[MDEV-30931] UBSAN: negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in get_interval_value on SELECT - Jira

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.3(EOL), 10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL)
Fix Version/s: 10.5.26, 10.6.19, 10.11.9, 11.1.6, 11.2.5, 11.4.3, 11.5.2
Component/s: Data types
Labels:
- UBSAN
- affects-tests

Description

SELECT DATE_ADD('01-01-23',INTERVAL '9223372036854775808-02' WEEK);

Leads to:

11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)
/test/11.0_dbg_san/sql/item_timefunc.cc:1354:12: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself
/test/11.0_dbg_san/sql/item_timefunc.cc:1388:33: runtime error: signed integer overflow: -9223372036854775808 * 7 cannot be represented in type 'long long int'
/test/11.0_dbg_san/sql/sql_time.cc:1005:19: runtime error: signed integer overflow: -1 * -9223372036854775808 cannot be represented in type 'long int'

11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)
/test/11.0_dbg_san/sql/item_timefunc.cc:1354:12: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself
#0 0x56538fd7e5c7 in get_interval_value(THD, Item, interval_type, INTERVAL*) /test/11.0_dbg_san/sql/item_timefunc.cc:1354
#1 0x56538fe494e8 in Func_handler_date_add_interval::add(THD, Item, interval_type, bool, st_mysql_time*) const /test/11.0_dbg_san/sql/item_timefunc.h:1697
#2 0x56538fe494e8 in Func_handler_date_add_interval_string::get_date(THD, Item_handled_func, st_mysql_time*, date_mode_t) const /test/11.0_dbg_san/sql/item_timefunc.h:1814
#3 0x56538e931a1a in Item_handled_func::get_date(THD, st_mysql_time, date_mode_t) /test/11.0_dbg_san/sql/item_func.h:790
#4 0x56538e8cb840 in Temporal_hybrid::Temporal_hybrid(THD, Item, date_mode_t) /test/11.0_dbg_san/sql/sql_type.cc:361
#5 0x56538fe338bc in Temporal_hybrid::Temporal_hybrid(THD, Item) /test/11.0_dbg_san/sql/sql_type.h:1232
#6 0x56538fe338bc in Temporal_hybrid::Temporal_hybrid(Item*) /test/11.0_dbg_san/sql/sql_type.h:1235
#7 0x56538fe338bc in Item_handled_func::Handler_temporal_string::val_str_ascii(Item_handled_func, String) const /test/11.0_dbg_san/sql/item_func.h:572
#8 0x56538e93118a in Item_handled_func::val_str_ascii(String*) /test/11.0_dbg_san/sql/item_func.h:774
#9 0x56538f9f8422 in Item_func::val_str_from_val_str_ascii(String, String) /test/11.0_dbg_san/sql/item_strfunc.cc:103
#10 0x56538fe31dbd in Item_handled_func::Handler_temporal::val_str(Item_handled_func, String) const /test/11.0_dbg_san/sql/item_func.h:537
#11 0x56538e930f6a in Item_handled_func::val_str(String*) /test/11.0_dbg_san/sql/item_func.h:770
#12 0x56538e90d5a1 in Type_handler::Item_send_str(Item, Protocol, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7446
#13 0x56538e35baa2 in Type_handler_string_result::Item_send(Item, Protocol, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5455
#14 0x56538d0ff59c in Item::send(Protocol, st_value) /test/11.0_dbg_san/sql/item.h:1235
#15 0x56538d2bb05c in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
#16 0x56538d6849ca in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
#17 0x56538ddfbb03 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
#18 0x56538ddfbb03 in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4761
#19 0x56538de0257a in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4672
#20 0x56538ddf0d38 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.0_dbg_san/sql/sql_select.cc:5153
#21 0x56538ddf5193 in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:611
#22 0x56538d974973 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6267
#23 0x56538d9d5cce in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
#24 0x56538da055e6 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
#25 0x56538da1537a in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
#26 0x56538da2317f in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
#27 0x56538e3e7459 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
#28 0x56538e3e8974 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
#29 0x14b1b9951b42 in start_thread nptl/pthread_create.c:442
#30 0x14b1b99e39ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

