[MDEV-31221] UBSAN runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int' in my_strtoll10_utf32 - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL)
Fix Version/s: 10.5.27, 10.6.20, 10.11.10, 11.2.6, 11.4.4, 11.6.2, 11.7.0
Component/s: Character Sets, Data types
Labels:
None

Description

SELECT CAST(CONVERT('-9223372036854775808' USING utf32) AS SIGNED);

Leads to:

11.0.2 8e55d7ea4a2f94ae3f38fdd8785778612d4b1203 (Debug)
/test/11.0_dbg_san/strings/ctype-ucs2.c:2604:11: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself

11.0.2 8e55d7ea4a2f94ae3f38fdd8785778612d4b1203 (Debug)
#0 0x560ec6266926 in my_strtoll10_utf32 /test/11.0_dbg_san/strings/ctype-ucs2.c:2604
#1 0x560ec3b8cb34 in charset_info_st::strtoll10(char const, char, int) const /test/11.0_dbg_san/include/m_ctype.h:932
#2 0x560ec3b8cb34 in Value_source::Converter_strtoll10::Converter_strtoll10(charset_info_st const, char const, unsigned long) /test/11.0_dbg_san/sql/field.h:247
#3 0x560ec3b8cb34 in Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn(THD, Value_source::Warn_filter, charset_info_st const, char const*, unsigned long) /test/11.0_dbg_san/sql/field.h:305
#4 0x560ec3b8cb34 in Item::val_int_from_str(int*) /test/11.0_dbg_san/sql/item.cc:252
#5 0x560ec3b8d272 in Item::val_int_signed_typecast_from_str() /test/11.0_dbg_san/sql/item.cc:261
#6 0x560ec320996f in Type_handler_string_result::Item_val_int_signed_typecast(Item*) const /test/11.0_dbg_san/sql/sql_type.cc:5218
#7 0x560ec1abcacf in Item::val_int_signed_typecast() /test/11.0_dbg_san/sql/item.h:1472
#8 0x560ec40f12c6 in Item_func_signed::val_int() /test/11.0_dbg_san/sql/item_func.h:1330
#9 0x560ec32c61ec in Type_handler::Item_send_longlong(Item, Protocol, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7488
#10 0x560ec332e1c4 in Type_handler_longlong::Item_send(Item, Protocol, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5760
#11 0x560ec1ab669e in Item::send(Protocol, st_value) /test/11.0_dbg_san/sql/item.h:1235
#12 0x560ec1c7215e in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
#13 0x560ec203be8c in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
#14 0x560ec27b2fc5 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
#15 0x560ec27b2fc5 in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4761
#16 0x560ec27b9a3c in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4672
#17 0x560ec27a81fa in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.0_dbg_san/sql/sql_select.cc:5153
#18 0x560ec27ac655 in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:611
#19 0x560ec232be35 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6267
#20 0x560ec238d190 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
#21 0x560ec23bcaa8 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
#22 0x560ec23cc83c in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
#23 0x560ec23da641 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
#24 0x560ec2d9e91b in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
#25 0x560ec2d9fe36 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
#26 0x152b8be94b42 in start_thread nptl/pthread_create.c:442
#27 0x152b8bf269ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

Setup:

Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1

Bug confirmed present in:
MariaDB: 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt), 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.3 (dbg), 10.11.3 (opt), 11.0.2 (dbg), 11.0.2 (opt), 11.1.0 (dbg), 11.1.0 (opt)

Attachments

Issue Links

is duplicated by

MDEV-28387 UBSAN: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in my_strtoll10 on SELECT

Closed

relates to

MDEV-28386 UBSAN: runtime error: negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in my_strntoull_8bit on SELECT ... OCT

Closed

MDEV-30931 UBSAN: negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in get_interval_value on SELECT

Closed

MDEV-34027 Server stack-buffer-overflow at int2str

Closed

Activity

Ascending order - Click to sort in descending order

Roel Van de Paar added a comment - 2023-05-13 03:02 - edited

Four additional stacks/UniqueID's with this additional testcase:

SELECT (-1/1)/(-1/CONV(0,0,'-9223372036854775808/-1'));

Leads to (one additional stack/UniqueID per line):

UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn|Value_source::longlong_from_string_with_check

UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|charset_info_st::strtoll10|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn

UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|my_strtoll10_8bit|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn

UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|my_strtoll10_8bit|charset_info_st::strtoll10|Value_source::Converter_strtoll10::Converter_strtoll10

Across versions/build types.

Roel Van de Paar added a comment - 2023-05-13 03:02 - edited Four additional stacks/UniqueID's with this additional testcase: SELECT (-1/1)/(-1/CONV(0,0, '-9223372036854775808/-1' )); Leads to (one additional stack/UniqueID per line): UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn|Value_source::longlong_from_string_with_check UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|charset_info_st::strtoll10|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|my_strtoll10_8bit|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|my_strtoll10_8bit|charset_info_st::strtoll10|Value_source::Converter_strtoll10::Converter_strtoll10 Across versions/build types.

Roel Van de Paar added a comment - 2024-02-23 22:37

Slightly different UniqueID/stack with:

SELECT CAST(CONVERT ('-9223372036854775808' USING utf16le) AS SIGNED);

UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/ctype-ucs2.c|my_strtoll10_mb2|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn|Item::val_int_from_str

UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/ctype-ucs2.c|my_strtoll10_mb2|charset_info_st::strtoll10|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn

Roel Van de Paar added a comment - 2024-02-23 22:37 Slightly different UniqueID/stack with: SELECT CAST ( CONVERT ( '-9223372036854775808' USING utf16le) AS SIGNED); UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/ctype-ucs2.c|my_strtoll10_mb2|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn|Item::val_int_from_str UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/ctype-ucs2.c|my_strtoll10_mb2|charset_info_st::strtoll10|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn

Roel Van de Paar added a comment - 2024-02-27 20:41

A significant connection between this bug and ~~MDEV-28386~~ seems to exist.

Roel Van de Paar added a comment - 2024-02-27 20:41 A significant connection between this bug and MDEV-28386 seems to exist.

Roel Van de Paar added a comment - 2024-02-27 20:43

SELECT BIN(CONVERT(-9223372036854775808 USING ucs2));

Leads to additional stacks:

UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/ctype-ucs2.c|my_strntoull_mb2_or_mb4|Item_func_conv::val_str|Type_handler::Item_send_str|Protocol::send_result_set_row

UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/ctype-ucs2.c|my_strntoull_mb2_or_mb4|Item_func_conv::val_str|Type_handler::Item_send_str|Type_handler_string_result::Item_send

UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/ctype-ucs2.c|my_strntoull_mb2_or_mb4|charset_info_st::strntoull|Item_func_conv::val_str|Type_handler::Item_send_str

Roel Van de Paar added a comment - 2024-02-27 20:43 SELECT BIN( CONVERT (-9223372036854775808 USING ucs2)); Leads to additional stacks: UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/ctype-ucs2.c|my_strntoull_mb2_or_mb4|Item_func_conv::val_str|Type_handler::Item_send_str|Protocol::send_result_set_row UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/ctype-ucs2.c|my_strntoull_mb2_or_mb4|Item_func_conv::val_str|Type_handler::Item_send_str|Type_handler_string_result::Item_send UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/ctype-ucs2.c|my_strntoull_mb2_or_mb4|charset_info_st::strntoull|Item_func_conv::val_str|Type_handler::Item_send_str

MariaDB Server

UBSAN runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int' in my_strtoll10_utf32

Details

Description

Attachments

Issue Links

Activity

People

Dates

Git Integration