Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL)
-
None
Description
SELECT CAST(CONVERT('-9223372036854775808' USING utf32) AS SIGNED); |
Leads to:
11.0.2 8e55d7ea4a2f94ae3f38fdd8785778612d4b1203 (Debug) |
/test/11.0_dbg_san/strings/ctype-ucs2.c:2604:11: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself
|
11.0.2 8e55d7ea4a2f94ae3f38fdd8785778612d4b1203 (Debug) |
#0 0x560ec6266926 in my_strtoll10_utf32 /test/11.0_dbg_san/strings/ctype-ucs2.c:2604
|
#1 0x560ec3b8cb34 in charset_info_st::strtoll10(char const*, char**, int*) const /test/11.0_dbg_san/include/m_ctype.h:932
|
#2 0x560ec3b8cb34 in Value_source::Converter_strtoll10::Converter_strtoll10(charset_info_st const*, char const*, unsigned long) /test/11.0_dbg_san/sql/field.h:247
|
#3 0x560ec3b8cb34 in Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn(THD*, Value_source::Warn_filter, charset_info_st const*, char const*, unsigned long) /test/11.0_dbg_san/sql/field.h:305
|
#4 0x560ec3b8cb34 in Item::val_int_from_str(int*) /test/11.0_dbg_san/sql/item.cc:252
|
#5 0x560ec3b8d272 in Item::val_int_signed_typecast_from_str() /test/11.0_dbg_san/sql/item.cc:261
|
#6 0x560ec320996f in Type_handler_string_result::Item_val_int_signed_typecast(Item*) const /test/11.0_dbg_san/sql/sql_type.cc:5218
|
#7 0x560ec1abcacf in Item::val_int_signed_typecast() /test/11.0_dbg_san/sql/item.h:1472
|
#8 0x560ec40f12c6 in Item_func_signed::val_int() /test/11.0_dbg_san/sql/item_func.h:1330
|
#9 0x560ec32c61ec in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7488
|
#10 0x560ec332e1c4 in Type_handler_longlong::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5760
|
#11 0x560ec1ab669e in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235
|
#12 0x560ec1c7215e in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
|
#13 0x560ec203be8c in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
|
#14 0x560ec27b2fc5 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
|
#15 0x560ec27b2fc5 in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4761
|
#16 0x560ec27b9a3c in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4672
|
#17 0x560ec27a81fa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5153
|
#18 0x560ec27ac655 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:611
|
#19 0x560ec232be35 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6267
|
#20 0x560ec238d190 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
|
#21 0x560ec23bcaa8 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
|
#22 0x560ec23cc83c in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
|
#23 0x560ec23da641 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
|
#24 0x560ec2d9e91b in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
|
#25 0x560ec2d9fe36 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
|
#26 0x152b8be94b42 in start_thread nptl/pthread_create.c:442
|
#27 0x152b8bf269ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
|
Setup:
Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and:
|
-DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON
|
Set before execution:
|
export UBSAN_OPTIONS=print_stacktrace=1
|
Bug confirmed present in:
MariaDB: 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt), 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.3 (dbg), 10.11.3 (opt), 11.0.2 (dbg), 11.0.2 (opt), 11.1.0 (dbg), 11.1.0 (opt)
Attachments
Issue Links
- is duplicated by
-
MDEV-28387 UBSAN: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in my_strtoll10 on SELECT
-
- Closed
-
- relates to
-
MDEV-28386 UBSAN: runtime error: negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in my_strntoull_8bit on SELECT ... OCT
-
- Closed
-
-
MDEV-30931 UBSAN: negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in get_interval_value on SELECT
-
- Closed
-
-
MDEV-34027 Server stack-buffer-overflow at int2str
-
- Closed
-
Activity
Field | Original Value | New Value |
---|---|---|
Link |
This issue relates to |
Description |
{code:sql}
