[MDEV-30982] UBSAN: runtime error: null pointer passed as argument 2, which is declared to never be null in my_strnncoll_binary on DELETE - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Duplicate
Affects Version/s: 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL)
Fix Version/s: 10.8.8, 10.4.31, 10.5.22, 10.6.15, 10.9.8, 10.10.6, 10.11.5, 11.0.3, 11.1.2, 11.2.1
Component/s: Data types
Labels:
- UBSAN
- regression-10.6

Description

May be related to ~~MDEV-28384~~, however this bug is in 10.6+ only and the testcase looks different (no GROUP_CONCAT/COUNT and this testcase uses DELETE instead of SELECT). Reproduces on InnoDB and MyISAM.

CREATE TABLE t (c1 SET('1','2','3'),c2 BINARY);

INSERT INTO t VALUES (0,0);

DELETE FROM t WHERE c2<c1;

Leads to:

11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)
/test/11.0_dbg_san/strings/ctype-bin.c:89:12: runtime error: null pointer passed as argument 2, which is declared to never be null

11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)
/test/11.0_dbg_san/strings/ctype-bin.c:89:12: runtime error: null pointer passed as argument 2, which is declared to never be null
#0 0x5575bfed62c1 in my_strnncoll_binary /test/11.0_dbg_san/strings/ctype-bin.c:89
#1 0x5575bfed62fc in my_strnncollsp_binary /test/11.0_dbg_san/strings/ctype-bin.c:128
#2 0x5575bc6b37a3 in charset_info_st::strnncollsp(char const, unsigned long, char const, unsigned long) const /test/11.0_dbg_san/include/m_ctype.h:1018
#3 0x5575bc6b37a3 in sortcmp(Binary_string const, Binary_string const, charset_info_st const*) /test/11.0_dbg_san/sql/sql_string.cc:868
#4 0x5575bda5602f in Arg_comparator::compare_string() /test/11.0_dbg_san/sql/item_cmpfunc.cc:777
#5 0x5575bda55b76 in Arg_comparator::compare() /test/11.0_dbg_san/sql/item_cmpfunc.h:103
#6 0x5575bda55b76 in Item_func_lt::val_int() /test/11.0_dbg_san/sql/item_cmpfunc.cc:1831
#7 0x5575bbdc6102 in SQL_SELECT::skip_record(THD*) /test/11.0_dbg_san/sql/opt_range.h:1913
#8 0x5575bbdc6102 in record_should_be_deleted /test/11.0_dbg_san/sql/sql_delete.cc:221
#9 0x5575bbde138d in mysql_delete(THD, TABLE_LIST, Item, SQL_I_List<st_order>, unsigned long long, unsigned long long, select_result*) /test/11.0_dbg_san/sql/sql_delete.cc:819
#10 0x5575bc0bb3e4 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:4811
#11 0x5575bc0db5e6 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
#12 0x5575bc0eb37a in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
#13 0x5575bc0f917f in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
#14 0x5575bcabd459 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
#15 0x5575bcabe974 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
#16 0x149656c64b42 in start_thread nptl/pthread_create.c:442
#17 0x149656cf69ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

Setup:

Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1

Bug confirmed present in:
MariaDB: 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.3 (dbg), 10.11.3 (opt), 11.0.2 (dbg), 11.0.2 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.39 (dbg), 10.3.39 (opt), 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt)

Attachments

Issue Links

duplicates

MDEV-28384 UBSAN: null pointer passed as argument 1, which is declared to never be null in my_strnncoll_binary on SELECT ... COUNT or GROUP_CONCAT

Closed

relates to

MDEV-31845 UBSAN: runtime error: null pointer passed as argument 2, which is declared to never be null in my_strnncoll_binary on SELECT

Confirmed

MDEV-28384 UBSAN: null pointer passed as argument 1, which is declared to never be null in my_strnncoll_binary on SELECT ... COUNT or GROUP_CONCAT

Closed

Activity

Ascending order - Click to sort in descending order

Roel Van de Paar created issue - 2023-04-01 04:30

Roel Van de Paar made changes - 2023-04-01 04:30

Field	Original Value	New Value
Link		This issue relates to ~~MDEV-28384~~ [ ~~MDEV-28384~~ ]

