233_2', 'SQL', 'reads_sql_data', 'NO', 'DEFINER', '', 'INT (10)', 'BEGIN declare x INT; SELECT COUNT (*) INTO x FROM mysql.user; END', 'root@localhost', NOW(), '0000-00-00 00:00:00', '', '', '', '', '', 'BEGIN declare x INT; SELECT COUNT (*) INTO x FROM mysql.user; END'), ('test', 'bug14233_3', 'PROCEDURE', 'bug14233_3', 'SQL', 'reads_sql_data','NO', 'DEFINER', '', '', 'alksj wpsj sa ^#!@ ', 'root@localhost', NOW(), '0000-00-00 00:00:00', '', '', '', '', '', 'alksj wpsj sa ^#!@ ');
      SELECT * FROM information_schema.parameters WHERE specific_schema='test';
      

      Leads to:

      10.6.0 9118fd360a3da0bba521caf2a35c424968235ac4 (Debug)

      mysqld: /test/10.6_dbg/sql/sql_string.h:923: bool String::append(const LEX_CSTRING*): Assertion `ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))' failed.
      

      10.6.0 9118fd360a3da0bba521caf2a35c424968235ac4 (Debug)

      Core was generated by `/test/MD010121-mariadb-10.6.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
          at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      [Current thread is 1 (Thread 0x1479446e3700 (LWP 2621708))]
      (gdb) bt
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      #1  0x000055e2ded170d7 in my_write_core (sig=sig@entry=6) at /test/10.6_dbg/mysys/stacktrace.c:424
      #2  0x000055e2de4abab1 in handle_fatal_signal (sig=6) at /test/10.6_dbg/sql/signal_handler.cc:330
      #3  <signal handler called>
      #4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      #5  0x00001479472a1859 in __GI_abort () at abort.c:79
      #6  0x00001479472a1729 in __assert_fail_base (fmt=0x147947437588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x55e2dee5cf18 "ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))", file=0x55e2dee5c848 "/test/10.6_dbg/sql/sql_string.h", line=923, function=<optimized out>) at assert.c:92
      #7  0x00001479472b2f36 in __GI___assert_fail (assertion=assertion@entry=0x55e2dee5cf18 "ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))", file=file@entry=0x55e2dee5c848 "/test/10.6_dbg/sql/sql_string.h", line=line@entry=923, function=function@entry=0x55e2dee5e328 "bool String::append(const LEX_CSTRING*)") at assert.c:101
      #8  0x000055e2de68b141 in String::append (ls=0x1479446ded90, this=0x1479446dd0b0) at /test/10.6_dbg/sql/sql_string.h:923
      #9  Sp_handler::show_create_sp (this=this@entry=0x55e2df7166a8 <sp_handler_function>, thd=thd@entry=0x1478e8000db8, buf=buf@entry=0x1479446dd0b0, db=@0x1479446dd110: {str = 0x1478e8042098 "test", length = 4}, name=@0x1479446dd120: {str = 0x1478e80420a0 "bug14233_1", length = 10}, params=@0x1479446ded80: {str = 0x55e2df03bd3e "", length = 0}, returns=@0x1479446ded90: {str = 0x1478e80420c0 "", length = 16}, body=@0x1479446dd0a0: {str = 0x55e2df039ca4 "RETURN NULL", length = 11}, chistics=@0x1479446dd0f0: {comment = {str = 0x0, length = 0}, suid = SP_IS_DEFAULT_SUID, detistic = false, daccess = SP_DEFAULT_ACCESS, agg_type = DEFAULT_AGGREGATE}, definer=@0x1479446dd0d0: {user = {str = 0x55e2df03bd3e "", length = 0}, host = {str = 0x55e2df03bd3e "", length = 0}}, ddl_options={m_options = DDL_options_st::OPT_NONE}, sql_mode=0) at /test/10.6_dbg/sql/sp.cc:2991
      #10 0x000055e2de6917f0 in Sp_handler::sp_load_for_information_schema (this=this@entry=0x55e2df7166a8 <sp_handler_function>, thd=thd@entry=0x1478e8000db8, proc_table=proc_table@entry=0x1478e8022a58, db=@0x1479446deda0: {str = 0x1478e8042098 "test", length = 4}, name=@0x1479446dedb0: {str = 0x1478e80420a0 "bug14233_1", length = 10}, params=@0x1479446ded80: {str = 0x55e2df03bd3e "", length = 0}, returns=@0x1479446ded90: {str = 0x1478e80420c0 "", length = 16}, sql_mode=0, free_sp_head=0x1479446ded6f) at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:71
      #11 0x000055e2de28f9c5 in store_schema_params (thd=thd@entry=0x1478e8000db8, table=table@entry=0x1478e801d520, proc_table=proc_table@entry=0x1478e8022a58, wild=wild@entry=0x0, full_access=<optimized out>, full_access@entry=true, sp_user=sp_user@entry=0x1479446dfb60 "root@localhost") at /test/10.6_dbg/sql/sql_show.cc:6321
      #12 0x000055e2de291cb0 in fill_schema_proc (thd=0x1478e8000db8, tables=<optimized out>, cond=<optimized out>) at /test/10.6_dbg/sql/sql_show.cc:6578
      #13 0x000055e2de294a31 in get_schema_tables_result (join=join@entry=0x1478e8014a40, executed_place=executed_place@entry=PROCESSED_BY_JOIN_EXEC) at /test/10.6_dbg/sql/sql_show.cc:8686
      #14 0x000055e2de268cb9 in JOIN::exec_inner (this=this@entry=0x1478e8014a40) at /test/10.6_dbg/sql/sql_select.cc:4449
      #15 0x000055e2de2697ad in JOIN::exec (this=this@entry=0x1478e8014a40) at /test/10.6_dbg/sql/sql_select.cc:4252
      #16 0x000055e2de267a09 in mysql_select (thd=thd@entry=0x1478e8000db8, tables=0x1478e8012dd0, fields=@0x1478e8012908: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1478e8012d60, last = 0x1478e8016868, elements = 16}, <No data fields>}, conds=0x1478e80136d0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2684619520, result=0x1478e8014a18, unit=0x1478e8004f80, select_lex=0x1478e80127b8) at /test/10.6_dbg/sql/sql_select.cc:4668
      #17 0x000055e2de267cd0 in handle_select (thd=thd@entry=0x1478e8000db8, lex=lex@entry=0x1478e8004eb8, result=result@entry=0x1478e8014a18, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.6_dbg/sql/sql_select.cc:417
      #18 0x000055e2de1da19d in execute_sqlcom_select (thd=thd@entry=0x1478e8000db8, all_tables=0x1478e8012dd0) at /test/10.6_dbg/sql/sql_parse.cc:6116
      #19 0x000055e2de1e6c7c in mysql_execute_command (thd=thd@entry=0x1478e8000db8) at /test/10.6_dbg/sql/sql_parse.cc:3820
      #20 0x000055e2de1d3072 in mysql_parse (thd=thd@entry=0x1478e8000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1479446e23d0) at /test/10.6_dbg/sql/sql_parse.cc:7881
      #21 0x000055e2de1e11ec in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1478e8000db8, packet=packet@entry=0x1478e8008d39 "SELECT * FROM information_schema.parameters WHERE specific_schema='test'", packet_length=packet_length@entry=72) at /test/10.6_dbg/sql/sql_class.h:1293
      #22 0x000055e2de1e452d in do_command (thd=0x1478e8000db8) at /test/10.6_dbg/sql/sql_parse.cc:1348
      #23 0x000055e2de3407fc in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55e2e22a6c28, put_in_cache=put_in_cache@entry=true) at /test/10.6_dbg/sql/sql_connect.cc:1410
      #24 0x000055e2de340f03 in handle_one_connection (arg=arg@entry=0x55e2e22a6c28) at /test/10.6_dbg/sql/sql_connect.cc:1312
      #25 0x000055e2de7f688f in pfs_spawn_thread (arg=0x55e2e21adf58) at /test/10.6_dbg/storage/perfschema/pfs.cc:2201
      #26 0x00001479477af609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #27 0x000014794739e293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.3.28 (dbg), 10.4.18 (dbg), 10.5.9 (dbg), 10.6.0 (dbg)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.2.37 (dbg), 10.2.37 (opt), 10.3.28 (opt), 10.4.18 (opt), 10.5.9 (opt), 10.6.0 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.50 (dbg), 5.6.50 (opt), 5.7.32 (dbg), 5.7.32 (opt), 8.0.22 (dbg), 8.0.22 (opt)

