SIGSEGV in Item_func_monthname::val_str and UBSAN: null pointer passed as argument 1, which is declared to never be null in Item_func_monthname::val_str in sql/item_timefunc.cc on SELECT MONTHNAME

SET lc_time_names=111;

SELECT MONTHNAME('2010-12-12');

Core was generated by `/test/MD010423-mariadb-11.1.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --cor'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74

[Current thread is 1 (Thread 0x14d6c75af640 (LWP 1242041))]

(gdb) bt

#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74

#1  0x000055c15ad22b87 in Item_func_monthname::val_str (this=0x14d6340137d8, str=0x14d6c75acf90) at /test/11.1_dbg/sql/item_timefunc.cc:997

#2  0x000055c15ab2e5d8 in Type_handler::Item_send_str (this=<optimized out>, item=0x14d6340137d8, protocol=0x14d634001368, buf=<optimized out>) at /test/11.1_dbg/sql/sql_type.cc:7446

#3  0x000055c15aa6e105 in Type_handler_string_result::Item_send (this=<optimized out>, item=<optimized out>, protocol=<optimized out>, buf=<optimized out>) at /test/11.1_dbg/sql/sql_type.h:5455

#4  0x000055c15a80b5e8 in Item::send (this=0x14d6340137d8, protocol=0x14d634001368, buffer=0x14d6c75acf60) at /test/11.1_dbg/sql/item.h:1235

#5  0x000055c15a8411dd in Protocol::send_result_set_row (this=this@entry=0x14d634001368, row_items=row_items@entry=0x14d6340134d8) at /test/11.1_dbg/sql/protocol.cc:1332

#6  0x000055c15a8c3a7d in select_send::send_data (this=0x14d6340141c0, items=@0x14d6340134d8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14d634013890, last = 0x14d634013890, elements = 1}, <No data fields>}) at /test/11.1_dbg/sql/sql_class.cc:3102

#7  0x000055c15a9b3ac9 in select_result_sink::send_data_with_check (sent=0, u=<optimized out>, items=<optimized out>, this=<optimized out>) at /test/11.1_dbg/sql/sql_class.h:5748

#8  JOIN::exec_inner (this=this@entry=0x14d6340141e8) at /test/11.1_dbg/sql/sql_select.cc:4763

#9  0x000055c15a9b49c0 in JOIN::exec (this=this@entry=0x14d6340141e8) at /test/11.1_dbg/sql/sql_select.cc:4674

#10 0x000055c15a9b2898 in mysql_select (thd=thd@entry=0x14d634000d58, tables=<optimized out>, fields=@0x14d6340134d8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14d634013890, last = 0x14d634013890, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x14d6340141c0, unit=0x14d634004fa0, select_lex=0x14d634013218) at /test/11.1_dbg/sql/sql_select.cc:5155

#11 0x000055c15a9b301e in handle_select (thd=thd@entry=0x14d634000d58, lex=lex@entry=0x14d634004ec8, result=result@entry=0x14d6340141c0, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/11.1_dbg/sql/sql_select.cc:611

#12 0x000055c15a919314 in execute_sqlcom_select (thd=thd@entry=0x14d634000d58, all_tables=0x0) at /test/11.1_dbg/sql/sql_parse.cc:6024

#13 0x000055c15a924974 in mysql_execute_command (thd=thd@entry=0x14d634000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/11.1_dbg/sql/sql_parse.cc:3944

#14 0x000055c15a92af05 in mysql_parse (thd=thd@entry=0x14d634000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14d6c75ae230) at /test/11.1_dbg/sql/sql_parse.cc:7760

#15 0x000055c15a92d099 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14d634000d58, packet=packet@entry=0x14d63400ae49 "", packet_length=packet_length@entry=30, blocking=blocking@entry=true) at /test/11.1_dbg/sql/sql_class.h:242

#16 0x000055c15a92eef5 in do_command (thd=0x14d634000d58, blocking=blocking@entry=true) at /test/11.1_dbg/sql/sql_parse.cc:1405

#17 0x000055c15aa80cfc in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55c15db5b988, put_in_cache=put_in_cache@entry=true) at /test/11.1_dbg/sql/sql_connect.cc:1416

#18 0x000055c15aa80f5b in handle_one_connection (arg=0x55c15db5b988) at /test/11.1_dbg/sql/sql_connect.cc:1318

#19 0x000014d6e4740b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#20 0x000014d6e47d2a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Core was generated by `/test/MD290323-mariadb-10.11.3-linux-x86_64-opt/bin/mariadbd --no-defaults --co'.