Roel Van de Paar made changes - 2023-04-01 04:31

Description

May be related to ~~MDEV-28384~~, however this bug is in 10.6+ only and the testcase looks different (no {{GROUP_CONCAT}}/{{COUNT}} and {{DELETE}} instead of {{SELECT}}). Reproduces on InnoDB and MyISAM.
{code:sql}
CREATE TABLE t (c1 SET('1','2','3'),c2 BINARY);
INSERT INTO t VALUES (0,0);
DELETE FROM t WHERE c2<c1;
{code}

Leads to:

{noformat:title=11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)}
/test/11.0_dbg_san/strings/ctype-bin.c:89:12: runtime error: null pointer passed as argument 2, which is declared to never be null
{noformat}

{noformat:title=11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)}
/test/11.0_dbg_san/strings/ctype-bin.c:89:12: runtime error: null pointer passed as argument 2, which is declared to never be null
    #0 0x5575bfed62c1 in my_strnncoll_binary /test/11.0_dbg_san/strings/ctype-bin.c:89
    #1 0x5575bfed62fc in my_strnncollsp_binary /test/11.0_dbg_san/strings/ctype-bin.c:128
    #2 0x5575bc6b37a3 in charset_info_st::strnncollsp(char const*, unsigned long, char const*, unsigned long) const /test/11.0_dbg_san/include/m_ctype.h:1018
    #3 0x5575bc6b37a3 in sortcmp(Binary_string const*, Binary_string const*, charset_info_st const*) /test/11.0_dbg_san/sql/sql_string.cc:868
    #4 0x5575bda5602f in Arg_comparator::compare_string() /test/11.0_dbg_san/sql/item_cmpfunc.cc:777
    #5 0x5575bda55b76 in Arg_comparator::compare() /test/11.0_dbg_san/sql/item_cmpfunc.h:103
    #6 0x5575bda55b76 in Item_func_lt::val_int() /test/11.0_dbg_san/sql/item_cmpfunc.cc:1831
    #7 0x5575bbdc6102 in SQL_SELECT::skip_record(THD*) /test/11.0_dbg_san/sql/opt_range.h:1913
    #8 0x5575bbdc6102 in record_should_be_deleted /test/11.0_dbg_san/sql/sql_delete.cc:221
    #9 0x5575bbde138d in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /test/11.0_dbg_san/sql/sql_delete.cc:819
    #10 0x5575bc0bb3e4 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:4811
    #11 0x5575bc0db5e6 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
    #12 0x5575bc0eb37a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
    #13 0x5575bc0f917f in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
    #14 0x5575bcabd459 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
    #15 0x5575bcabe974 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
    #16 0x149656c64b42 in start_thread nptl/pthread_create.c:442
    #17 0x149656cf69ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
{noformat}

Setup:

{noformat}
Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and:
    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON
Set before execution:
    export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1
{noformat}

Bug confirmed present in:
MariaDB: 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.3 (dbg), 10.11.3 (opt), 11.0.2 (dbg), 11.0.2 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.39 (dbg), 10.3.39 (opt), 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt)

May be related to ~~MDEV-28384~~, however this bug is in 10.6+ only and the testcase looks different (no {{GROUP_CONCAT}}/{{COUNT}} and this testcase uses {{DELETE}} instead of {{SELECT}}). Reproduces on InnoDB and MyISAM.
{code:sql}
CREATE TABLE t (c1 SET('1','2','3'),c2 BINARY);
INSERT INTO t VALUES (0,0);
DELETE FROM t WHERE c2<c1;
{code}

Leads to:

{noformat:title=11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)}
/test/11.0_dbg_san/strings/ctype-bin.c:89:12: runtime error: null pointer passed as argument 2, which is declared to never be null
{noformat}