      10.2 Gives a really odd error:

      10.2.37 (Debug)

      10.2.37>SET character_set_connection=utf16;
      Query OK, 0 rows affected (0.00 sec)
       
      10.2.37>INSERT INTO mysql.proc (db, name, type, specific_name, language, sql_data_access, is_deterministic, security_type, param_list, returns, body, definer, CREATEd, modified, sql_mode, COMMENT, character_set_client, collation_connection, db_collation, body_utf8) VALUES ('test', 'bug14233_1', 'FUNCTION', 'bug14233_1', 'SQL', 'reads_sql_data', 'NO', 'DEFINER', '', 'INT (10)', 'SELECT COUNT (*) FROM mysql.user', 'root@localhost', NOW(), '0000-00-00 00:00:00', '', '', '', '', '', 'SELECT COUNT (*) FROM mysql.user'), ('test', 'bug14233_2', 'FUNCTION', 'bug14233_2', 'SQL', 'reads_sql_data', 'NO', 'DEFINER', '', 'INT (10)', 'BEGIN declare x INT; SELECT COUNT (*) INTO x FROM mysql.user; END', 'root@localhost', NOW(), '0000-00-00 00:00:00', '', '', '', '', '', 'BEGIN declare x INT; SELECT COUNT (*) INTO x FROM mysql.user; END'), ('test', 'bug14233_3', 'PROCEDURE', 'bug14233_3', 'SQL', 'reads_sql_data','NO', 'DEFINER', '', '', 'alksj wpsj sa ^#!@ ', 'root@localhost', NOW(), '0000-00-00 00:00:00', '', '', '', '', '', 'alksj wpsj sa ^#!@ ');
      Query OK, 3 rows affected (0.00 sec)
      Records: 3  Duplicates: 0  Warnings: 0
       
      10.2.37>SELECT * FROM information_schema.parameters WHERE specific_schema='test';
      ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'RETURN NULL' at line 2
      

      The text 'RETURN NULL' also appears in the stack from 10.6 above, so 10.2 looks to be affected by this bug also, but in a different way.

      See also: https://bugs.mysql.com/bug.php?id=14233

      Attachments

        Issue Links

          Activity

            Roel Roel Van de Paar added a comment - - edited

            SET collation_connection=ucs2_general_ci;
            INSERT INTO mysql.proc (db, name, type, specific_name, language, sql_data_access, is_deterministic, security_type, param_list, returns, body, definer, created, modified, sql_mode, comment, character_set_client, collation_connection, db_collation, body_utf8 ) VALUES ( 'a', 'a', 'FUNCTION', 'bug14233_1', 'SQL', 'READS_SQL_DATA', 'NO', 'DEFINER', '', 'int(10)', 'SELECT * FROM mysql.user', 'root@localhost', NOW(), '0000-00-00 00:00:00', '', '', '', '', '', 'SELECT * FROM mysql.user' );
            SELECT * FROM INFORMATION_SCHEMA.ROUTINES WHERE ROUTINE_NAME='a';
            

            Leads to:

            10.5.4 4080e3acefd7e58d88c2f3539fb6a0fb359cf057

            mysqld: /test/10.5_dbg/sql/sql_string.h:924: bool String::append(const LEX_CSTRING*): Assertion `ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))' failed.
            

