Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL)
-
None
Description
SELECT CAST(CONVERT('-9223372036854775808' USING utf32) AS SIGNED); |
Leads to:
11.0.2 8e55d7ea4a2f94ae3f38fdd8785778612d4b1203 (Debug) |
/test/11.0_dbg_san/strings/ctype-ucs2.c:2604:11: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself
|
11.0.2 8e55d7ea4a2f94ae3f38fdd8785778612d4b1203 (Debug) |
#0 0x560ec6266926 in my_strtoll10_utf32 /test/11.0_dbg_san/strings/ctype-ucs2.c:2604
|
#1 0x560ec3b8cb34 in charset_info_st::strtoll10(char const*, char**, int*) const /test/11.0_dbg_san/include/m_ctype.h:932
|
#2 0x560ec3b8cb34 in Value_source::Converter_strtoll10::Converter_strtoll10(charset_info_st const*, char const*, unsigned long) /test/11.0_dbg_san/sql/field.h:247
|
#3 0x560ec3b8cb34 in Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn(THD*, Value_source::Warn_filter, charset_info_st const*, char const*, unsigned long) /test/11.0_dbg_san/sql/field.h:305
|
#4 0x560ec3b8cb34 in Item::val_int_from_str(int*) /test/11.0_dbg_san/sql/item.cc:252
|
#5 0x560ec3b8d272 in Item::val_int_signed_typecast_from_str() /test/11.0_dbg_san/sql/item.cc:261
|
#6 0x560ec320996f in Type_handler_string_result::Item_val_int_signed_typecast(Item*) const /test/11.0_dbg_san/sql/sql_type.cc:5218
|
#7 0x560ec1abcacf in Item::val_int_signed_typecast() /test/11.0_dbg_san/sql/item.h:1472
|
#8 0x560ec40f12c6 in Item_func_signed::val_int() /test/11.0_dbg_san/sql/item_func.h:1330
|
#9 0x560ec32c61ec in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7488
|
#10 0x560ec332e1c4 in Type_handler_longlong::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5760
|
#11 0x560ec1ab669e in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235
|
#12 0x560ec1c7215e in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
|
#13 0x560ec203be8c in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
|
#14 0x560ec27b2fc5 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
|
#15 0x560ec27b2fc5 in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4761
|
#16 0x560ec27b9a3c in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4672
|
#17 0x560ec27a81fa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5153
|
#18 0x560ec27ac655 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:611
|
#19 0x560ec232be35 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6267
|
#20 0x560ec238d190 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
|
#21 0x560ec23bcaa8 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
|
#22 0x560ec23cc83c in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
|
#23 0x560ec23da641 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
|
#24 0x560ec2d9e91b in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
|
#25 0x560ec2d9fe36 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
|
#26 0x152b8be94b42 in start_thread nptl/pthread_create.c:442
|
#27 0x152b8bf269ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
|
Setup:
Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and:
|
-DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON
|
Set before execution:
|
export UBSAN_OPTIONS=print_stacktrace=1
|
Bug confirmed present in:
MariaDB: 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt), 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.3 (dbg), 10.11.3 (opt), 11.0.2 (dbg), 11.0.2 (opt), 11.1.0 (dbg), 11.1.0 (opt)
Attachments
Issue Links
- is duplicated by
-
MDEV-28387 UBSAN: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in my_strtoll10 on SELECT
- Closed
- relates to
-
MDEV-28386 UBSAN: runtime error: negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in my_strntoull_8bit on SELECT ... OCT
- Closed
-
MDEV-30931 UBSAN: negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in get_interval_value on SELECT
- Closed
-
MDEV-34027 Server stack-buffer-overflow at int2str
- Closed