SELECT CAST(CONVERT ('-9223372036854775808' USING utf32) AS SIGNED); {code} Leads to: {noformat:title=11.0.2 8e55d7ea4a2f94ae3f38fdd8785778612d4b1203 (Debug)} /test/11.0_dbg_san/strings/ctype-ucs2.c:2604:11: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself {noformat} {noformat:title=11.0.2 8e55d7ea4a2f94ae3f38fdd8785778612d4b1203 (Debug)} #0 0x560ec6266926 in my_strtoll10_utf32 /test/11.0_dbg_san/strings/ctype-ucs2.c:2604 #1 0x560ec3b8cb34 in charset_info_st::strtoll10(char const*, char**, int*) const /test/11.0_dbg_san/include/m_ctype.h:932 #2 0x560ec3b8cb34 in Value_source::Converter_strtoll10::Converter_strtoll10(charset_info_st const*, char const*, unsigned long) /test/11.0_dbg_san/sql/field.h:247 #3 0x560ec3b8cb34 in Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn(THD*, Value_source::Warn_filter, charset_info_st const*, char const*, unsigned long) /test/11.0_dbg_san/sql/field.h:305 #4 0x560ec3b8cb34 in Item::val_int_from_str(int*) /test/11.0_dbg_san/sql/item.cc:252 #5 0x560ec3b8d272 in Item::val_int_signed_typecast_from_str() /test/11.0_dbg_san/sql/item.cc:261 #6 0x560ec320996f in Type_handler_string_result::Item_val_int_signed_typecast(Item*) const /test/11.0_dbg_san/sql/sql_type.cc:5218 #7 0x560ec1abcacf in Item::val_int_signed_typecast() /test/11.0_dbg_san/sql/item.h:1472 #8 0x560ec40f12c6 in Item_func_signed::val_int() /test/11.0_dbg_san/sql/item_func.h:1330 #9 0x560ec32c61ec in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7488 #10 0x560ec332e1c4 in Type_handler_longlong::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5760 #11 0x560ec1ab669e in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235 #12 0x560ec1c7215e in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332 #13 0x560ec203be8c in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102 #14 0x560ec27b2fc5 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748 #15 0x560ec27b2fc5 in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4761 #16 0x560ec27b9a3c in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4672 #17 0x560ec27a81fa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5153 #18 0x560ec27ac655 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:611 #19 0x560ec232be35 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6267 #20 0x560ec238d190 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949 #21 0x560ec23bcaa8 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999 #22 0x560ec23cc83c in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894 #23 0x560ec23da641 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407 #24 0x560ec2d9e91b in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416 #25 0x560ec2d9fe36 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318 #26 0x152b8be94b42 in start_thread nptl/pthread_create.c:442 #27 0x152b8bf269ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff) {noformat} Setup: {noformat} Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and: -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON Set before execution: export UBSAN_OPTIONS=print_stacktrace=1 {noformat} Bug confirmed present in: MariaDB: 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt), 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.3 (dbg), 10.11.3 (opt), 11.0.2 (dbg), 11.0.2 (opt), 11.1.0 (dbg), 11.1.0 (opt) |
{code:sql}
SELECT CAST(CONVERT('-9223372036854775808' USING utf32) AS SIGNED); {code} Leads to: {noformat:title=11.0.2 8e55d7ea4a2f94ae3f38fdd8785778612d4b1203 (Debug)} /test/11.0_dbg_san/strings/ctype-ucs2.c:2604:11: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself {noformat} {noformat:title=11.0.2 8e55d7ea4a2f94ae3f38fdd8785778612d4b1203 (Debug)} #0 0x560ec6266926 in my_strtoll10_utf32 /test/11.0_dbg_san/strings/ctype-ucs2.c:2604 #1 0x560ec3b8cb34 in charset_info_st::strtoll10(char const*, char**, int*) const /test/11.0_dbg_san/include/m_ctype.h:932 #2 0x560ec3b8cb34 in Value_source::Converter_strtoll10::Converter_strtoll10(charset_info_st const*, char const*, unsigned long) /test/11.0_dbg_san/sql/field.h:247 #3 0x560ec3b8cb34 in Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn(THD*, Value_source::Warn_filter, charset_info_st