            10.5.4 4080e3acefd7e58d88c2f3539fb6a0fb359cf057

            Core was generated by `/test/MD150620-mariadb-10.5.4-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
            Program terminated with signal SIGABRT, Aborted.
            #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
                at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
            [Current thread is 1 (Thread 0x14f08449c700 (LWP 1573308))]
            (gdb) bt
            #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
            #1  0x0000561ffbdd44c6 in my_write_core (sig=sig@entry=6) at /test/10.5_dbg/mysys/stacktrace.c:518
            #2  0x0000561ffb576d60 in handle_fatal_signal (sig=6) at /test/10.5_dbg/sql/signal_handler.cc:330
            #3  <signal handler called>
            #4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
            #5  0x000014f08cdc5801 in __GI_abort () at abort.c:79
            #6  0x000014f08cdb539a in __assert_fail_base (fmt=0x14f08cf3c7d8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x561ffbf2bda8 "ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))", file=file@entry=0x561ffbf2b678 "/test/10.5_dbg/sql/sql_string.h", line=line@entry=924, function=function@entry=0x561ffc124500 <_ZZN6String6appendEPK25st_mysql_const_lex_stringE19__PRETTY_FUNCTION__> "bool String::append(const LEX_CSTRING*)") at assert.c:92
            #7  0x000014f08cdb5412 in __GI___assert_fail (assertion=assertion@entry=0x561ffbf2bda8 "ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))", file=file@entry=0x561ffbf2b678 "/test/10.5_dbg/sql/sql_string.h", line=line@entry=924, function=function@entry=0x561ffc124500 <_ZZN6String6appendEPK25st_mysql_const_lex_stringE19__PRETTY_FUNCTION__> "bool String::append(const LEX_CSTRING*)") at assert.c:101
            #8  0x0000561ffb721483 in String::append (ls=0x14f084497280, this=0x14f0844955a0) at /test/10.5_dbg/sql/sql_string.h:922
            #9  Sp_handler::show_create_sp (this=this@entry=0x561ffca8ba68 <sp_handler_function>, thd=thd@entry=0x14f06b815088, buf=buf@entry=0x14f0844955a0, db=@0x14f084495600: {str = 0x14f06b903d88 "a", length = 1}, name=@0x14f084495610: {str = 0x14f06b903d90 "a", length = 1}, params=@0x561ffc91b880: {str = 0x561ffc126516 "", length = 0}, returns=@0x14f084497280: {str = 0x14f06b903da8 "", length = 14}, body=@0x14f084495590: {str = 0x561ffc12359b "RETURN NULL", length = 11}, chistics=@0x14f0844955e0: {comment = {str = 0x0, length = 0}, suid = SP_IS_DEFAULT_SUID, detistic = false, daccess = SP_DEFAULT_ACCESS, agg_type = DEFAULT_AGGREGATE}, definer=@0x14f0844955c0: {user = {str = 0x561ffc126516 "", length = 0}, host = {str = 0x561ffc126516 "", length = 0}}, ddl_options={m_options = DDL_options_st::OPT_NONE}, sql_mode=0) at /test/10.5_dbg/sql/sp.cc:2995
            #10 0x0000561ffb727c41 in Sp_handler::sp_load_for_information_schema (this=this@entry=0x561ffca8ba68 <sp_handler_function>, thd=thd@entry=0x14f06b815088, proc_table=proc_table@entry=0x14f06b8a2088, db=@0x14f084497250: {str = 0x14f06b903d88 "a", length = 1}, name=@0x14f084497260: {str = 0x14f06b903d90 "a", length = 1}, params=@0x561ffc91b880: {str = 0x561ffc126516 "", length = 0}, returns=@0x14f084497280: {str = 0x14f06b903da8 "", length = 14}, sql_mode=0, free_sp_head=0x14f08449724f) at /test/10.5_dbg/sql/sp.cc:3066
            #11 0x0000561ffb373cf3 in store_schema_proc (thd=thd@entry=0x14f06b815088, table=table@entry=0x14f06b8d40a0, proc_table=proc_table@entry=0x14f06b8a2088, wild=wild@entry=0x0, full_access=<optimized out>, full_access@entry=true, sp_user=sp_user@entry=0x14f0844988d0 "root@localhost") at /test/10.5_dbg/sql/sql_show.cc:6430
            #12 0x0000561ffb374b19 in fill_schema_proc (thd=0x14f06b815088, tables=<optimized out>, cond=<optimized out>) at /test/10.5_dbg/sql/sql_show.cc:6549
            #13 0x0000561ffb37715d in get_schema_tables_result (join=join@entry=0x14f06b876b00, executed_place=executed_place@entry=PROCESSED_BY_JOIN_EXEC) at /test/10.5_dbg/sql/sql_show.cc:8673
            #14 0x0000561ffb34a8e1 in JOIN::exec_inner (this=this@entry=0x14f06b876b00) at /test/10.5_dbg/sql/sql_select.cc:4401
            #15 0x0000561ffb34b289 in JOIN::exec (this=this@entry=0x14f06b876b00) at /test/10.5_dbg/sql/sql_select.cc:4225
            #16 0x0000561ffb34959e in mysql_select (thd=thd@entry=0x14f06b815088, tables=<optimized out>, fields=@0x14f06b8742d8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f06b874738, last = 0x14f06b87a030, elements = 31}, <No data fields>}, conds=0x14f06b875080, og_num=0, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=2684619520, result=0x14f06b876ad8, unit=0x14f06b8190a0, select_lex=0x14f06b874188) at /test/10.5_dbg/sql/sql_select.cc:4649
            #17 0x0000561ffb3498cd in handle_select (thd=thd@entry=0x14f06b815088, lex=lex@entry=0x14f06b818fd8, result=result@entry=0x14f06b876ad8, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.5_dbg/sql/sql_select.cc:417
            #18 0x0000561ffb2d31ed in execute_sqlcom_select (thd=thd@entry=0x14f06b815088, all_tables=0x14f06b8747a8) at /test/10.5_dbg/sql/sql_parse.cc:6209
            #19 0x0000561ffb2cc312 in mysql_execute_command (thd=thd@entry=0x14f06b815088) at /test/10.5_dbg/sql/sql_parse.cc:3939
            #20 0x0000561ffb2d915c in mysql_parse (thd=thd@entry=0x14f06b815088, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14f08449b350, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7993
            #21 0x0000561ffb2c5c60 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14f06b815088, packet=packet@entry=0x14f06b867089 "SELECT * FROM INFORMATION_SCHEMA.ROUTINES WHERE ROUTINE_NAME='a'", packet_length=packet_length@entry=64, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1874
            #22 0x0000561ffb2c443a in do_command (thd=0x14f06b815088) at /test/10.5_dbg/sql/sql_parse.cc:1355
            #23 0x0000561ffb41fc47 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x14f06e57a808, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1411
            #24 0x0000561ffb420363 in handle_one_connection (arg=arg@entry=0x14f06e57a808) at /test/10.5_dbg/sql/sql_connect.cc:1313
            #25 0x0000561ffb881902 in pfs_spawn_thread (arg=0x14f08b846c88) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201
            #26 0x000014f08daa86db in start_thread (arg=0x14f08449c700) at pthread_create.c:463
            #27 0x000014f08cea688f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            

            Bug confirmed present in:
            MariaDB: 10.3.24 (dbg), 10.4.14 (dbg), 10.5.4 (dbg), 10.5.4 (opt)

            Bug confirmed not present in:
            MariaDB: 10.1.46 (dbg), 10.1.46 (opt), 10.2.33 (dbg), 10.2.33 (opt), 10.3.24 (opt), 10.4.14 (opt)
            MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt)

            10.2 Again affected in different way:

            10.2.37 (Debug)

