Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-31302

Assertion `mon > 0 && mon < 13' failed in my_time_t sec_since_epoch(int, int, int, int, int, int)

Details

    Description

      CREATE TABLE t (a DATE) ENGINE=INNODB;
      		 
      SET @@time_zone='+1:00';
      		 
      INSERT INTO t VALUES ('24:00:01');
      		 
      SELECT UNIX_TIMESTAMP(MAX(a)) AS a FROM t;

      Leads to:

      11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug)

      		 
      mariadbd: /test/mtest/11.0_dbg/sql/tztime.cc:801: my_time_t sec_since_epoch(int, int, int, int, int, int): Assertion `mon > 0 && mon < 13' failed.

      11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug)

      		 
      Core was generated by `/test/mtest/GAL_MD170523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd --no-defa'.
      		 
      Program terminated with signal SIGABRT, Aborted.
      		 
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
      		 
          at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      		 
      [Current thread is 1 (Thread 0x14ef714c1700 (LWP 519733))]
      		 
      (gdb) bt
      		 
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      		 
      #1  0x000055cb25c36747 in my_write_core (sig=sig@entry=6) at /test/mtest/11.0_dbg/mysys/stacktrace.c:424
      		 
      #2  0x000055cb25524460 in handle_fatal_signal (sig=6) at /test/mtest/11.0_dbg/sql/signal_handler.cc:360
      		 
      #3  <signal handler called>
      		 
      #4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      		 
      #5  0x000014ef8ac68859 in __GI_abort () at abort.c:79
      		 
      #6  0x000014ef8ac68729 in __assert_fail_base (fmt=0x14ef8adfe588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x55cb25e1ff96 "mon > 0 && mon < 13", file=0x55cb25e20038 "/test/mtest/11.0_dbg/sql/tztime.cc", line=801, function=<optimized out>) at assert.c:92
      		 
      #7  0x000014ef8ac79fd6 in __GI___assert_fail (assertion=assertion@entry=0x55cb25e1ff96 "mon > 0 && mon < 13", file=file@entry=0x55cb25e20038 "/test/mtest/11.0_dbg/sql/tztime.cc", line=line@entry=801, function=function@entry=0x55cb25e20128 "my_time_t sec_since_epoch(int, int, int, int, int, int)") at assert.c:101
      		 
      #8  0x000055cb2537082f in sec_since_epoch (year=2024, mon=0, mday=1, hour=0, min=0, sec=0) at /test/mtest/11.0_dbg/sql/tztime.cc:801
      		 
      #9  0x000055cb25370fa5 in Time_zone_offset::TIME_to_gmt_sec (this=0x55cb27817648, t=<optimized out>, error_code=0x14ef714bed4c) at /test/mtest/11.0_dbg/sql/tztime.cc:1386
      		 
      #10 0x000055cb2536e1e2 in TIME_to_timestamp (thd=<optimized out>, t=t@entry=0x14ef714beda0, error_code=error_code@entry=0x14ef714bed4c) at /test/mtest/11.0_dbg/sql/sql_time.cc:512
      		 
      #11 0x000055cb25448d8a in Timestamp::Timestamp (this=this@entry=0x14ef714bed50, thd=<optimized out>, ltime=ltime@entry=0x14ef714beda0, error_code=error_code@entry=0x14ef714bed4c) at /test/mtest/11.0_dbg/sql/sql_type.cc:404
      		 
      #12 0x000055cb25448dfd in Timestamp_or_zero_datetime::Timestamp_or_zero_datetime (this=0x14ef714bed50, thd=<optimized out>, ltime=0x14ef714beda0, error_code=0x14ef714bed4c) at /test/mtest/11.0_dbg/sql/sql_type.cc:409
      		 
