Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-27081

UBSAN: runtime error: null pointer passed as argument 2, which is declared to never be null in sql/filesort.cc

    XMLWordPrintable

    Details

      Description

      SELECT HOST,USER,PASSWORD FROM mysql.user ORDER BY HOST,USER,PASSWORD;
      

      Leads to:

      10.8.0 5566cbadb03856aba9c236b131f544490cd2bee4 (Debug)

      /test/10.8_dbg_san/sql/filesort.cc:2992:9: runtime error: null pointer passed as argument 2, which is declared to never be null
      

      10.8.0 5566cbadb03856aba9c236b131f544490cd2bee4 (Debug)

          #0 0x5584fd7c9b20 in SORT_FIELD_ATTR::pack_sort_string(unsigned char*, Binary_string const*, charset_info_st const*) const /test/10.8_dbg_san/sql/filesort.cc:2992
          #1 0x5584fd7cada7 in Type_handler_string_result::make_packed_sort_key_part(unsigned char*, Item*, SORT_FIELD_ATTR const*, Sort_param*) const /test/10.8_dbg_san/sql/filesort.cc:2610
          #2 0x5584fd7bf3c4 in make_packed_sortkey /test/10.8_dbg_san/sql/filesort.cc:3089
          #3 0x5584fd7bf3c4 in make_sortkey /test/10.8_dbg_san/sql/filesort.cc:1362
          #4 0x5584fd7d54d2 in find_all_keys /test/10.8_dbg_san/sql/filesort.cc:978
          #5 0x5584fd7d54d2 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /test/10.8_dbg_san/sql/filesort.cc:357
          #6 0x5584fc349deb in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /test/10.8_dbg_san/sql/sql_select.cc:24403
          #7 0x5584fc34b7f2 in st_join_table::sort_table() /test/10.8_dbg_san/sql/sql_select.cc:22077
          #8 0x5584fc34c2a2 in join_init_read_record(st_join_table*) /test/10.8_dbg_san/sql/sql_select.cc:22016
          #9 0x5584fc28cdb0 in sub_select(JOIN*, st_join_table*, bool) /test/10.8_dbg_san/sql/sql_select.cc:21062
          #10 0x5584fc45d98f in do_select /test/10.8_dbg_san/sql/sql_select.cc:20612
          #11 0x5584fc45d98f in JOIN::exec_inner() /test/10.8_dbg_san/sql/sql_select.cc:4735
          #12 0x5584fc45f2c0 in JOIN::exec() /test/10.8_dbg_san/sql/sql_select.cc:4513
          #13 0x5584fc44ee4f in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.8_dbg_san/sql/sql_select.cc:4993
          #14 0x5584fc4507b4 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.8_dbg_san/sql/sql_select.cc:545
          #15 0x5584fbfc0b4c in execute_sqlcom_select /test/10.8_dbg_san/sql/sql_parse.cc:6253
          #16 0x5584fc02615e in mysql_execute_command(THD*, bool) /test/10.8_dbg_san/sql/sql_parse.cc:3944
          #17 0x5584fbf889f6 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.8_dbg_san/sql/sql_parse.cc:8028
          #18 0x5584fbffdfd8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.8_dbg_san/sql/sql_parse.cc:1894
          #19 0x5584fc014a3c in do_command(THD*, bool) /test/10.8_dbg_san/sql/sql_parse.cc:1402
          #20 0x5584fcacf4f5 in do_handle_one_connection(CONNECT*, bool) /test/10.8_dbg_san/sql/sql_connect.cc:1418
          #21 0x5584fcad238f in handle_one_connection /test/10.8_dbg_san/sql/sql_connect.cc:1312
          #22 0x5584fefbe990 in pfs_spawn_thread /test/10.8_dbg_san/storage/perfschema/pfs.cc:2201
          #23 0x154d59572608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
          #24 0x154d587e8292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
      

      10.8.0 5566cbadb03856aba9c236b131f544490cd2bee4 (Optimized)

          #0 0x55d3a951f964 in SORT_FIELD_ATTR::pack_sort_string(unsigned char*, Binary_string const*, charset_info_st const*) const /test/10.8_opt_san/sql/filesort.cc:2992
          #1 0x55d3ab5ecd9b in make_packed_sortkey /test/10.8_opt_san/sql/filesort.cc:3089
          #2 0x55d3ab5ecd9b in make_sortkey /test/10.8_opt_san/sql/filesort.cc:1362
          #3 0x55d3ab5fa517 in find_all_keys /test/10.8_opt_san/sql/filesort.cc:978
          #4 0x55d3ab5fa517 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /test/10.8_opt_san/sql/filesort.cc:357
          #5 0x55d3aa498f69 in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /test/10.8_opt_san/sql/sql_select.cc:24403
          #6 0x55d3aa49ab1f in st_join_table::sort_table() /test/10.8_opt_san/sql/sql_select.cc:22077
          #7 0x55d3aa49b16c in join_init_read_record(st_join_table*) /test/10.8_opt_san/sql/sql_select.cc:22016
          #8 0x55d3aa4076c5 in sub_select(JOIN*, st_join_table*, bool) /test/10.8_opt_san/sql/sql_select.cc:21062
          #9 0x55d3aa5aa289 in do_select /test/10.8_opt_san/sql/sql_select.cc:20612
          #10 0x55d3aa5aa289 in JOIN::exec_inner() /test/10.8_opt_san/sql/sql_select.cc:4735
          #11 0x55d3aa5ae999 in JOIN::exec() /test/10.8_opt_san/sql/sql_select.cc:4513
          #12 0x55d3aa59d351 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.8_opt_san/sql/sql_select.cc:4993
          #13 0x55d3aa5a1263 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.8_opt_san/sql/sql_select.cc:545
          #14 0x55d3aa1c345f in execute_sqlcom_select /test/10.8_opt_san/sql/sql_parse.cc:6253
          #15 0x55d3aa2036ab in mysql_execute_command(THD*, bool) /test/10.8_opt_san/sql/sql_parse.cc:3944
          #16 0x55d3aa192e28 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.8_opt_san/sql/sql_parse.cc:8028
          #17 0x55d3aa1e8bb9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.8_opt_san/sql/sql_parse.cc:1894
          #18 0x55d3aa1f4412 in do_command(THD*, bool) /test/10.8_opt_san/sql/sql_parse.cc:1402
          #19 0x55d3aaac05ed in do_handle_one_connection(CONNECT*, bool) /test/10.8_opt_san/sql/sql_connect.cc:1418
          #20 0x55d3aaac30e4 in handle_one_connection /test/10.8_opt_san/sql/sql_connect.cc:1312
          #21 0x55d3acb40461 in pfs_spawn_thread /test/10.8_opt_san/storage/perfschema/pfs.cc:2201
          #22 0x148b0abe2608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
          #23 0x148b09e58292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
      

      Setup:

      Compiled with GCC >=7.5.0 (I use GCC 9.3.0) and:
          -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON
      Set before execution:
          export UBSAN_OPTIONS=print_stacktrace=1
      

      Bug confirmed present in:
      MariaDB: 10.5.14 (dbg), 10.5.14 (opt), 10.6.6 (dbg), 10.6.6 (opt), 10.7.2 (dbg), 10.7.2 (opt), 10.8.0 (dbg), 10.8.0 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.2.42 (dbg), 10.2.42 (opt), 10.3.33 (dbg), 10.3.33 (opt), 10.4.23 (dbg), 10.4.23 (opt)

        Attachments

          Activity

            People

            Assignee:
            sanja Oleksandr Byelkin
            Reporter:
            Roel Roel Van de Paar
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:

                Git Integration