            10.2.37>SELECT * FROM INFORMATION_SCHEMA.ROUTINES WHERE ROUTINE_NAME='a';
            ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'RETURN NULL' at line 2
            

            Roel Roel Van de Paar added a comment - - edited SET collation_connection=ucs2_general_ci; INSERT INTO mysql.proc (db, name, type, specific_name, language, sql_data_access, is_deterministic, security_type, param_list, returns, body, definer, created, modified, sql_mode, comment, character_set_client, collation_connection, db_collation, body_utf8 ) VALUES ( 'a', 'a', 'FUNCTION', 'bug14233_1', 'SQL', 'READS_SQL_DATA', 'NO', 'DEFINER', '', 'int(10)', 'SELECT * FROM mysql.user', 'root@localhost', NOW(), '0000-00-00 00:00:00', '', '', '', '', '', 'SELECT * FROM mysql.user' ); SELECT * FROM INFORMATION_SCHEMA.ROUTINES WHERE ROUTINE_NAME='a'; Leads to: 10.5.4 4080e3acefd7e58d88c2f3539fb6a0fb359cf057 mysqld: /test/10.5_dbg/sql/sql_string.h:924: bool String::append(const LEX_CSTRING*): Assertion `ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))' failed. 10.5.4 4080e3acefd7e58d88c2f3539fb6a0fb359cf057 Core was generated by `/test/MD150620-mariadb-10.5.4-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'. Program terminated with signal SIGABRT, Aborted. #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57 [Current thread is 1 (Thread 0x14f08449c700 (LWP 1573308))] (gdb) bt #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57 #1 0x0000561ffbdd44c6 in my_write_core (sig=sig@entry=6) at /test/10.5_dbg/mysys/stacktrace.c:518 #2 0x0000561ffb576d60 in handle_fatal_signal (sig=6) at /test/10.5_dbg/sql/signal_handler.cc:330 #3 <signal handler called> #4 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #5 0x000014f08cdc5801 in __GI_abort () at abort.c:79 #6 0x000014f08cdb539a in __assert_fail_base (fmt=0x14f08cf3c7d8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x561ffbf2bda8 "ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))", file=file@entry=0x561ffbf2b678 "/test/10.5_dbg/sql/sql_string.h", line=line@entry=924, function=function@entry=0x561ffc124500 <_ZZN6String6appendEPK25st_mysql_const_lex_stringE19__PRETTY_FUNCTION__> "bool String::append(const LEX_CSTRING*)") at assert.c:92 #7 0x000014f08cdb5412 in __GI___assert_fail (assertion=assertion@entry=0x561ffbf2bda8 "ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))", file=file@entry=0x561ffbf2b678 "/test/10.5_dbg/sql/sql_string.h", line=line@entry=924, function=function@entry=0x561ffc124500 <_ZZN6String6appendEPK25st_mysql_const_lex_stringE19__PRETTY_FUNCTION__> "bool String::append(const LEX_CSTRING*)") at assert.c:101 #8 0x0000561ffb721483 in String::append (ls=0x14f084497280, this=0x14f0844955a0) at /test/10.5_dbg/sql/sql_string.h:922 #9 Sp_handler::show_create_sp (this=this@entry=0x561ffca8ba68 <sp_handler_function>, thd=thd@entry=0x14f06b815088, buf=buf@entry=0x14f0844955a0, db=@0x14f084495600: {str = 0x14f06b903d88 "a", length = 1}, name=@0x14f084495610: {str = 0x14f06b903d90 "a", length = 1}, params=@0x561ffc91b880: {str = 0x561ffc126516 "", length = 0}, returns=@0x14f084497280: {str = 0x14f06b903da8 "", length = 14}, body=@0x14f084495590: {str = 0x561ffc12359b "RETURN NULL", length = 11}, chistics=@0x14f0844955e0: {comment = {str = 0x0, length = 0}, suid = SP_IS_DEFAULT_SUID, detistic = false, daccess = SP_DEFAULT_ACCESS, agg_type = DEFAULT_AGGREGATE}, definer=@0x14f0844955c0: {user = {str = 0x561ffc126516 "", length = 0}, host = {str = 0x561ffc126516 "", length = 0}}, ddl_options={m_options = DDL_options_st::OPT_NONE}, sql_mode=0) at /test/10.5_dbg/sql/sp.cc:2995 #10 0x0000561ffb727c41 in Sp_handler::sp_load_for_information_schema (this=this@entry=0x561ffca8ba68 <sp_handler_function>, thd=thd@entry=0x14f06b815088, proc_table=proc_table@entry=0x14f06b8a2088, db=@0x14f084497250: {str = 0x14f06b903d88 "a", length = 1}, name=@0x14f084497260: {str = 0x14f06b903d90 "a", length = 1}, params=@0x561ffc91b880: {str = 0x561ffc126516 "", length = 0}, returns=@0x14f084497280: {str = 0x14f06b903da8 "", length = 14}, sql_mode=0, free_sp_head=0x14f08449724f) at /test/10.5_dbg/sql/sp.cc:3066 #11 0x0000561ffb373cf3 in store_schema_proc (thd=thd@entry=0x14f06b815088, table=table@entry=0x14f06b8d40a0, proc_table=proc_table@entry=0x14f06b8a2088, wild=wild@entry=0x0, full_access=<optimized out>, full_access@entry=true, sp_user=sp_user@entry=0x14f0844988d0 "root@localhost") at /test/10.5_dbg/sql/sql_show.cc:6430 #12 0x0000561ffb374b19 in fill_schema_proc (thd=0x14f06b815088, tables=<optimized out>, cond=<optimized out>) at /test/10.5_dbg/sql/sql_show.cc:6549 #13 0x0000561ffb37715d in get_schema_tables_result (join=join@entry=0x14f06b876b00, executed_place=executed_place@entry=PROCESSED_BY_JOIN_EXEC) at /test/10.5_dbg/sql/sql_show.cc:8673 #14 0x0000561ffb34a8e1 in JOIN::exec_inner (this=this@entry=0x14f06b876b00) at /test/10.5_dbg/sql/sql_select.cc:4401 #15 0x0000561ffb34b289 in JOIN::exec (this=this@entry=0x14f06b876b00) at /test/10.5_dbg/sql/sql_select.cc:4225 #16 0x0000561ffb34959e in mysql_select (thd=thd@entry=0x14f06b815088, tables=<optimized out>, fields=@0x14f06b8742d8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f06b874738, last = 0x14f06b87a030, elements = 31}, <No data fields>}, conds=0x14f06b875080, og_num=0, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=2684619520, result=0x14f06b876ad8, unit=0x14f06b8190a0, select_lex=0x14f06b874188) at /test/10.5_dbg/sql/sql_select.cc:4649 #17 0x0000561ffb3498cd in handle_select (thd=thd@entry=0x14f06b815088, lex=lex@entry=0x14f06b818fd8, result=result@entry=0x14f06b876ad8, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.5_dbg/sql/sql_select.cc:417 #18 0x0000561ffb2d31ed in execute_sqlcom_select (thd=thd@entry=0x14f06b815088, all_tables=0x14f06b8747a8) at /test/10.5_dbg/sql/sql_parse.cc:6209 #19 0x0000561ffb2cc312 in mysql_execute_command (thd=thd@entry=0x14f06b815088) at /test/10.5_dbg/sql/sql_parse.cc:3939 #20 0x0000561ffb2d915c in mysql_parse (thd=thd@entry=0x14f06b815088, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14f08449b350, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7993 #21 0x0000561ffb2c5c60 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14f06b815088, packet=packet@entry=0x14f06b867089 "SELECT * FROM INFORMATION_SCHEMA.ROUTINES WHERE ROUTINE_NAME='a'", packet_length=packet_length@entry=64, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1874 #22 0x0000561ffb2c443a in do_command (thd=0x14f06b815088) at /test/10.5_dbg/sql/sql_parse.cc:1355 #23 0x0000561ffb41fc47 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x14f06e57a808, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1411 #24 0x0000561ffb420363 in handle_one_connection (arg=arg@entry=0x14f06e57a808) at /test/10.5_dbg/sql/sql_connect.cc:1313 #25 0x0000561ffb881902 in pfs_spawn_thread (arg=0x14f08b846c88) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201 #26 0x000014f08daa86db in start_thread (arg=0x14f08449c700) at pthread_create.c:463 #27 0x000014f08cea688f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Bug confirmed present in: MariaDB: 10.3.24 (dbg), 10.4.14 (dbg), 10.5.4 (dbg), 10.5.4 (opt) Bug confirmed not present in: MariaDB: 10.1.46 (dbg), 10.1.46 (opt), 10.2.33 (dbg), 10.2.33 (opt), 10.3.24 (opt), 10.4.14 (opt) MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt) 10.2 Again affected in different way: 10.2.37 (Debug) 10.2.37>SELECT * FROM INFORMATION_SCHEMA.ROUTINES WHERE ROUTINE_NAME='a'; ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'RETURN NULL' at line 2

