Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-30931

UBSAN: negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in get_interval_value on SELECT

    XMLWordPrintable

Details

    Description

      SELECT DATE_ADD('01-01-23',INTERVAL '9223372036854775808-02' WEEK);
      

      Leads to:

      11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)

      /test/11.0_dbg_san/sql/item_timefunc.cc:1354:12: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself
      /test/11.0_dbg_san/sql/item_timefunc.cc:1388:33: runtime error: signed integer overflow: -9223372036854775808 * 7 cannot be represented in type 'long long int'
      /test/11.0_dbg_san/sql/sql_time.cc:1005:19: runtime error: signed integer overflow: -1 * -9223372036854775808 cannot be represented in type 'long int'
      

      11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)

      /test/11.0_dbg_san/sql/item_timefunc.cc:1354:12: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself
          #0 0x56538fd7e5c7 in get_interval_value(THD*, Item*, interval_type, INTERVAL*) /test/11.0_dbg_san/sql/item_timefunc.cc:1354
          #1 0x56538fe494e8 in Func_handler_date_add_interval::add(THD*, Item*, interval_type, bool, st_mysql_time*) const /test/11.0_dbg_san/sql/item_timefunc.h:1697
          #2 0x56538fe494e8 in Func_handler_date_add_interval_string::get_date(THD*, Item_handled_func*, st_mysql_time*, date_mode_t) const /test/11.0_dbg_san/sql/item_timefunc.h:1814
          #3 0x56538e931a1a in Item_handled_func::get_date(THD*, st_mysql_time*, date_mode_t) /test/11.0_dbg_san/sql/item_func.h:790
          #4 0x56538e8cb840 in Temporal_hybrid::Temporal_hybrid(THD*, Item*, date_mode_t) /test/11.0_dbg_san/sql/sql_type.cc:361
          #5 0x56538fe338bc in Temporal_hybrid::Temporal_hybrid(THD*, Item*) /test/11.0_dbg_san/sql/sql_type.h:1232
          #6 0x56538fe338bc in Temporal_hybrid::Temporal_hybrid(Item*) /test/11.0_dbg_san/sql/sql_type.h:1235
          #7 0x56538fe338bc in Item_handled_func::Handler_temporal_string::val_str_ascii(Item_handled_func*, String*) const /test/11.0_dbg_san/sql/item_func.h:572
          #8 0x56538e93118a in Item_handled_func::val_str_ascii(String*) /test/11.0_dbg_san/sql/item_func.h:774
          #9 0x56538f9f8422 in Item_func::val_str_from_val_str_ascii(String*, String*) /test/11.0_dbg_san/sql/item_strfunc.cc:103
          #10 0x56538fe31dbd in Item_handled_func::Handler_temporal::val_str(Item_handled_func*, String*) const /test/11.0_dbg_san/sql/item_func.h:537
          #11 0x56538e930f6a in Item_handled_func::val_str(String*) /test/11.0_dbg_san/sql/item_func.h:770
          #12 0x56538e90d5a1 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7446
          #13 0x56538e35baa2 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5455
          #14 0x56538d0ff59c in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235
          #15 0x56538d2bb05c in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
          #16 0x56538d6849ca in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
          #17 0x56538ddfbb03 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
          #18 0x56538ddfbb03 in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4761
          #19 0x56538de0257a in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4672
          #20 0x56538ddf0d38 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5153
          #21 0x56538ddf5193 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:611
          #22 0x56538d974973 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6267
          #23 0x56538d9d5cce in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
          #24 0x56538da055e6 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
          #25 0x56538da1537a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
          #26 0x56538da2317f in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
          #27 0x56538e3e7459 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
          #28 0x56538e3e8974 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
          #29 0x14b1b9951b42 in start_thread nptl/pthread_create.c:442
          #30 0x14b1b99e39ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
       
      /test/11.0_dbg_san/sql/item_timefunc.cc:1388:33: runtime error: signed integer overflow: -9223372036854775808 * 7 cannot be represented in type 'long long int'
          #0 0x56538fd7ec0b in get_interval_value(THD*, Item*, interval_type, INTERVAL*) /test/11.0_dbg_san/sql/item_timefunc.cc:1388
          #1 0x56538fe494e8 in Func_handler_date_add_interval::add(THD*, Item*, interval_type, bool, st_mysql_time*) const /test/11.0_dbg_san/sql/item_timefunc.h:1697
          #2 0x56538fe494e8 in Func_handler_date_add_interval_string::get_date(THD*, Item_handled_func*, st_mysql_time*, date_mode_t) const /test/11.0_dbg_san/sql/item_timefunc.h:1814
          #3 0x56538e931a1a in Item_handled_func::get_date(THD*, st_mysql_time*, date_mode_t) /test/11.0_dbg_san/sql/item_func.h:790
          #4 0x56538e8cb840 in Temporal_hybrid::Temporal_hybrid(THD*, Item*, date_mode_t) /test/11.0_dbg_san/sql/sql_type.cc:361
          #5 0x56538fe338bc in Temporal_hybrid::Temporal_hybrid(THD*, Item*) /test/11.0_dbg_san/sql/sql_type.h:1232
          #6 0x56538fe338bc in Temporal_hybrid::Temporal_hybrid(Item*) /test/11.0_dbg_san/sql/sql_type.h:1235
          #7 0x56538fe338bc in Item_handled_func::Handler_temporal_string::val_str_ascii(Item_handled_func*, String*) const /test/11.0_dbg_san/sql/item_func.h:572
          #8 0x56538e93118a in Item_handled_func::val_str_ascii(String*) /test/11.0_dbg_san/sql/item_func.h:774
          #9 0x56538f9f8422 in Item_func::val_str_from_val_str_ascii(String*, String*) /test/11.0_dbg_san/sql/item_strfunc.cc:103
          #10 0x56538fe31dbd in Item_handled_func::Handler_temporal::val_str(Item_handled_func*, String*) const /test/11.0_dbg_san/sql/item_func.h:537
          #11 0x56538e930f6a in Item_handled_func::val_str(String*) /test/11.0_dbg_san/sql/item_func.h:770
          #12 0x56538e90d5a1 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7446
          #13 0x56538e35baa2 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5455
          #14 0x56538d0ff59c in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235
          #15 0x56538d2bb05c in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
          #16 0x56538d6849ca in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
          #17 0x56538ddfbb03 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
          #18 0x56538ddfbb03 in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4761
          #19 0x56538de0257a in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4672
          #20 0x56538ddf0d38 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5153
          #21 0x56538ddf5193 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:611
          #22 0x56538d974973 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6267
          #23 0x56538d9d5cce in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
          #24 0x56538da055e6 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
          #25 0x56538da1537a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
          #26 0x56538da2317f in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
          #27 0x56538e3e7459 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
          #28 0x56538e3e8974 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
          #29 0x14b1b9951b42 in start_thread nptl/pthread_create.c:442
          #30 0x14b1b99e39ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
       
