Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-32992

Server crashes when the result set has a decimal part when using the UNION with ORDER BY (SELECT .. LIMIT) clause

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Duplicate
    • 11.4
    • N/A
    • Optimizer
    • None

    Description

      The stack is almost identical to MDEV-32606, but the crash is in a different location in sql/my_decimal.h.

      SELECT 0.0 a UNION SELECT 0 ORDER BY (SELECT a LIMIT 0);
      

      Leads to

      11.4.0 6b2287fff23fbdc362499501c562f01d0d2db52e (Optimized)

      Core was generated by `/test/MD301123-mariadb-11.4.0-linux-x86_64-opt/bin/mariadbd --no-defaults --cor'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x00005616befc5d52 in my_decimal::operator= (rhs=..., this=0x14cce80bfc00)
          at /test/11.4_opt/sql/my_decimal.h:353
      [Current thread is 1 (Thread 0x14cce80c2700 (LWP 2551264))]
      (gdb) bt
      #0  0x00005616befc5d52 in my_decimal::operator= (rhs=<error reading variable>, this=0x14cce80bfc00) at /test/11.4_opt/sql/my_decimal.h:353
      #1  my_decimal2decimal (to=0x14cce80bfc00, from=0x0) at /test/11.4_opt/sql/my_decimal.h:353
      #2  my_decimal::to_binary (this=0x0, bin=bin@entry=0x14ccb003c548 "", prec=3, scale=1, mask=mask@entry=30) at /test/11.4_opt/sql/my_decimal.cc:206
      #3  0x00005616bee7022f in Type_handler_decimal_result::make_sort_key_part (this=<optimized out>, to=0x14ccb003c548 "", item=0x14ccb001c4b8, sort_field=0x14ccb001c878, tmp_buffer=<optimized out>) at /test/11.4_opt/sql/filesort.cc:1382
      #4  0x00005616bee71253 in make_sortkey (to=0x14ccb003c548 "", param=0x14cce80bfe90) at /test/11.4_opt/sql/filesort.cc:2956
      #5  make_sortkey (param=param@entry=0x14cce80bfe90, to=0x14ccb003c548 "", ref_pos=ref_pos@entry=0x14ccb0017948 "\230\323\001\260\314\024", using_packed_sortkeys=using_packed_sortkeys@entry=false) at /test/11.4_opt/sql/filesort.cc:1415
      #6  0x00005616bee73d3f in find_all_keys (found_rows=0x14ccb003c520, pq=0x0, tempfile=0x14cce80bff50, buffpek_pointers=0x14cce80c0040, fs_info=0x14ccb003c3b0, select=0x14ccb001c1f8, param=0x14cce80bfe90, thd=0x14ccb0000c58) at /test/11.4_opt/sql/filesort.cc:1031
      #7  filesort (thd=0x14ccb0000c58, table=table@entry=0x14ccb0016bd0, filesort=filesort@entry=0x14ccb001c7c8, tracker=0x14ccb001c810, join=join@entry=0x14ccb0019330, first_table_bit=<optimized out>) at /test/11.4_opt/sql/filesort.cc:408
      #8  0x00005616bec5d9f2 in create_sort_index (thd=<optimized out>, join=0x14ccb0019330, tab=tab@entry=0x14ccb001b300, fsort=0x14ccb001c7c8, fsort@entry=0x0) at /test/11.4_opt/sql/sql_select.cc:26903
      #9  0x00005616bec5dda2 in st_join_table::sort_table (this=this@entry=0x14ccb001b300) at /test/11.4_opt/sql/sql_select.cc:24542
      #10 0x00005616bec5de75 in join_init_read_record (tab=0x14ccb001b300) at /test/11.4_opt/sql/sql_select.cc:24462
      #11 0x00005616bec4576f in sub_select (join=0x14ccb0019330, join_tab=0x14ccb001b300, end_of_records=false) at /test/11.4_opt/sql/sql_select.cc:23497
      #12 0x00005616bec77e6d in do_select (procedure=<optimized out>, join=0x14ccb0019330) at /test/11.4_opt/sql/sql_select.cc:23017
      #13 JOIN::exec_inner (this=0x14ccb0019330) at /test/11.4_opt/sql/sql_select.cc:4940
      #14 0x00005616bec7828e in JOIN::exec (this=this@entry=0x14ccb0019330) at /test/11.4_opt/sql/sql_select.cc:4726
      #15 0x00005616bec762d0 in mysql_select (thd=0x14ccb0000c58, tables=0x14ccb0004f58, fields=<optimized out>, conds=conds@entry=0x0, og_num=1, order=0x14ccb0013478, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x14ccb0013590, unit=0x14ccb0004f10, select_lex=0x14ccb0011ee8) at /test/11.4_opt/sql/sql_select.cc:5249
      #16 0x00005616becce061 in st_select_lex_unit::exec_inner (this=0x14ccb0004f10) at /test/11.4_opt/sql/sql_lex.h:970
      #17 0x00005616becd1098 in mysql_union (thd=thd@entry=0x14ccb0000c58, lex=lex@entry=0x14ccb0004e30, result=result@entry=0x14ccb0013590, unit=unit@entry=0x14ccb0004f10, setup_tables_done_option=<optimized out>) at /test/11.4_opt/sql/sql_union.cc:45
      #18 0x00005616bec769da in handle_select (thd=thd@entry=0x14ccb0000c58, lex=lex@entry=0x14ccb0004e30, result=result@entry=0x14ccb0013590, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/11.4_opt/sql/sql_select.cc:618
      #19 0x00005616bebf120e in execute_sqlcom_select (thd=0x14ccb0000c58, all_tables=0x0) at /test/11.4_opt/sql/sql_parse.cc:6029
      #20 0x00005616bebff897 in mysql_execute_command (thd=0x14ccb0000c58, is_called_from_prepared_stmt=<optimized out>) at /test/11.4_opt/sql/sql_parse.cc:3924
      #21 0x00005616bebebdd6 in mysql_parse (thd=0x14ccb0000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/11.4_opt/sql/sql_parse.cc:7748
      #22 0x00005616bebf8345 in dispatch_command (command=COM_QUERY, thd=0x14ccb0000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/11.4_opt/sql/sql_class.h:1551
      #23 0x00005616bebfa59e in do_command (thd=0x14ccb0000c58, blocking=blocking@entry=true) at /test/11.4_opt/sql/sql_parse.cc:1406
      #24 0x00005616bed291b7 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/11.4_opt/sql/sql_connect.cc:1418
      #25 0x00005616bed294fd in handle_one_connection (arg=arg@entry=0x5616c1f9bd78) at /test/11.4_opt/sql/sql_connect.cc:1320
      #26 0x00005616bf0cf35c in pfs_spawn_thread (arg=0x5616c1fc3b48) at /test/11.4_opt/storage/perfschema/pfs.cc:2201
      #27 0x000014ccfce63609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #28 0x000014ccfca4f133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      UBSAN Error member call on null pointer of type 'struct my_decimal' in sql/filesort.cc