            Additional testcase

            SET CHARACTER_SET_CONNECTION=ucs2;
            INSERT INTO mysql.proc (db, name, type, specific_name, language, sql_data_access, is_deterministic, security_type, param_list, returns, body, definer, created, modified, sql_mode, comment, character_set_client, collation_connection, db_collation, body_utf8 ) VALUES ('test','bug14233_1','FUNCTION','bug14233_1','SQL','READS_SQL_DATA','NO','DEFINER','','int(10)','SELECT COUNT(*) FROM mysql.user','root@localhost', NOW() , '0000-00-00 00:00:00','','','','','','SELECT COUNT(*) FROM mysql.user');
            SHOW FUNCTION STATUS WHERE db=DATABASE();
            

            Roel Roel Van de Paar added a comment - Additional testcase SET CHARACTER_SET_CONNECTION=ucs2; INSERT INTO mysql.proc (db, name, type, specific_name, language, sql_data_access, is_deterministic, security_type, param_list, returns, body, definer, created, modified, sql_mode, comment, character_set_client, collation_connection, db_collation, body_utf8 ) VALUES ('test','bug14233_1','FUNCTION','bug14233_1','SQL','READS_SQL_DATA','NO','DEFINER','','int(10)','SELECT COUNT(*) FROM mysql.user','root@localhost', NOW() , '0000-00-00 00:00:00','','','','','','SELECT COUNT(*) FROM mysql.user'); SHOW FUNCTION STATUS WHERE db=DATABASE();
            Roel Roel Van de Paar added a comment - - edited

            Another test:

            SET collation_connection='utf32_bin';
            INSERT INTO mysql.proc (db, name, type, specific_name, language, sql_data_access, is_deterministic, security_type, param_list, returns, body, definer, CREATEd, modified, sql_mode, comment, CHARACTER_SET_client, collation_connection, db_collation, body_utf8) VALUES ('test', 'bug14233_1', 'FUNCTION', 'bug14233_1', 'SQL', 'READS_SQL_DATA', 'NO', 'DEFINER', '', 'INT (10)', 'SELECT COUNT (*) FROM mysql.USEr', 'root@localhost', NOW(), '0000-00-00 00:00:00', '', '', '', '', '', 'SELECT COUNT (*) FROM mysql.USEr'), ('test', 'bug14233_2', 'FUNCTION', 'bug14233_2', 'SQL', 'READS_SQL_DATA', 'NO', 'DEFINER', '', 'INT (10)', 'begin declare x INT; SELECT COUNT (*) INTO x FROM mysql.USEr; end', 'root@localhost', NOW(), '0000-00-00 00:00:00', '', '', '', '', '', 'begin declare x INT; SELECT COUNT (*) INTO x FROM mysql.USEr; end'), ('test', 'bug14233_3', 'PROCEDURE', 'bug14233_3', 'SQL', 'READS_SQL_DATA','NO', 'DEFINER', '', '', 'alksj wpsj sa ^#!@ ', 'root@localhost', NOW(), '0000-00-00 00:00:00', '', '', '', '', '', 'alksj wpsj sa ^#!@ ');
            SELECT SPECIFIC_SCHEMA, SPECIFIC_NAME, PARAMETER_NAME, DATA_TYPE, DATETIME_PRECISION FROM INFORMATION_SCHEMA.PARAMETERS WHERE SPECIFIC_SCHEMA='i_s_parameters_test';
            

            Leads to:

            10.4.18 b2029c0300bf8c311ff5d9fdc4b73a9e48bf6930 (Debug)