      #13 0x000055cb25453b1c in Type_handler_timestamp_common::TIME_to_native (this=this@entry=0x55cb2680f830 <type_handler_timestamp2>, thd=thd@entry=0x14ef20000d48, ltime=ltime@entry=0x14ef714beda0, to=to@entry=0x14ef714bee50, decimals=decimals@entry=0) at /test/mtest/11.0_dbg/sql/sql_type.cc:9025
      		 
      #14 0x000055cb25453c8a in Type_handler_timestamp_common::Item_val_native_with_conversion (this=this@entry=0x55cb2680f830 <type_handler_timestamp2>, thd=thd@entry=0x14ef20000d48, item=item@entry=0x14ef200156b8, to=to@entry=0x14ef714bee50) at /test/mtest/11.0_dbg/sql/sql_type.h:2567
      		 
      #15 0x000055cb25453ff7 in Timestamp_or_zero_datetime_native_null::Timestamp_or_zero_datetime_native_null (this=0x14ef714bee50, thd=0x14ef20000d48, item=0x14ef200156b8, conv=<optimized out>) at /test/mtest/11.0_dbg/sql/sql_type.cc:9089
      		 
      #16 0x000055cb2566be34 in Item_func_unix_timestamp::get_timestamp_value (this=0x14ef200139b8, seconds=seconds@entry=0x14ef714beec8, second_part=second_part@entry=0x14ef714beec0) at /test/mtest/11.0_dbg/sql/item_timefunc.cc:1229
      		 
      #17 0x000055cb2566bfb6 in Item_func_unix_timestamp::int_op (this=<optimized out>) at /test/mtest/11.0_dbg/sql/item_timefunc.cc:1246
      		 
      #18 0x000055cb254355ac in Item_func_hybrid_field_type::val_int_from_int_op (this=<optimized out>) at /test/mtest/11.0_dbg/sql/item_func.h:849
      		 
      #19 Type_handler_int_result::Item_func_hybrid_field_type_val_int (this=<optimized out>, item=<optimized out>) at /test/mtest/11.0_dbg/sql/sql_type.cc:5406
      		 
      #20 0x000055cb25588bed in Item_func_hybrid_field_type::val_int (this=0x14ef200139b8) at /test/mtest/11.0_dbg/sql/sql_type.h:7441
      		 
      #21 0x000055cb254533e5 in Type_handler::Item_send_longlong (this=<optimized out>, item=0x14ef200139b8, protocol=0x14ef20001358, buf=<optimized out>) at /test/mtest/11.0_dbg/sql/sql_type.cc:7488
      		 
      #22 0x000055cb2545b71f in Type_handler_longlong::Item_send (this=<optimized out>, item=<optimized out>, protocol=<optimized out>, buf=<optimized out>) at /test/mtest/11.0_dbg/sql/sql_type.h:5760
      		 
      #23 0x000055cb2510dd1a in Item::send (this=0x14ef200139b8, protocol=0x14ef20001358, buffer=0x14ef714bef70) at /test/mtest/11.0_dbg/sql/item.h:1235
      		 
      #24 0x000055cb25145fe9 in Protocol::send_result_set_row (this=this@entry=0x14ef20001358, row_items=row_items@entry=0x14ef20014f60) at /test/mtest/11.0_dbg/sql/protocol.cc:1332
      		 
      #25 0x000055cb251ce7df in select_send::send_data (this=0x14ef20014af8, items=@0x14ef20014f60: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14ef20016a10, last = 0x14ef20016a10, elements = 1}, <No data fields>}) at /test/mtest/11.0_dbg/sql/sql_class.cc:3102
      		 
      #26 0x000055cb252b5510 in select_result_sink::send_data_with_check (sent=<optimized out>, u=<optimized out>, items=@0x14ef20014f60: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14ef20016a10, last = 0x14ef20016a10, elements = 1}, <No data fields>}, this=<optimized out>) at /test/mtest/11.0_dbg/sql/sql_class.h:5748
      		 
      #27 end_send_group (join=0x14ef20014b20, join_tab=<optimized out>, end_of_records=<optimized out>) at /test/mtest/11.0_dbg/sql/sql_select.cc:24676
      		 