      /test/11.0_dbg_san/sql/sql_time.cc:1005:19: runtime error: signed integer overflow: -1 * -9223372036854775808 cannot be represented in type 'long int'
          #0 0x56538e2a429e in date_add_interval(THD*, st_mysql_time*, interval_type, INTERVAL const&, bool) /test/11.0_dbg_san/sql/sql_time.cc:1005
          #1 0x56538fe49572 in Func_handler_date_add_interval::add(THD*, Item*, interval_type, bool, st_mysql_time*) const /test/11.0_dbg_san/sql/item_timefunc.h:1701
          #2 0x56538fe49572 in Func_handler_date_add_interval_string::get_date(THD*, Item_handled_func*, st_mysql_time*, date_mode_t) const /test/11.0_dbg_san/sql/item_timefunc.h:1814
          #3 0x56538e931a1a in Item_handled_func::get_date(THD*, st_mysql_time*, date_mode_t) /test/11.0_dbg_san/sql/item_func.h:790
          #4 0x56538e8cb840 in Temporal_hybrid::Temporal_hybrid(THD*, Item*, date_mode_t) /test/11.0_dbg_san/sql/sql_type.cc:361
          #5 0x56538fe338bc in Temporal_hybrid::Temporal_hybrid(THD*, Item*) /test/11.0_dbg_san/sql/sql_type.h:1232
          #6 0x56538fe338bc in Temporal_hybrid::Temporal_hybrid(Item*) /test/11.0_dbg_san/sql/sql_type.h:1235
          #7 0x56538fe338bc in Item_handled_func::Handler_temporal_string::val_str_ascii(Item_handled_func*, String*) const /test/11.0_dbg_san/sql/item_func.h:572
          #8 0x56538e93118a in Item_handled_func::val_str_ascii(String*) /test/11.0_dbg_san/sql/item_func.h:774
          #9 0x56538f9f8422 in Item_func::val_str_from_val_str_ascii(String*, String*) /test/11.0_dbg_san/sql/item_strfunc.cc:103
          #10 0x56538fe31dbd in Item_handled_func::Handler_temporal::val_str(Item_handled_func*, String*) const /test/11.0_dbg_san/sql/item_func.h:537
          #11 0x56538e930f6a in Item_handled_func::val_str(String*) /test/11.0_dbg_san/sql/item_func.h:770
          #12 0x56538e90d5a1 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7446
          #13 0x56538e35baa2 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5455
          #14 0x56538d0ff59c in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235
          #15 0x56538d2bb05c in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
          #16 0x56538d6849ca in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
          #17 0x56538ddfbb03 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
          #18 0x56538ddfbb03 in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4761
          #19 0x56538de0257a in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4672
          #20 0x56538ddf0d38 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5153
          #21 0x56538ddf5193 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:611
          #22 0x56538d974973 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6267
          #23 0x56538d9d5cce in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
          #24 0x56538da055e6 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
          #25 0x56538da1537a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
          #26 0x56538da2317f in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
          #27 0x56538e3e7459 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
          #28 0x56538e3e8974 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
          #29 0x14b1b9951b42 in start_thread nptl/pthread_create.c:442
          #30 0x14b1b99e39ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
      

      Setup:

      Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and:
          -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON
      Set before execution:
          export UBSAN_OPTIONS=print_stacktrace=1
      

      Bug confirmed present in:
      MariaDB: 10.3.39 (dbg), 10.3.39 (opt), 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt), 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.3 (dbg), 10.11.3 (opt), 11.0.2 (dbg), 11.0.2 (opt)

      All UBSAN issues seen with this testcase across versions and build types:

      UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|sql/item_timefunc.cc|get_interval_value|Func_handler_date_add_interval::add|Func_handler_date_add_interval_string::get_date|Item_handled_func::get_date
      UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|sql/item_timefunc.cc|get_interval_value|Func_handler_date_add_interval::add|Func_handler_date_add_interval_string::get_date|Temporal_hybrid::Temporal_hybrid
      UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|sql/item_timefunc.cc|get_interval_value|Item_date_add_interval::get_date|Item_temporal_hybrid_func::val_str_ascii|Item_func::val_str_from_val_str_ascii
      

      Attachments

        Issue Links

          Activity

            People

              bar Alexander Barkov
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.