            Core was generated by `/test/MD131120-mariadb-10.4.18-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
            Program terminated with signal SIGABRT, Aborted.
            #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
                at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
            [Current thread is 1 (Thread 0x154cf808c700 (LWP 1735101))]
            (gdb) bt
            #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
            #1  0x000055e35ff41c00 in my_write_core (sig=sig@entry=6) at /test/10.4_dbg/mysys/stacktrace.c:386
            #2  0x000055e35f6ca32e in handle_fatal_signal (sig=6) at /test/10.4_dbg/sql/signal_handler.cc:343
            #3  <signal handler called>
            #4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
            #5  0x0000154d0fba18b1 in __GI_abort () at abort.c:79
            #6  0x0000154d0fb9142a in __assert_fail_base (fmt=0x154d0fd18a38 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55e360011aa0 "ls->length < 0xF
            FFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))", file=file@entry=0x55e36000fea8 "/test/10.4_dbg/sql/sql_string.h", line=line@entry=908, fu
            nction=function@entry=0x55e3601f2ec0 <_ZZN6String6appendEPK25st_mysql_const_lex_stringE19__PRETTY_FUNCTION__> "bool String::append(const LEX_CSTRING*)") at assert.c:92
            #7  0x0000154d0fb914a2 in __GI___assert_fail (assertion=assertion@entry=0x55e360011aa0 "ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strl
            en(ls->str))", file=file@entry=0x55e36000fea8 "/test/10.4_dbg/sql/sql_string.h", line=line@entry=908, function=function@entry=0x55e3601f2ec0 <_ZZN6String6appendEPK25st_
            mysql_const_lex_stringE19__PRETTY_FUNCTION__> "bool String::append(const LEX_CSTRING*)") at assert.c:101
            #8  0x000055e35f86b8f6 in String::append (ls=0x154cf8086a10, this=0x154cf8084d60) at /test/10.4_dbg/sql/sql_string.h:906
            #9  Sp_handler::show_create_sp (this=this@entry=0x55e360af2c48 <sp_handler_function>, thd=thd@entry=0x154ca4000d50, buf=buf@entry=0x154cf8084d60, db=@0x154cf8084dc0: {s
            tr = 0x154ca40439f8 "test", length = 4}, name=@0x154cf8084dd0: {str = 0x154ca4043a00 "bug14233_1", length = 10}, params=@0x154cf8086a00: {str = 0x55e3601f4e76 "", lengt
            h = 0}, returns=@0x154cf8086a10: {str = 0x154ca4043a20 "", length = 32}, body=@0x154cf8084d50: {str = 0x55e3601f1f5e "RETURN NULL", length = 11}, chistics=@0x154cf8084d
            a0: {comment = {str = 0x0, length = 0}, suid = SP_IS_DEFAULT_SUID, detistic = false, daccess = SP_DEFAULT_ACCESS, agg_type = DEFAULT_AGGREGATE}, definer=@0x154cf8084d80
            : {user = {str = 0x55e3601f4e76 "", length = 0}, host = {str = 0x55e3601f4e76 "", length = 0}}, ddl_options={m_options = DDL_options_st::OPT_NONE}, sql_mode=0) at /test
            /10.4_dbg/sql/sp.cc:2956
            #10 0x000055e35f871dcf in Sp_handler::sp_load_for_information_schema (this=this@entry=0x55e360af2c48 <sp_handler_function>, thd=thd@entry=0x154ca4000d50, proc_table=pro
            c_table@entry=0x154ca4027210, db=@0x154cf8086a20: {str = 0x154ca40439f8 "test", length = 4}, name=@0x154cf8086a30: {str = 0x154ca4043a00 "bug14233_1", length = 10}, par
            ams=@0x154cf8086a00: {str = 0x55e3601f4e76 "", length = 0}, returns=@0x154cf8086a10: {str = 0x154ca4043a20 "", length = 32}, sql_mode=0, free_sp_head=0x154cf80869ef) at
             /test/10.4_dbg/sql/sp.cc:3028
            #11 0x000055e35f4aaae8 in store_schema_params (thd=thd@entry=0x154ca4000d50, table=table@entry=0x154ca401f528, proc_table=proc_table@entry=0x154ca4027210, wild=wild@ent
            ry=0x0, full_access=<optimized out>, full_access@entry=true, sp_user=sp_user@entry=0x154cf8088270 "root@localhost") at /test/10.4_dbg/sql/sql_show.cc:6379
            #12 0x000055e35f4ac489 in fill_schema_proc (thd=0x154ca4000d50, tables=<optimized out>, cond=<optimized out>) at /test/10.4_dbg/sql/sql_show.cc:6633
            #13 0x000055e35f4b123b in get_schema_tables_result (join=join@entry=0x154ca40152d8, executed_place=executed_place@entry=PROCESSED_BY_JOIN_EXEC) at /test/10.4_dbg/sql/sq
            l_show.cc:8927
            #14 0x000055e35f48f93f in JOIN::exec_inner (this=this@entry=0x154ca40152d8) at /test/10.4_dbg/sql/sql_select.cc:4439
            #15 0x000055e35f4902af in JOIN::exec (this=this@entry=0x154ca40152d8) at /test/10.4_dbg/sql/sql_select.cc:4264
            #16 0x000055e35f48e639 in mysql_select (thd=thd@entry=0x154ca4000d50, tables=<optimized out>, wild_num=0, fields=@0x154ca40121b0: {<base_list> = {<Sql_alloc> = {<No dat
            a fields>}, first = 0x154ca40125f0, last = 0x154ca4012ab8, elements = 5}, <No data fields>}, conds=0x154ca40134f0, og_num=<optimized out>, order=0x0, group=0x0, having=
            0x0, proc_param=0x0, select_options=2684619520, result=0x154ca40152b0, unit=0x154ca4004c80, select_lex=0x154ca4012068) at /test/10.4_dbg/sql/sql_select.cc:4699
            #17 0x000055e35f48e964 in handle_select (thd=thd@entry=0x154ca4000d50, lex=lex@entry=0x154ca4004bc0, result=result@entry=0x154ca40152b0, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.4_dbg/sql/sql_select.cc:410
            #18 0x000055e35f406bbc in execute_sqlcom_select (thd=thd@entry=0x154ca4000d50, all_tables=0x154ca4012b28) at /test/10.4_dbg/sql/sql_parse.cc:6400
            #19 0x000055e35f41203b in mysql_execute_command (thd=thd@entry=0x154ca4000d50) at /test/10.4_dbg/sql/sql_parse.cc:3925
            #20 0x000055e35f41cabf in mysql_parse (thd=thd@entry=0x154ca4000d50, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x154cf808b4a0, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_parse.cc:7938
            #21 0x000055e35f41f337 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x154ca4000d50, packet=packet@entry=0x154ca401a231 "SELECT SPECIFIC_SCHEMA, SPECIFIC_NAME, PARAMETER_NAME, DATA_TYPE, DATETIME_PRECISION FROM INFORMATION_SCHEMA.PARAMETERS WHERE SPECIFIC_SCHEMA='i_s_parameters_test'", packet_length=packet_length@entry=163, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_parse.cc:1839
            #22 0x000055e35f422d72 in do_command (thd=0x154ca4000d50) at /test/10.4_dbg/sql/sql_parse.cc:1357
            #23 0x000055e35f5515b6 in do_handle_one_connection (connect=connect@entry=0x55e362477ef0) at /test/10.4_dbg/sql/sql_connect.cc:1412
            #24 0x000055e35f5516d6 in handle_one_connection (arg=0x55e362477ef0) at /test/10.4_dbg/sql/sql_connect.cc:1316
            #25 0x0000154d10b086db in start_thread (arg=0x154cf808c700) at pthread_create.c:463
            #26 0x0000154d0fc82a3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            