      #28 0x000055cb2528ffd9 in sub_select (join=0x14ef20014b20, join_tab=0x14ef20067960, end_of_records=true) at /test/mtest/11.0_dbg/sql/sql_select.cc:23185
      		 
      #29 0x000055cb252c9abf in do_select (procedure=<optimized out>, join=0x14ef20014b20) at /test/mtest/11.0_dbg/sql/sql_select.cc:22782
      		 
      #30 JOIN::exec_inner (this=this@entry=0x14ef20014b20) at /test/mtest/11.0_dbg/sql/sql_select.cc:4900
      		 
      #31 0x000055cb252c9fc1 in JOIN::exec (this=this@entry=0x14ef20014b20) at /test/mtest/11.0_dbg/sql/sql_select.cc:4677
      		 
      #32 0x000055cb252c7e9a in mysql_select (thd=thd@entry=0x14ef20000d48, tables=0x14ef20013ac8, fields=@0x14ef200134d8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14ef20013a78, last = 0x14ef20013a78, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x14ef20014af8, unit=0x14ef20004f90, select_lex=0x14ef20013220) at /test/mtest/11.0_dbg/sql/sql_select.cc:5158
      		 
      #33 0x000055cb252c8626 in handle_select (thd=thd@entry=0x14ef20000d48, lex=lex@entry=0x14ef20004eb8, result=result@entry=0x14ef20014af8, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/mtest/11.0_dbg/sql/sql_select.cc:616
      		 
      #34 0x000055cb2522b64f in execute_sqlcom_select (thd=thd@entry=0x14ef20000d48, all_tables=0x14ef20013ac8) at /test/mtest/11.0_dbg/sql/sql_parse.cc:6279
      		 
      #35 0x000055cb25237924 in mysql_execute_command (thd=thd@entry=0x14ef20000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/mtest/11.0_dbg/sql/sql_parse.cc:3949
      		 
      #36 0x000055cb25225732 in mysql_parse (thd=thd@entry=0x14ef20000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14ef714c0300) at /test/mtest/11.0_dbg/sql/sql_parse.cc:8014
      		 
      #37 0x000055cb252330b5 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14ef20000d48, packet=packet@entry=0x14ef2000ae39 "", packet_length=packet_length@entry=41, blocking=blocking@entry=true) at /test/mtest/11.0_dbg/sql/sql_class.h:1370
      		 
      #38 0x000055cb25235518 in do_command (thd=0x14ef20000d48, blocking=blocking@entry=true) at /test/mtest/11.0_dbg/sql/sql_parse.cc:1407
      		 
      #39 0x000055cb2539e29e in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55cb2784b978, put_in_cache=put_in_cache@entry=true) at /test/mtest/11.0_dbg/sql/sql_connect.cc:1416
      		 
      #40 0x000055cb2539e770 in handle_one_connection (arg=0x55cb2784b978) at /test/mtest/11.0_dbg/sql/sql_connect.cc:1318
      		 
      #41 0x000014ef8b179609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      		 
      #42 0x000014ef8ad65133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

      Bug confirmed present in:
      MariaDB: 10.4.30 (dbg), 10.5.21 (dbg), 10.6.14 (dbg), 10.8.8 (dbg), 10.9.7 (dbg), 10.10.5 (dbg), 10.11.4 (dbg), 11.0.2 (dbg), 11.1.0 (dbg)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.4.30 (opt), 10.5.21 (opt), 10.6.14 (opt), 10.8.8 (opt), 10.9.7 (opt), 10.10.5 (opt), 10.11.4 (opt), 11.0.2 (opt), 11.1.0 (opt)

      Attachments

        Issue Links

          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-33848 ASAN global-buffer-overflow at sec_since_epoch

          • Major - Major loss of function.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-22734 Assertion `mon > 0 && mon < 13' failed in sec_since_epoch

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            alice Alice Sherepa added a comment -

            Test case from MDEV-33848:

            SELECT CONVERT_TZ(MAX(GREATEST(DATE('2021-00-00'), DATE('2021-00-00'))), '+00:00', '+7:5');


            mysqld: /10.4/src/sql/tztime.cc:801: my_time_t sec_since_epoch(int, int, int, int, int, int): Assertion `mon > 0 && mon < 13' failed.
            		 