{noformat:title=11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)}
/test/11.0_dbg_san/strings/ctype-bin.c:89:12: runtime error: null pointer passed as argument 2, which is declared to never be null
    #0 0x5575bfed62c1 in my_strnncoll_binary /test/11.0_dbg_san/strings/ctype-bin.c:89
    #1 0x5575bfed62fc in my_strnncollsp_binary /test/11.0_dbg_san/strings/ctype-bin.c:128
    #2 0x5575bc6b37a3 in charset_info_st::strnncollsp(char const*, unsigned long, char const*, unsigned long) const /test/11.0_dbg_san/include/m_ctype.h:1018
    #3 0x5575bc6b37a3 in sortcmp(Binary_string const*, Binary_string const*, charset_info_st const*) /test/11.0_dbg_san/sql/sql_string.cc:868
    #4 0x5575bda5602f in Arg_comparator::compare_string() /test/11.0_dbg_san/sql/item_cmpfunc.cc:777
    #5 0x5575bda55b76 in Arg_comparator::compare() /test/11.0_dbg_san/sql/item_cmpfunc.h:103
    #6 0x5575bda55b76 in Item_func_lt::val_int() /test/11.0_dbg_san/sql/item_cmpfunc.cc:1831
    #7 0x5575bbdc6102 in SQL_SELECT::skip_record(THD*) /test/11.0_dbg_san/sql/opt_range.h:1913
    #8 0x5575bbdc6102 in record_should_be_deleted /test/11.0_dbg_san/sql/sql_delete.cc:221
    #9 0x5575bbde138d in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /test/11.0_dbg_san/sql/sql_delete.cc:819
    #10 0x5575bc0bb3e4 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:4811
    #11 0x5575bc0db5e6 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
    #12 0x5575bc0eb37a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
    #13 0x5575bc0f917f in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
    #14 0x5575bcabd459 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
    #15 0x5575bcabe974 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
    #16 0x149656c64b42 in start_thread nptl/pthread_create.c:442
    #17 0x149656cf69ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
{noformat}

Setup:

{noformat}
Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and:
    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON
Set before execution:
    export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1
{noformat}

Bug confirmed present in:
MariaDB: 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.3 (dbg), 10.11.3 (opt), 11.0.2 (dbg), 11.0.2 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.39 (dbg), 10.3.39 (opt), 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt)

Roel Van de Paar added a comment - 2023-04-01 04:33

All stacks/UniqueID's seen:

UBSAN|null pointer passed as argument 2, which is declared to never be null|strings/ctype-bin.c|my_strnncoll_binary|my_strnncollsp_binary|Arg_comparator::compare|Item_func_lt::val_int

UBSAN|null pointer passed as argument 2, which is declared to never be null|strings/ctype-bin.c|my_strnncoll_binary|my_strnncollsp_binary|charset_info_st::strnncollsp|sortcmp

Julien Fritsch made changes - 2023-04-27 14:56

Fix Version/s

10.8 [ 26121 ]

Alexander Barkov made changes - 2023-07-20 08:23

Fix Version/s		10.4.31 [ 29010 ]
Fix Version/s		10.5.22 [ 29011 ]
Fix Version/s		10.6.15 [ 29013 ]
Fix Version/s		10.9.8 [ 29015 ]
Fix Version/s		10.10.6 [ 29017 ]
Fix Version/s		10.11.5 [ 29019 ]
Fix Version/s		11.0.3 [ 28920 ]
Fix Version/s		11.1.2 [ 28921 ]
Fix Version/s		11.2.1 [ 29034 ]
Fix Version/s		10.8.8 [ 28518 ]
Fix Version/s	10.6 [ 24028 ]
Fix Version/s	10.9 [ 26905 ]
Fix Version/s	10.10 [ 27530 ]
Fix Version/s	10.11 [ 27614 ]
Fix Version/s	11.0 [ 28320 ]
Resolution		Duplicate [ 3 ]
Status	Open [ 1 ]	Closed [ 6 ]

Alexander Barkov made changes - 2023-07-20 08:23

Link

This issue duplicates ~~MDEV-28384~~ [ ~~MDEV-28384~~ ]

Alexander Barkov added a comment - 2023-07-20 08:23

This problem was fixed by a joint patch for ~~MDEV-28384~~.

Alexander Barkov added a comment - 2023-07-20 08:23 This problem was fixed by a joint patch for MDEV-28384 .

Roel Van de Paar made changes - 2023-08-04 05:03

Link

This issue relates to MDEV-31845 [ MDEV-31845 ]

People

Assignee:: Alexander Barkov

Reporter:: Roel Van de Paar

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2023-04-01 04:30

Updated:: 2023-08-04 05:03

Resolved:: 2023-07-20 08:23

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server

Details

Description

Attachments

Issue Links

Activity

People

Dates

Git Integration