Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-26349

BUG: Abortion in sql/sql_show.cc:9239

Details

    • Bug
    • Status: Closed (View Workflow)
    • Critical
    • Resolution: Cannot Reproduce
    • 10.5.9
    • N/A
    • Optimizer - CTE
    • Ubuntu 18.04
      MariaDB 10.5.9

    Description

      I used my fuzzing tool to test Mariadb , and found a bug that can result in an abortion.

      Mariadb installation：
      1) cd mariadb-10.5.9
      2) mkdir build; cd build
      3) cmake -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DCMAKE_BUILD_TYPE=Debug ../
      4) make -j8 && sudo make install

      How to Repeat:
      export ASAN_OPTIONS=detect_leaks=0
      /usr/local/mysql/bin/mysqld_safe &
      /usr/local/mysql/bin/mysql -uroot -p123456(your password)
      MariaDB> drop database if exists test_db;
      MariaDB> create database test_db;
      MariaDB> use test_db;
      MariaDB> source fuzz.sql;

      I have simplified the content of fuzz.sql, and I hope fuzz.sql can help you reproduce the bug and fix it. In addition, I attach the failure report (which has its stack trace).

      Attachments

        1. fuzz.sql
          2 kB
        2. report.txt
          7 kB

        Activity

          Ascending order - Click to sort in descending order
          danblack Daniel Black added a comment -

          Failed to reproduce on:

          10.5.13-0268b871228

          		 
          CMakeCache.txt:WITH_ASAN:BOOL=ON
          		 
          CMakeCache.txt:WITH_ASAN_SCOPE:BOOL=ON
          		 
          CMAKE_CXX_COMPILER:STRING=/usr/lib64/ccache/clang++
          		 
          CMAKE_C_COMPILER:STRING=/usr/lib64/ccache/clang
          		 
          CMAKE_BUILD_TYPE:STRING=RelWithDebInfo
          		 
           
          		 
          $ /usr/lib64/ccache/clang++ --version
          		 
          clang version 12.0.0 (Fedora 12.0.0-2.fc34)
          		 
          Target: x86_64-unknown-linux-gnu
          		 
          Thread model: posix
          		 
          InstalledDir: /usr/bin

          CMAKE_BUILD_TYPE=Debug

          		 
          MariaDB [test_db]> create or replace database  test_db;
          		 
          Query OK, 2 rows affected (0.012 sec)
          		 
           
          		 
          MariaDB [test_db]> use test_db;
          		 
          Database changed
          		 
          MariaDB [test_db]> select version();
          		 
          +-----------------------+
          		 
          | version()             |
          		 
          +-----------------------+
          		 
          | 10.5.13-MariaDB-debug |
          		 
          +-----------------------+
          		 
          1 row in set (0.001 sec)
          		 
           
          		 
          MariaDB [test_db]> source ~/Downloads/fuzz-MDEV-26349.sql
          		 
          Query OK, 0 rows affected (0.006 sec)
          		 
           
          		 
          Query OK, 2 rows affected (0.002 sec)
          		 
          Records: 2  Duplicates: 0  Warnings: 0
          		 
           
          		 
          +------+----+------+------+------+------+----+----+----+----+-----+
          		 
          | c0   | c1 | c2   | c3   | c4   | c5   | c6 | c7 | c8 | c9 | c10 |
          		 
          +------+----+------+------+------+------+----+----+----+----+-----+
          		 
          |   75 | 75 | NULL |   75 |    2 |   11 | 75 | 75 | 75 | 75 |  75 |
          		 
          |   90 | 90 | NULL |   90 |    2 |   11 | 90 | 90 | 90 | 90 |  90 |
          		 
          +------+----+------+------+------+------+----+----+----+----+-----+
          		 
          2 rows in set (0.007 sec)
          		 
           
          		 
          MariaDB [test_db]>

          danblack Daniel Black added a comment - Failed to reproduce on: 10.5.13-0268b871228 CMakeCache.txt:WITH_ASAN:BOOL=ON CMakeCache.txt:WITH_ASAN_SCOPE:BOOL=ON CMAKE_CXX_COMPILER:STRING=/usr/lib64/ccache/clang++ CMAKE_C_COMPILER:STRING=/usr/lib64/ccache/clang CMAKE_BUILD_TYPE:STRING=RelWithDebInfo   $ /usr/lib64/ccache/clang++ --version clang version 12.0.0 (Fedora 12.0.0-2.fc34) Target: x86_64-unknown-linux-gnu Thread model: posix InstalledDir: /usr/bin CMAKE_BUILD_TYPE=Debug MariaDB [test_db]> create or replace database test_db; Query OK, 2 rows affected (0.012 sec)   MariaDB [test_db]> use test_db; Database changed MariaDB [test_db]> select version(); +-----------------------+ | version() | +-----------------------+ | 10.5.13-MariaDB-debug | +-----------------------+ 1 row in set (0.001 sec)   MariaDB [test_db]> source ~/Downloads/fuzz-MDEV-26349.sql Query OK, 0 rows affected (0.006 sec)   Query OK, 2 rows affected (0.002 sec) Records: 2 Duplicates: 0 Warnings: 0   +------+----+------+------+------+------+----+----+----+----+-----+ | c0 | c1 | c2 | c3 | c4 | c5 | c6 | c7 | c8 | c9 | c10 | +------+----+------+------+------+------+----+----+----+----+-----+ | 75 | 75 | NULL | 75 | 2 | 11 | 75 | 75 | 75 | 75 | 75 | | 90 | 90 | NULL | 90 | 2 | 11 | 90 | 90 | 90 | 90 | 90 | +------+----+------+------+------+------+----+----+----+----+-----+ 2 rows in set (0.007 sec)   MariaDB [test_db]>
          danblack Daniel Black added a comment -

          also checked 10.2.41, 10.3.32, 10.4.42 latest as of today and couldn't reproduce segfault on non-debug versions.

          danblack Daniel Black added a comment - also checked 10.2.41, 10.3.32, 10.4.42 latest as of today and couldn't reproduce segfault on non-debug versions.

          People

            danblack Daniel Black
            Zuming Jiang Zuming Jiang
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.