            240408  9:24:59 [ERROR] mysqld got signal 6 ;
            		 
             
            		 
            Server version: 10.4.34-MariaDB-debug-log source revision: 8cc36fb7434114fce06725cc607c2f7c65ac3ac7
            		 
             
            		 
            /lib/x86_64-linux-gnu/libc.so.6(+0x33fd6)[0x7f6269afefd6]
            		 
            sql/tztime.cc:802(sec_since_epoch(int, int, int, int, int, int))[0x558de5bb830b]
            		 
            sql/tztime.cc:1386(Time_zone_offset::TIME_to_gmt_sec(st_mysql_time const*, unsigned int*) const)[0x558de5bb9e82]
            		 
            sql/item_timefunc.cc:1993(Item_func_convert_tz::get_date(THD*, st_mysql_time*, date_mode_t))[0x558de62cbebf]
            		 
            sql/sql_type.cc:7189(Type_handler::Item_send_datetime(Item*, Protocol*, st_value*) const)[0x558de5dd52a6]
            		 
            sql/sql_type.h:5846(Type_handler_datetime_common::Item_send(Item*, Protocol*, st_value*) const)[0x558de5defa7e]
            		 
            sql/item.h:1059(Item::send(Protocol*, st_value*))[0x558de5578284]
            		 
            sql/protocol.cc:1033(Protocol::send_result_set_row(List<Item>*))[0x558de55697c1]
            		 
            sql/sql_class.cc:3144(select_send::send_data(List<Item>&))[0x558de571e8db]
            		 
            sql/sql_select.cc:22315(end_send_group(JOIN*, st_join_table*, bool))[0x558de5999d29]
            		 
            sql/sql_select.cc:20417(do_select(JOIN*, Procedure*))[0x558de598c66b]
            		 
            sql/sql_select.cc:4650(JOIN::exec_inner())[0x558de591a8fc]
            		 
            sql/sql_select.cc:4433(JOIN::exec())[0x558de5917f2c]
            		 
            sql/sql_select.cc:4873(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x558de591c108]
            		 
            sql/sql_select.cc:442(handle_select(THD*, LEX*, select_result*, unsigned long))[0x558de58ec662]
            		 
            sql/sql_parse.cc:6558(execute_sqlcom_select(THD*, TABLE_LIST*))[0x558de5853194]
            		 
            sql/sql_parse.cc:3989(mysql_execute_command(THD*))[0x558de5840381]
            		 
            sql/sql_parse.cc:8097(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x558de585c70f]
            		 
            sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x558de5832349]
            		 
            sql/sql_parse.cc:1378(do_command(THD*))[0x558de582ee74]
            		 
            sql/sql_connect.cc:1419(do_handle_one_connection(CONNECT*))[0x558de5c45038]
            		 
            sql/sql_connect.cc:1324(handle_one_connection)[0x558de5c448dc]
            		 
            perfschema/pfs.cc:1871(pfs_spawn_thread)[0x558de68e3d8e]
            		 
            nptl/pthread_create.c:478(start_thread)[0x7f626a019609]
            		 
             
            		 