Program terminated with signal SIGSEGV, Segmentation fault. 

#0  __pthread_kill_implementation (no_tid=0, signo=11, threadid=22438654330432)

    at ./nptl/pthread_kill.c:44

[Current thread is 1 (Thread 0x146868054640 (LWP 1243054))]

(gdb) bt

#0  __pthread_kill_implementation (no_tid=0, signo=11, threadid=22438654330432) at ./nptl/pthread_kill.c:44

#1  __pthread_kill_internal (signo=11, threadid=22438654330432) at ./nptl/pthread_kill.c:78

#2  __GI___pthread_kill (threadid=22438654330432, signo=11) at ./nptl/pthread_kill.c:89

#3  0x000055827c933828 in handle_fatal_signal (sig=<optimized out>) at /test/10.11_opt/sql/signal_handler.cc:357

#4  <signal handler called>

#5  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74

#6  0x000055827ca37712 in Item_func_monthname::val_str (this=0x1467d0010fe0, str=0x146868051960) at /test/10.11_opt/sql/item_timefunc.cc:997

#7  0x000055827c88eb38 in Type_handler::Item_send_str (this=<optimized out>, item=<optimized out>, protocol=0x1467d00011f0, buf=<optimized out>) at /test/10.11_opt/sql/sql_type.cc:7446

#8  0x000055827c6054fa in Protocol::send_result_set_row (this=this@entry=0x1467d00011f0, row_items=row_items@entry=0x1467d0010cf8) at /test/10.11_opt/sql/protocol.cc:1332

#9  0x000055827c682b27 in select_send::send_data (this=0x1467d0011a40, items=@0x1467d0010cf8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1467d0010780, last = 0x1467d0010780, elements = 1}, <No data fields>}) at /test/10.11_opt/sql/sql_class.cc:3103

#10 0x000055827c758730 in select_result_sink::send_data_with_check (u=<optimized out>, sent=0, items=<optimized out>, this=<optimized out>) at /test/10.11_opt/sql/sql_class.h:5746

#11 select_result_sink::send_data_with_check (sent=0, u=<optimized out>, items=<optimized out>, this=<optimized out>) at /test/10.11_opt/sql/sql_class.h:5736

#12 JOIN::exec_inner (this=0x1467d0011aa0) at /test/10.11_opt/sql/sql_select.cc:4701

#13 0x000055827c758f19 in JOIN::exec (this=this@entry=0x1467d0011aa0) at /test/10.11_opt/sql/sql_select.cc:4613

#14 0x000055827c756fc1 in mysql_select (thd=0x1467d0000c68, tables=0x0, fields=@0x1467d0010cf8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1467d0010780, last = 0x1467d0010780, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x1467d0011a40, unit=0x1467d0004ce8, select_lex=0x1467d0010a40) at /test/10.11_opt/sql/sql_select.cc:5093

#15 0x000055827c757714 in handle_select (thd=thd@entry=0x1467d0000c68, lex=lex@entry=0x1467d0004c10, result=result@entry=0x1467d0011a40, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.11_opt/sql/sql_select.cc:581

#16 0x000055827c6cf905 in execute_sqlcom_select (thd=0x1467d0000c68, all_tables=0x0) at /test/10.11_opt/sql/sql_parse.cc:6267

#17 0x000055827c6de9f0 in mysql_execute_command (thd=0x1467d0000c68, is_called_from_prepared_stmt=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:3949

#18 0x000055827c6e0284 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x1467d0000c68) at /test/10.11_opt/sql/sql_parse.cc:8002

#19 mysql_parse (thd=0x1467d0000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:7924

#20 0x000055827c6e28c2 in dispatch_command (command=COM_QUERY, thd=0x1467d0000c68, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:1991

#21 0x000055827c6e40a8 in do_command (thd=0x1467d0000c68, blocking=blocking@entry=true) at /test/10.11_opt/sql/sql_parse.cc:1407

#22 0x000055827c803c7f in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55827f2bb1e8, put_in_cache=put_in_cache@entry=true) at /test/10.11_opt/sql/sql_connect.cc:1416

#23 0x000055827c803f5d in handle_one_connection (arg=0x55827f2bb1e8) at /test/10.11_opt/sql/sql_connect.cc:1318

#24 0x000014687fa0ab43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#25 0x000014687fa9ca00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

2023-04-07 10:57:12 0 [Note] /test/UBASAN_MD250323-mariadb-11.0.2-linux-x86_64-opt/bin/mariadbd: ready for connections.