/test/11.0_dbg_san/sql/item_timefunc.cc:1388:33: runtime error: signed integer overflow: -9223372036854775808 * 7 cannot be represented in type 'long long int'
#0 0x56538fd7ec0b in get_interval_value(THD, Item, interval_type, INTERVAL*) /test/11.0_dbg_san/sql/item_timefunc.cc:1388
#1 0x56538fe494e8 in Func_handler_date_add_interval::add(THD, Item, interval_type, bool, st_mysql_time*) const /test/11.0_dbg_san/sql/item_timefunc.h:1697
#2 0x56538fe494e8 in Func_handler_date_add_interval_string::get_date(THD, Item_handled_func, st_mysql_time*, date_mode_t) const /test/11.0_dbg_san/sql/item_timefunc.h:1814
#3 0x56538e931a1a in Item_handled_func::get_date(THD, st_mysql_time, date_mode_t) /test/11.0_dbg_san/sql/item_func.h:790
#4 0x56538e8cb840 in Temporal_hybrid::Temporal_hybrid(THD, Item, date_mode_t) /test/11.0_dbg_san/sql/sql_type.cc:361
#5 0x56538fe338bc in Temporal_hybrid::Temporal_hybrid(THD, Item) /test/11.0_dbg_san/sql/sql_type.h:1232
#6 0x56538fe338bc in Temporal_hybrid::Temporal_hybrid(Item*) /test/11.0_dbg_san/sql/sql_type.h:1235
#7 0x56538fe338bc in Item_handled_func::Handler_temporal_string::val_str_ascii(Item_handled_func, String) const /test/11.0_dbg_san/sql/item_func.h:572
#8 0x56538e93118a in Item_handled_func::val_str_ascii(String*) /test/11.0_dbg_san/sql/item_func.h:774
#9 0x56538f9f8422 in Item_func::val_str_from_val_str_ascii(String, String) /test/11.0_dbg_san/sql/item_strfunc.cc:103
#10 0x56538fe31dbd in Item_handled_func::Handler_temporal::val_str(Item_handled_func, String) const /test/11.0_dbg_san/sql/item_func.h:537
#11 0x56538e930f6a in Item_handled_func::val_str(String*) /test/11.0_dbg_san/sql/item_func.h:770
#12 0x56538e90d5a1 in Type_handler::Item_send_str(Item, Protocol, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7446
#13 0x56538e35baa2 in Type_handler_string_result::Item_send(Item, Protocol, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5455
#14 0x56538d0ff59c in Item::send(Protocol, st_value) /test/11.0_dbg_san/sql/item.h:1235
#15 0x56538d2bb05c in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
#16 0x56538d6849ca in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
#17 0x56538ddfbb03 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
#18 0x56538ddfbb03 in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4761
#19 0x56538de0257a in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4672
#20 0x56538ddf0d38 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.0_dbg_san/sql/sql_select.cc:5153
#21 0x56538ddf5193 in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:611
#22 0x56538d974973 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6267
#23 0x56538d9d5cce in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
#24 0x56538da055e6 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
#25 0x56538da1537a in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
#26 0x56538da2317f in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
#27 0x56538e3e7459 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
#28 0x56538e3e8974 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
#29 0x14b1b9951b42 in start_thread nptl/pthread_create.c:442
#30 0x14b1b99e39ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

