Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-26351

segfault - (MARIA_HA *) 0x0 in ha_maria::extra

Details

    Description

      I used my fuzzing tool to test Mariadb , and found a bug that can result in an abortion.

      Mariadb installation：
      1) cd mariadb-10.5.9
      2) mkdir build; cd build
      3) cmake -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DCMAKE_BUILD_TYPE=Debug ../
      4) make -j8 && sudo make install

      How to Repeat:
      export ASAN_OPTIONS=detect_leaks=0
      /usr/local/mysql/bin/mysqld_safe &
      /usr/local/mysql/bin/mysql -uroot -p123456(your password)
      MariaDB> drop database if exists test_db;
      MariaDB> create database test_db;
      MariaDB> use test_db;
      MariaDB> source fuzz.sql;

      I have simplified the content of fuzz.sql, and I hope fuzz.sql can help you reproduce the bug and fix it. In addition, I attach the failure report (which has its stack trace).

      This bug looks similar to MDEV-25787, but their stack trace are totally different in my report. I hope you can judge whether they are different bugs.

      Attachments

        1. fuzz.sql
          91 kB
        2. report.txt
          72 kB

        Issue Links

          duplicates

          Bug - A problem which impairs or prevents the functions of the product. MDEV-25787 Bug report: crash on SELECT DISTINCT thousands_blob_fields

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          links to

          Web Link CVE-2021-46663

          Activity

            Ascending order - Click to sort in descending order
            Zuming Jiang Zuming Jiang created issue -
            danblack Daniel Black made changes -
            Field Original Value New Value
            Affects Version/s 10.5.13 [ 26026 ]
            danblack Daniel Black made changes -
            Fix Version/s 10.5 [ 23123 ]
            danblack Daniel Black made changes -
            Component/s Data Definition - Create Table [ 14503 ]
            Component/s Storage Engine - Aria [ 10126 ]
            danblack Daniel Black made changes -
            Summary BUG: Abortion in sql/sql_partition.cc:7211 segfault - (MARIA_HA *) 0x0 in
            danblack Daniel Black made changes -
            Summary segfault - (MARIA_HA *) 0x0 in segfault - (MARIA_HA *) 0x0 in ha_maria::extra
            danblack Daniel Black made changes -
            Affects Version/s 10.2.41 [ 26032 ]
            danblack Daniel Black made changes -
            Affects Version/s 10.3.32 [ 26029 ]
            Affects Version/s 10.4.22 [ 26031 ]
            serg Sergei Golubchik made changes -
            Priority Critical [ 2 ] Major [ 3 ]
            serg Sergei Golubchik made changes -
            Assignee Sergei Petrunia [ psergey ]
            serg Sergei Golubchik made changes -
            Workflow MariaDB v3 [ 124261 ] MariaDB v4 [ 143083 ]
            serg Sergei Golubchik made changes -
            serg Sergei Golubchik made changes -
            Priority Major [ 3 ] Blocker [ 1 ]
            serg Sergei Golubchik made changes -
            Assignee Sergei Petrunia [ psergey ] Sergei Golubchik [ serg ]
            serg Sergei Golubchik made changes -
            Status Open [ 1 ] In Progress [ 3 ]
            serg Sergei Golubchik made changes -
            Comment [ I cannot repeat it on 10.5.9 nor on the latest 10.5 ]
            serg Sergei Golubchik made changes -
            Status In Progress [ 3 ] Stalled [ 10000 ]
            serg Sergei Golubchik made changes -
            Status Stalled [ 10000 ] In Testing [ 10301 ]
            serg Sergei Golubchik made changes -
            serg Sergei Golubchik made changes -
            Fix Version/s 10.2.43 [ 26804 ]
            Fix Version/s 10.3.34 [ 26806 ]
            Fix Version/s 10.4.24 [ 26808 ]
            Fix Version/s 10.5.15 [ 26810 ]
            Fix Version/s 10.6.7 [ 26812 ]
            Fix Version/s 10.7.3 [ 26814 ]
            Fix Version/s 10.5 [ 23123 ]
            serg Sergei Golubchik made changes -
            Resolution Fixed [ 1 ]
            Status In Testing [ 10301 ] Closed [ 6 ]

            People

              serg Sergei Golubchik
              Zuming Jiang Zuming Jiang
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.