const*, char const*, unsigned long) /test/11.0_dbg_san/sql/field.h:305 #4 0x560ec3b8cb34 in Item::val_int_from_str(int*) /test/11.0_dbg_san/sql/item.cc:252 #5 0x560ec3b8d272 in Item::val_int_signed_typecast_from_str() /test/11.0_dbg_san/sql/item.cc:261 #6 0x560ec320996f in Type_handler_string_result::Item_val_int_signed_typecast(Item*) const /test/11.0_dbg_san/sql/sql_type.cc:5218 #7 0x560ec1abcacf in Item::val_int_signed_typecast() /test/11.0_dbg_san/sql/item.h:1472 #8 0x560ec40f12c6 in Item_func_signed::val_int() /test/11.0_dbg_san/sql/item_func.h:1330 #9 0x560ec32c61ec in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7488 #10 0x560ec332e1c4 in Type_handler_longlong::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5760 #11 0x560ec1ab669e in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235 #12 0x560ec1c7215e in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332 #13 0x560ec203be8c in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102 #14 0x560ec27b2fc5 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748 #15 0x560ec27b2fc5 in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4761 #16 0x560ec27b9a3c in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4672 #17 0x560ec27a81fa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5153 #18 0x560ec27ac655 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:611 #19 0x560ec232be35 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6267 #20 0x560ec238d190 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949 #21 0x560ec23bcaa8 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999 #22 0x560ec23cc83c in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894 #23 0x560ec23da641 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407 #24 0x560ec2d9e91b in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416 #25 0x560ec2d9fe36 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318 #26 0x152b8be94b42 in start_thread nptl/pthread_create.c:442 #27 0x152b8bf269ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff) {noformat} Setup: {noformat} Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and: -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON Set before execution: export UBSAN_OPTIONS=print_stacktrace=1 {noformat} Bug confirmed present in: MariaDB: 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt), 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.3 (dbg), 10.11.3 (opt), 11.0.2 (dbg), 11.0.2 (opt), 11.1.0 (dbg), 11.1.0 (opt) |
Status | Open [ 1 ] | Confirmed [ 10101 ] |
Fix Version/s | 10.9 [ 26905 ] |
Fix Version/s | 10.10 [ 27530 ] |
Link |
This issue relates to |
Link |
This issue relates to |
Link |
This issue relates to |
Fix Version/s | 11.0 [ 28320 ] |
Fix Version/s | 10.4 [ 22408 ] |
Fix Version/s | 11.1 [ 28549 ] |
Link |
This issue relates to |
issue.field.resolutiondate | 2024-09-20 09:57:46.0 | 2024-09-20 09:57:45.826 |
Fix Version/s | 10.5.27 [ 29902 ] | |
Fix Version/s | 10.6.20 [ 29903 ] | |
Fix Version/s | 10.11.10 [ 29904 ] | |
Fix Version/s | 11.2.6 [ 29906 ] | |
Fix Version/s | 11.4.4 [ 29907 ] | |
Fix Version/s | 11.6.2 [ 29908 ] | |
Fix Version/s | 11.7.0 [ 29912 ] | |
Fix Version/s | 10.5 [ 23123 ] | |
Fix Version/s | 10.6 [ 24028 ] | |
Fix Version/s | 10.11 [ 27614 ] | |
Resolution | Fixed [ 1 ] | |
Status | Confirmed [ 10101 ] | Closed [ 6 ] |
Link |
This issue is duplicated by |
Four additional stacks/UniqueID's with this additional testcase:
Leads to (one additional stack/UniqueID per line):
UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn|Value_source::longlong_from_string_with_check
UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|charset_info_st::strtoll10|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn
UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|my_strtoll10_8bit|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn
UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|my_strtoll10_8bit|charset_info_st::strtoll10|Value_source::Converter_strtoll10::Converter_strtoll10
Across versions/build types.