/test/11.0_dbg_san/sql/sql_time.cc:1005:19: runtime error: signed integer overflow: -1 * -9223372036854775808 cannot be represented in type 'long int'
#0 0x56538e2a429e in date_add_interval(THD, st_mysql_time, interval_type, INTERVAL const&, bool) /test/11.0_dbg_san/sql/sql_time.cc:1005
#1 0x56538fe49572 in Func_handler_date_add_interval::add(THD, Item, interval_type, bool, st_mysql_time*) const /test/11.0_dbg_san/sql/item_timefunc.h:1701
#2 0x56538fe49572 in Func_handler_date_add_interval_string::get_date(THD, Item_handled_func, st_mysql_time*, date_mode_t) const /test/11.0_dbg_san/sql/item_timefunc.h:1814
#3 0x56538e931a1a in Item_handled_func::get_date(THD, st_mysql_time, date_mode_t) /test/11.0_dbg_san/sql/item_func.h:790
#4 0x56538e8cb840 in Temporal_hybrid::Temporal_hybrid(THD, Item, date_mode_t) /test/11.0_dbg_san/sql/sql_type.cc:361
#5 0x56538fe338bc in Temporal_hybrid::Temporal_hybrid(THD, Item) /test/11.0_dbg_san/sql/sql_type.h:1232
#6 0x56538fe338bc in Temporal_hybrid::Temporal_hybrid(Item*) /test/11.0_dbg_san/sql/sql_type.h:1235
#7 0x56538fe338bc in Item_handled_func::Handler_temporal_string::val_str_ascii(Item_handled_func, String) const /test/11.0_dbg_san/sql/item_func.h:572
#8 0x56538e93118a in Item_handled_func::val_str_ascii(String*) /test/11.0_dbg_san/sql/item_func.h:774
#9 0x56538f9f8422 in Item_func::val_str_from_val_str_ascii(String, String) /test/11.0_dbg_san/sql/item_strfunc.cc:103
#10 0x56538fe31dbd in Item_handled_func::Handler_temporal::val_str(Item_handled_func, String) const /test/11.0_dbg_san/sql/item_func.h:537
#11 0x56538e930f6a in Item_handled_func::val_str(String*) /test/11.0_dbg_san/sql/item_func.h:770
#12 0x56538e90d5a1 in Type_handler::Item_send_str(Item, Protocol, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7446
#13 0x56538e35baa2 in Type_handler_string_result::Item_send(Item, Protocol, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5455
#14 0x56538d0ff59c in Item::send(Protocol, st_value) /test/11.0_dbg_san/sql/item.h:1235
#15 0x56538d2bb05c in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
#16 0x56538d6849ca in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
#17 0x56538ddfbb03 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
#18 0x56538ddfbb03 in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4761
#19 0x56538de0257a in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4672
#20 0x56538ddf0d38 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.0_dbg_san/sql/sql_select.cc:5153
#21 0x56538ddf5193 in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:611
#22 0x56538d974973 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6267
#23 0x56538d9d5cce in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
#24 0x56538da055e6 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
#25 0x56538da1537a in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
#26 0x56538da2317f in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
#27 0x56538e3e7459 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
#28 0x56538e3e8974 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
#29 0x14b1b9951b42 in start_thread nptl/pthread_create.c:442
#30 0x14b1b99e39ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

Setup:

Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1

Bug confirmed present in:
MariaDB: 10.3.39 (dbg), 10.3.39 (opt), 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt), 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.3 (dbg), 10.11.3 (opt), 11.0.2 (dbg), 11.0.2 (opt)

All UBSAN issues seen with this testcase across versions and build types:

UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|sql/item_timefunc.cc|get_interval_value|Func_handler_date_add_interval::add|Func_handler_date_add_interval_string::get_date|Item_handled_func::get_date

UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|sql/item_timefunc.cc|get_interval_value|Func_handler_date_add_interval::add|Func_handler_date_add_interval_string::get_date|Temporal_hybrid::Temporal_hybrid

UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|sql/item_timefunc.cc|get_interval_value|Item_date_add_interval::get_date|Item_temporal_hybrid_func::val_str_ascii|Item_func::val_str_from_val_str_ascii

Attachments

Issue Links

relates to

MDEV-35406 UBSAN runtime error: signed integer overflow on SELECT DATE_ADD/MAKEDATE

Confirmed

MDEV-35714 UBSAN: runtime error: downcast of address 0x1549d2b0ba50 with insufficient space for an object of type 'my_decimal' in Item_dyncol_get::get_date

Open

MDEV-30932 UBSAN: negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in Item_func_mul::int_op and Item_func_round::int_op

Closed

MDEV-31221 UBSAN runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int' in my_strtoll10_utf32

Closed

Activity

People

Assignee:: Alexander Barkov

Reporter:: Roel Van de Paar

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2023-03-27 06:10

Updated:: 3 days ago 04:48

Resolved:: 2024-05-24 05:09

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.