            Bug confirmed present in:
            MariaDB: 10.3.28 (dbg), 10.4.18 (dbg), 10.5.9 (dbg), 10.6.0 (dbg)

            Bug confirmed not present in:
            MariaDB: 10.1.49 (dbg), 10.1.49 (opt), 10.2.37 (dbg), 10.2.37 (opt), 10.3.28 (opt), 10.4.18 (opt), 10.5.9 (opt), 10.6.0 (opt)

            10.2 Also affected in a different way:

            10.2.37 (Debug)

            10.2.37>SELECT SPECIFIC_SCHEMA, SPECIFIC_NAME, PARAMETER_NAME, DATA_TYPE, DATETIME_PRECISION FROM INFORMATION_SCHEMA.PARAMETERS WHERE SPECIFIC_SCHEMA='i_s_parameters_test';
            ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'RETURN NULL' at line 2
            

            Roel Roel Van de Paar added a comment - - edited Another test: SET collation_connection='utf32_bin'; INSERT INTO mysql.proc (db, name, type, specific_name, language, sql_data_access, is_deterministic, security_type, param_list, returns, body, definer, CREATEd, modified, sql_mode, comment, CHARACTER_SET_client, collation_connection, db_collation, body_utf8) VALUES ('test', 'bug14233_1', 'FUNCTION', 'bug14233_1', 'SQL', 'READS_SQL_DATA', 'NO', 'DEFINER', '', 'INT (10)', 'SELECT COUNT (*) FROM mysql.USEr', 'root@localhost', NOW(), '0000-00-00 00:00:00', '', '', '', '', '', 'SELECT COUNT (*) FROM mysql.USEr'), ('test', 'bug14233_2', 'FUNCTION', 'bug14233_2', 'SQL', 'READS_SQL_DATA', 'NO', 'DEFINER', '', 'INT (10)', 'begin declare x INT; SELECT COUNT (*) INTO x FROM mysql.USEr; end', 'root@localhost', NOW(), '0000-00-00 00:00:00', '', '', '', '', '', 'begin declare x INT; SELECT COUNT (*) INTO x FROM mysql.USEr; end'), ('test', 'bug14233_3', 'PROCEDURE', 'bug14233_3', 'SQL', 'READS_SQL_DATA','NO', 'DEFINER', '', '', 'alksj wpsj sa ^#!@ ', 'root@localhost', NOW(), '0000-00-00 00:00:00', '', '', '', '', '', 'alksj wpsj sa ^#!@ '); SELECT SPECIFIC_SCHEMA, SPECIFIC_NAME, PARAMETER_NAME, DATA_TYPE, DATETIME_PRECISION FROM INFORMATION_SCHEMA.PARAMETERS WHERE SPECIFIC_SCHEMA='i_s_parameters_test'; Leads to: 10.4.18 b2029c0300bf8c311ff5d9fdc4b73a9e48bf6930 (Debug) Core was generated by `/test/MD131120-mariadb-10.4.18-linux-x86_64-dbg/bin/mysqld --no-defaults --core'. Program terminated with signal SIGABRT, Aborted. #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57 [Current thread is 1 (Thread 0x154cf808c700 (LWP 1735101))] (gdb) bt #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57 #1 0x000055e35ff41c00 in my_write_core (sig=sig@entry=6) at /test/10.4_dbg/mysys/stacktrace.c:386 #2 0x000055e35f6ca32e in handle_fatal_signal (sig=6) at /test/10.4_dbg/sql/signal_handler.cc:343 #3 <signal handler called> #4 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #5 0x0000154d0fba18b1 in __GI_abort () at abort.c:79 #6 0x0000154d0fb9142a in __assert_fail_base (fmt=0x154d0fd18a38 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55e360011aa0 "ls->length < 0xF FFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))", file=file@entry=0x55e36000fea8 "/test/10.4_dbg/sql/sql_string.h", line=line@entry=908, fu nction=function@entry=0x55e3601f2ec0 <_ZZN6String6appendEPK25st_mysql_const_lex_stringE19__PRETTY_FUNCTION__> "bool String::append(const LEX_CSTRING*)") at assert.c:92 #7 0x0000154d0fb914a2 in __GI___assert_fail (assertion=assertion@entry=0x55e360011aa0 "ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strl en(ls->str))", file=file@entry=0x55e36000fea8 "/test/10.4_dbg/sql/sql_string.h", line=line@entry=908, function=function@entry=0x55e3601f2ec0 <_ZZN6String6appendEPK25st_ mysql_const_lex_stringE19__PRETTY_FUNCTION__> "bool String::append(const LEX_CSTRING*)") at assert.c:101 #8 0x000055e35f86b8f6 in String::append (ls=0x154cf8086a10, this=0x154cf8084d60) at /test/10.4_dbg/sql/sql_string.h:906 #9 Sp_handler::show_create_sp (this=this@entry=0x55e360af2c48 <sp_handler_function>, thd=thd@entry=0x154ca4000d50, buf=buf@entry=0x154cf8084d60, db=@0x154cf8084dc0: {s tr = 0x154ca40439f8 "test", length = 4}, name=@0x154cf8084dd0: {str = 0x154ca4043a00 "bug14233_1", length = 10}, params=@0x154cf8086a00: {str = 0x55e3601f4e76 "", lengt h = 0}, returns=@0x154cf8086a10: {str = 0x154ca4043a20 "", length = 32}, body=@0x154cf8084d50: {str = 0x55e3601f1f5e "RETURN NULL", length = 11}, chistics=@0x154cf8084d a0: {comment = {str = 0x0, length = 0}, suid = SP_IS_DEFAULT_SUID, detistic = false, daccess = SP_DEFAULT_ACCESS, agg_type = DEFAULT_AGGREGATE}, definer=@0x154cf8084d80 : {user = {str = 0x55e3601f4e76 "", length = 0}, host = {str = 0x55e3601f4e76 "", length = 0}}, ddl_options={m_options = DDL_options_st::OPT_NONE}, sql_mode=0) at /test /10.4_dbg/sql/sp.cc:2956 #10 0x000055e35f871dcf in Sp_handler::sp_load_for_information_schema (this=this@entry=0x55e360af2c48 <sp_handler_function>, thd=thd@entry=0x154ca4000d50, proc_table=pro c_table@entry=0x154ca4027210, db=@0x154cf8086a20: {str = 0x154ca40439f8 "test", length = 4}, name=@0x154cf8086a30: {str = 0x154ca4043a00 "bug14233_1", length = 10}, par ams=@0x154cf8086a00: {str = 0x55e3601f4e76 "", length = 0}, returns=@0x154cf8086a10: {str = 0x154ca4043a20 "", length = 32}, sql_mode=0, free_sp_head=0x154cf80869ef) at /test/10.4_dbg/sql/sp.cc:3028 #11 0x000055e35f4aaae8 in store_schema_params (thd=thd@entry=0x154ca4000d50, table=table@entry=0x154ca401f528, proc_table=proc_table@entry=0x154ca4027210, wild=wild@ent ry=0x0, full_access=<optimized out>, full_access@entry=true, sp_user=sp_user@entry=0x154cf8088270 "root@localhost") at /test/10.4_dbg/sql/sql_show.cc:6379 #12 0x000055e35f4ac489 in fill_schema_proc (thd=0x154ca4000d50, tables=<optimized out>, cond=<optimized out>) at /test/10.4_dbg/sql/sql_show.cc:6633 #13 0x000055e35f4b123b in get_schema_tables_result (join=join@entry=0x154ca40152d8, executed_place=executed_place@entry=PROCESSED_BY_JOIN_EXEC) at /test/10.4_dbg/sql/sq l_show.cc:8927 #14 0x000055e35f48f93f in JOIN::exec_inner (this=this@entry=0x154ca40152d8) at /test/10.4_dbg/sql/sql_select.cc:4439 #15 0x000055e35f4902af in JOIN::exec (this=this@entry=0x154ca40152d8) at /test/10.4_dbg/sql/sql_select.cc:4264 #16 0x000055e35f48e639 in mysql_select (thd=thd@entry=0x154ca4000d50, tables=<optimized out>, wild_num=0, fields=@0x154ca40121b0: {<base_list> = {<Sql_alloc> = {<No dat a fields>}, first = 0x154ca40125f0, last = 0x154ca4012ab8, elements = 5}, <No data fields>}, conds=0x154ca40134f0, og_num=<optimized out>, order=0x0, group=0x0, having= 0x0, proc_param=0x0, select_options=2684619520, result=0x154ca40152b0, unit=0x154ca4004c80, select_lex=0x154ca4012068) at /test/10.4_dbg/sql/sql_select.cc:4699 #17 0x000055e35f48e964 in handle_select (thd=thd@entry=0x154ca4000d50, lex=lex@entry=0x154ca4004bc0, result=result@entry=0x154ca40152b0, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.4_dbg/sql/sql_select.cc:410 #18 0x000055e35f406bbc in execute_sqlcom_select (thd=thd@entry=0x154ca4000d50, all_tables=0x154ca4012b28) at /test/10.4_dbg/sql/sql_parse.cc:6400 #19 0x000055e35f41203b in mysql_execute_command (thd=thd@entry=0x154ca4000d50) at /test/10.4_dbg/sql/sql_parse.cc:3925 #20 0x000055e35f41cabf in mysql_parse (thd=thd@entry=0x154ca4000d50, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x154cf808b4a0, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_parse.cc:7938 #21 0x000055e35f41f337 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x154ca4000d50, packet=packet@entry=0x154ca401a231 "SELECT SPECIFIC_SCHEMA, SPECIFIC_NAME, PARAMETER_NAME, DATA_TYPE, DATETIME_PRECISION FROM INFORMATION_SCHEMA.PARAMETERS WHERE SPECIFIC_SCHEMA='i_s_parameters_test'", packet_length=packet_length@entry=163, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_parse.cc:1839 #22 0x000055e35f422d72 in do_command (thd=0x154ca4000d50) at /test/10.4_dbg/sql/sql_parse.cc:1357 #23 0x000055e35f5515b6 in do_handle_one_connection (connect=connect@entry=0x55e362477ef0) at /test/10.4_dbg/sql/sql_connect.cc:1412 #24 0x000055e35f5516d6 in handle_one_connection (arg=0x55e362477ef0) at /test/10.4_dbg/sql/sql_connect.cc:1316 #25 0x0000154d10b086db in start_thread (arg=0x154cf808c700) at pthread_create.c:463 #26 0x0000154d0fc82a3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Bug confirmed present in: MariaDB: 10.3.28 (dbg), 10.4.18 (dbg), 10.5.9 (dbg), 10.6.0 (dbg) Bug confirmed not present in: MariaDB: 10.1.49 (dbg), 10.1.49 (opt), 10.2.37 (dbg), 10.2.37 (opt), 10.3.28 (opt), 10.4.18 (opt), 10.5.9 (opt), 10.6.0 (opt) 10.2 Also affected in a different way: 10.2.37 (Debug) 10.2.37>SELECT SPECIFIC_SCHEMA, SPECIFIC_NAME, PARAMETER_NAME, DATA_TYPE, DATETIME_PRECISION FROM INFORMATION_SCHEMA.PARAMETERS WHERE SPECIFIC_SCHEMA='i_s_parameters_test'; ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'RETURN NULL' at line 2

            Unique bugID's seen so far

            ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))|SIGABRT|String::append|Sp_handler::show_create_sp|Sp_handler::sp_load_for_information_schema|store_schema_params
            ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))|SIGABRT|String::append|Sp_handler::show_create_sp|Sp_handler::sp_load_for_information_schema|store_schema_proc
            

            Roel Roel Van de Paar added a comment - Unique bugID's seen so far ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))|SIGABRT|String::append|Sp_handler::show_create_sp|Sp_handler::sp_load_for_information_schema|store_schema_params ls->length < 0xFFFFFFFFL && ((ls->length == 0 && !ls->str) || ls->length == strlen(ls->str))|SIGABRT|String::append|Sp_handler::show_create_sp|Sp_handler::sp_load_for_information_schema|store_schema_proc

            Thank you serg for the quick fix

            Roel Roel Van de Paar added a comment - Thank you serg for the quick fix

            People

              serg Sergei Golubchik
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.