            Query (0x62b0000b6290): SELECT CONVERT_TZ(MAX(GREATEST(DATE('2021-00-00'), DATE('2021-00-00'))), '+00:00', '+7:5')

            alice Alice Sherepa added a comment - Test case from MDEV-33848 : SELECT CONVERT_TZ( MAX (GREATEST( DATE ( '2021-00-00' ), DATE ( '2021-00-00' ))), '+00:00' , '+7:5' ); mysqld: /10.4/src/sql/tztime.cc:801: my_time_t sec_since_epoch(int, int, int, int, int, int): Assertion `mon > 0 && mon < 13' failed. 240408 9:24:59 [ERROR] mysqld got signal 6 ;   Server version: 10.4.34-MariaDB-debug-log source revision: 8cc36fb7434114fce06725cc607c2f7c65ac3ac7   /lib/x86_64-linux-gnu/libc.so.6(+0x33fd6)[0x7f6269afefd6] sql/tztime.cc:802(sec_since_epoch(int, int, int, int, int, int))[0x558de5bb830b] sql/tztime.cc:1386(Time_zone_offset::TIME_to_gmt_sec(st_mysql_time const*, unsigned int*) const)[0x558de5bb9e82] sql/item_timefunc.cc:1993(Item_func_convert_tz::get_date(THD*, st_mysql_time*, date_mode_t))[0x558de62cbebf] sql/sql_type.cc:7189(Type_handler::Item_send_datetime(Item*, Protocol*, st_value*) const)[0x558de5dd52a6] sql/sql_type.h:5846(Type_handler_datetime_common::Item_send(Item*, Protocol*, st_value*) const)[0x558de5defa7e] sql/item.h:1059(Item::send(Protocol*, st_value*))[0x558de5578284] sql/protocol.cc:1033(Protocol::send_result_set_row(List<Item>*))[0x558de55697c1] sql/sql_class.cc:3144(select_send::send_data(List<Item>&))[0x558de571e8db] sql/sql_select.cc:22315(end_send_group(JOIN*, st_join_table*, bool))[0x558de5999d29] sql/sql_select.cc:20417(do_select(JOIN*, Procedure*))[0x558de598c66b] sql/sql_select.cc:4650(JOIN::exec_inner())[0x558de591a8fc] sql/sql_select.cc:4433(JOIN::exec())[0x558de5917f2c] sql/sql_select.cc:4873(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x558de591c108] sql/sql_select.cc:442(handle_select(THD*, LEX*, select_result*, unsigned long))[0x558de58ec662] sql/sql_parse.cc:6558(execute_sqlcom_select(THD*, TABLE_LIST*))[0x558de5853194] sql/sql_parse.cc:3989(mysql_execute_command(THD*))[0x558de5840381] sql/sql_parse.cc:8097(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x558de585c70f] sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x558de5832349] sql/sql_parse.cc:1378(do_command(THD*))[0x558de582ee74] sql/sql_connect.cc:1419(do_handle_one_connection(CONNECT*))[0x558de5c45038] sql/sql_connect.cc:1324(handle_one_connection)[0x558de5c448dc] perfschema/pfs.cc:1871(pfs_spawn_thread)[0x558de68e3d8e] nptl/pthread_create.c:478(start_thread)[0x7f626a019609]   Query (0x62b0000b6290): SELECT CONVERT_TZ(MAX(GREATEST(DATE('2021-00-00'), DATE('2021-00-00'))), '+00:00', '+7:5')
            bar Alexander Barkov added a comment -

            The problem is also repeatable with MyISAM:

            CREATE OR REPLACE TABLE t1 (a DATE) ENGINE=MyISAM;
            		 
            SET @@time_zone='+1:00';
            		 
            INSERT INTO t1 VALUES ('2024-00-01');
            		 
            SELECT UNIX_TIMESTAMP(MAX(a)) AS a FROM t1;

            bar Alexander Barkov added a comment - The problem is also repeatable with MyISAM: CREATE OR REPLACE TABLE t1 (a DATE ) ENGINE=MyISAM; SET @@time_zone= '+1:00' ; INSERT INTO t1 VALUES ( '2024-00-01' ); SELECT UNIX_TIMESTAMP( MAX (a)) AS a FROM t1;

            People

              bar Alexander Barkov
              ramesh Ramesh Sivaraman
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.