Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-30982

UBSAN: runtime error: null pointer passed as argument 2, which is declared to never be null in my_strnncoll_binary on DELETE

    XMLWordPrintable

Details

    Description

      May be related to MDEV-28384, however this bug is in 10.6+ only and the testcase looks different (no GROUP_CONCAT/COUNT and this testcase uses DELETE instead of SELECT). Reproduces on InnoDB and MyISAM.

      CREATE TABLE t (c1 SET('1','2','3'),c2 BINARY);
      INSERT INTO t VALUES (0,0);
      DELETE FROM t WHERE c2<c1;
      

      Leads to:

      11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)

      /test/11.0_dbg_san/strings/ctype-bin.c:89:12: runtime error: null pointer passed as argument 2, which is declared to never be null
      

      11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)

      /test/11.0_dbg_san/strings/ctype-bin.c:89:12: runtime error: null pointer passed as argument 2, which is declared to never be null
          #0 0x5575bfed62c1 in my_strnncoll_binary /test/11.0_dbg_san/strings/ctype-bin.c:89
          #1 0x5575bfed62fc in my_strnncollsp_binary /test/11.0_dbg_san/strings/ctype-bin.c:128
          #2 0x5575bc6b37a3 in charset_info_st::strnncollsp(char const*, unsigned long, char const*, unsigned long) const /test/11.0_dbg_san/include/m_ctype.h:1018
          #3 0x5575bc6b37a3 in sortcmp(Binary_string const*, Binary_string const*, charset_info_st const*) /test/11.0_dbg_san/sql/sql_string.cc:868
          #4 0x5575bda5602f in Arg_comparator::compare_string() /test/11.0_dbg_san/sql/item_cmpfunc.cc:777
          #5 0x5575bda55b76 in Arg_comparator::compare() /test/11.0_dbg_san/sql/item_cmpfunc.h:103
          #6 0x5575bda55b76 in Item_func_lt::val_int() /test/11.0_dbg_san/sql/item_cmpfunc.cc:1831
          #7 0x5575bbdc6102 in SQL_SELECT::skip_record(THD*) /test/11.0_dbg_san/sql/opt_range.h:1913
          #8 0x5575bbdc6102 in record_should_be_deleted /test/11.0_dbg_san/sql/sql_delete.cc:221
          #9 0x5575bbde138d in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /test/11.0_dbg_san/sql/sql_delete.cc:819
          #10 0x5575bc0bb3e4 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:4811
          #11 0x5575bc0db5e6 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
          #12 0x5575bc0eb37a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
          #13 0x5575bc0f917f in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
          #14 0x5575bcabd459 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
          #15 0x5575bcabe974 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
          #16 0x149656c64b42 in start_thread nptl/pthread_create.c:442
          #17 0x149656cf69ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
      

      Setup:

      Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and:
          -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON
      Set before execution:
          export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1
      

      Bug confirmed present in:
      MariaDB: 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.3 (dbg), 10.11.3 (opt), 11.0.2 (dbg), 11.0.2 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.3.39 (dbg), 10.3.39 (opt), 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt)

      Attachments

        Issue Links

          Activity

            People

              bar Alexander Barkov
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.