Version: '11.0.2-MariaDB'  socket: '/test/UBASAN_MD250323-mariadb-11.0.2-linux-x86_64-opt/socket.sock'  port: 11678  MariaDB Server

/test/11.0_opt_san/sql/item_timefunc.cc:997:38: runtime error: null pointer passed as argument 1, which is declared to never be null

    #0 0x5580a0843a5a in Item_func_monthname::val_str(String*) /test/11.0_opt_san/sql/item_timefunc.cc:997

    #1 0x5580a22a26d6 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_opt_san/sql/sql_type.cc:7446

    #2 0x5580a0e13a9c in Protocol::send_result_set_row(List<Item>*) /test/11.0_opt_san/sql/protocol.cc:1332

    #3 0x5580a11958aa in select_send::send_data(List<Item>&) /test/11.0_opt_san/sql/sql_class.cc:3102

    #4 0x5580a18f88a2 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_opt_san/sql/sql_class.h:5748

    #5 0x5580a18f88a2 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_opt_san/sql/sql_class.h:5738

    #6 0x5580a18f88a2 in JOIN::exec_inner() /test/11.0_opt_san/sql/sql_select.cc:4761

    #7 0x5580a18fd5b3 in JOIN::exec() /test/11.0_opt_san/sql/sql_select.cc:4672

    #8 0x5580a18eb050 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_opt_san/sql/sql_select.cc:5153

    #9 0x5580a18eebe0 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_opt_san/sql/sql_select.cc:611

    #10 0x5580a147be40 in execute_sqlcom_select /test/11.0_opt_san/sql/sql_parse.cc:6267

    #11 0x5580a14e153c in mysql_execute_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:3949

    #12 0x5580a14f2322 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_opt_san/sql/sql_parse.cc:7999

    #13 0x5580a14fffad in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_opt_san/sql/sql_parse.cc:1894

    #14 0x5580a1509718 in do_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:1407

    #15 0x5580a1e0ac2c in do_handle_one_connection(CONNECT*, bool) /test/11.0_opt_san/sql/sql_connect.cc:1416

    #16 0x5580a1e0d22c in handle_one_connection /test/11.0_opt_san/sql/sql_connect.cc:1318

    #17 0x145a54f29b42 in start_thread nptl/pthread_create.c:442

    #18 0x145a54fbb9ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

230407 10:57:13 [ERROR] mysqld got signal 11 ;

2023-04-07 10:57:39 0 [Note] /test/UBASAN_MD250323-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd: ready for connections.

Version: '11.0.2-MariaDB-debug'  socket: '/test/UBASAN_MD250323-mariadb-11.0.2-linux-x86_64-dbg/socket.sock'  port: 12441  MariaDB Server

/test/11.0_dbg_san/sql/item_timefunc.cc:997:38: runtime error: null pointer passed as argument 1, which is declared to never be null

    #0 0x560971984914 in Item_func_monthname::val_str(String*) /test/11.0_dbg_san/sql/item_timefunc.cc:997

    #1 0x5609705215a1 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7446

    #2 0x56096ff6faa2 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5455

    #3 0x56096ed1359c in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235

    #4 0x56096eecf05c in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332

    #5 0x56096f2989ca in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102

    #6 0x56096fa0fb03 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748

    #7 0x56096fa0fb03 in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4761

    #8 0x56096fa1657a in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4672

    #9 0x56096fa04d38 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5153

    #10 0x56096fa09193 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:611

    #11 0x56096f588973 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6267

    #12 0x56096f5e9cce in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949

    #13 0x56096f6195e6 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999

    #14 0x56096f62937a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894

    #15 0x56096f63717f in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407

    #16 0x56096fffb459 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416

    #17 0x56096fffc974 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318

    #18 0x14c005515b42 in start_thread nptl/pthread_create.c:442

    #19 0x14c0055a79ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

230407 10:57:41 [ERROR] mysqld got signal 11 ;