Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-30051

SIGSEGV in Item_equal_iterator or Field::eq on SELECT, UBSAN: member call on address X which does not point to an object of type 'Item_equal' in sql/item_cmpfunc.cc and other UBSAN issues

    XMLWordPrintable

    Details

      Description

      CREATE TABLE t(c INT) ENGINE=InnoDB;
      SELECT * FROM t AS v NATURAL JOIN t AS w GROUP BY c HAVING c AND(SELECT (c=1 AND (((1 +''/ 0) AND ''=FALSE) OR c='')));
      

      Leads to:

      10.11.2 8283948846740a22f96bbe7bccf250708406d5d9 (Debug)

      Core was generated by `/test/MD171122-mariadb-10.11.2-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  Item_equal_iterator<List_iterator_fast, Item>::get_curr_field (
          this=<synthetic pointer>) at /test/10.11_dbg/sql/item_cmpfunc.h:3479
      3479	  Field *get_curr_field()
      [Current thread is 1 (Thread 0x152d58668700 (LWP 212884))]
      (gdb) bt
      #0  Item_equal_iterator<List_iterator_fast, Item>::get_curr_field (this=<synthetic pointer>) at /test/10.11_dbg/sql/item_cmpfunc.h:3479
      #1  Item_equal::contains (this=this@entry=0x152d1802a320, field=0x152d1801ccb8) at /test/10.11_dbg/sql/item_cmpfunc.cc:6874
      #2  0x000056430ab69dbb in Item_equal::merge_with_check (this=this@entry=0x152d1802a320, thd=thd@entry=0x152d18000d48, item=item@entry=0x152d18029dd8, save_merged=save_merged@entry=true) at /test/10.11_dbg/sql/item_cmpfunc.h:3479
      #3  0x000056430ab6a081 in Item_equal::merge_into_list (this=0x152d18029dd8, thd=thd@entry=0x152d18000d48, list=list@entry=0x152d18016618, save_merged=save_merged@entry=true, only_intersected=only_intersected@entry=true) at /test/10.11_dbg/sql/item_cmpfunc.cc:7017
      #4  0x000056430a88b5e9 in propagate_new_equalities (thd=0x152d18000d48, cond=0x152d18016538, new_equalities=0x152d1802a768, inherited=0x152d1802a758, is_simplifiable_cond=0x152d5866668f) at /test/10.11_dbg/sql/sql_select.cc:18270
      #5  0x000056430a88b65a in propagate_new_equalities (thd=thd@entry=0x152d18000d48, cond=cond@entry=0x152d1802a688, new_equalities=0x152d1802a768, inherited=inherited@entry=0x0, is_simplifiable_cond=is_simplifiable_cond@entry=0x152d5866668f) at /test/10.11_dbg/sql/sql_select.cc:18291
      #6  0x000056430a9e7c11 in and_new_conditions_to_optimized_cond (thd=0x152d18000d48, cond=0x152d1802a688, cond_eq=cond_eq@entry=0x152d18027f08, new_conds=@0x152d180133c8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x152d1802a558, last = 0x152d1802a568, elements = 2}, <No data fields>}, cond_value=cond_value@entry=0x152d18027de0) at /test/10.11_dbg/sql/opt_subselect.cc:6122
      #7  0x000056430a8b72fa in JOIN::optimize_inner (this=this@entry=0x152d18027a58) at /test/10.11_dbg/sql/sql_select.cc:2295
      #8  0x000056430a8b7e45 in JOIN::optimize (this=this@entry=0x152d18027a58) at /test/10.11_dbg/sql/sql_select.cc:1871
      #9  0x000056430a8b7f35 in mysql_select (thd=thd@entry=0x152d18000d48, tables=0x152d18013850, fields=@0x152d18013508: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x152d180137f8, last = 0x152d180137f8, elements = 1}, <No data fields>}, conds=0x0, og_num=1, order=0x0, group=0x152d18014fd8, having=0x152d18026f90, proc_param=0x0, select_options=2164525824, result=0x152d18027a30, unit=0x152d18004f88, select_lex=0x152d18013268) at /test/10.11_dbg/sql/sql_select.cc:5067
      #10 0x000056430a8b86fb in handle_select (thd=thd@entry=0x152d18000d48, lex=lex@entry=0x152d18004eb0, result=result@entry=0x152d18027a30, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.11_dbg/sql/sql_select.cc:581
      #11 0x000056430a82617f in execute_sqlcom_select (thd=thd@entry=0x152d18000d48, all_tables=0x152d18013850) at /test/10.11_dbg/sql/sql_parse.cc:6263
      #12 0x000056430a8322a1 in mysql_execute_command (thd=thd@entry=0x152d18000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:3947
      #13 0x000056430a820606 in mysql_parse (thd=thd@entry=0x152d18000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x152d58667300) at /test/10.11_dbg/sql/sql_parse.cc:7998
      #14 0x000056430a82db41 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x152d18000d48, packet=packet@entry=0x152d1800adf9 "SELECT * FROM t AS v NATURAL JOIN t AS w GROUP BY c HAVING c AND(SELECT (c=1 AND (((1 +''/ 0) AND ''=FALSE) OR c='')))", packet_length=packet_length@entry=118, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1346
      #15 0x000056430a82ff7f in do_command (thd=0x152d18000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
      #16 0x000056430a98a763 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x56430d434d28, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
      #17 0x000056430a98ac32 in handle_one_connection (arg=0x56430d434d28) at /test/10.11_dbg/sql/sql_connect.cc:1318
      #18 0x0000152d71aef609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #19 0x0000152d716db133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.4.27 (dbg), 10.4.27 (opt), 10.5.18 (dbg), 10.5.18 (opt), 10.6.10 (dbg), 10.6.10 (opt), 10.7.6 (dbg), 10.7.6 (opt), 10.8.5 (dbg), 10.8.5 (opt), 10.9.3 (dbg), 10.9.3 (opt), 10.10.2 (dbg), 10.10.2 (opt), 10.11.2 (dbg), 10.11.2 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.3.37 (dbg), 10.3.37 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)

        Attachments

          Activity

            People

            Assignee:
            psergei Sergei Petrunia
            Reporter:
            Roel Roel Van de Paar
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:

                Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.