      11.4.0 70de4075a18c12ed7e55db9a49e66eb6cff308b2 (Optimized, UBASAN)

      /test/11.4_opt_san/sql/filesort.cc:1382:21: runtime error: member call on null pointer of type 'struct my_decimal'
          #0 0x562075bed443 in Type_handler_decimal_result::make_sort_key_part(unsigned char*, Item*, SORT_FIELD_ATTR const*, String*) const /test/11.4_opt_san/sql/filesort.cc:1382
          #1 0x562075bf5b30 in make_sortkey /test/11.4_opt_san/sql/filesort.cc:2956
          #2 0x562075bf5b30 in make_sortkey /test/11.4_opt_san/sql/filesort.cc:1415
          #3 0x562075c03508 in find_all_keys /test/11.4_opt_san/sql/filesort.cc:1031
          #4 0x562075c03508 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /test/11.4_opt_san/sql/filesort.cc:408
          #5 0x5620748f1589 in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /test/11.4_opt_san/sql/sql_select.cc:26903
          #6 0x5620748f2f92 in st_join_table::sort_table() /test/11.4_opt_san/sql/sql_select.cc:24542
          #7 0x5620748f3549 in join_init_read_record(st_join_table*) /test/11.4_opt_san/sql/sql_select.cc:24462
          #8 0x56207485366c in sub_select(JOIN*, st_join_table*, bool) /test/11.4_opt_san/sql/sql_select.cc:23497
          #9 0x562074a2eb0e in do_select /test/11.4_opt_san/sql/sql_select.cc:23017
          #10 0x562074a2eb0e in JOIN::exec_inner() /test/11.4_opt_san/sql/sql_select.cc:4940
          #11 0x562074a33a09 in JOIN::exec() /test/11.4_opt_san/sql/sql_select.cc:4726
          #12 0x562074a20edc in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/
      11.4_opt_san/sql/sql_select.cc:5249
          #13 0x562074cf3024 in st_select_lex_unit::exec_inner() /test/11.4_opt_san/sql/sql_union.cc:2477
          #14 0x562074d0b51c in mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long long) /test/11.4_opt_san/sql/sql_union.cc:45
          #15 0x562074a24576 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.4_opt_san/sql/sql_select.cc:618
          #16 0x5620745fb53f in execute_sqlcom_select /test/11.4_opt_san/sql/sql_parse.cc:6029
          #17 0x56207464b4ed in mysql_execute_command(THD*, bool) /test/11.4_opt_san/sql/sql_parse.cc:3924
          #18 0x5620745ca7a0 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.4_opt_san/sql/sql_parse.cc:7748
          #19 0x562074621868 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.4_opt_san/sql/sql_parse.cc:1893
          #20 0x56207462d0bd in do_command(THD*, bool) /test/11.4_opt_san/sql/sql_parse.cc:1406
          #21 0x562074f7e20d in do_handle_one_connection(CONNECT*, bool) /test/11.4_opt_san/sql/sql_connect.cc:1418
          #22 0x562074f8087c in handle_one_connection /test/11.4_opt_san/sql/sql_connect.cc:1320
          #23 0x151ddc916608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
          #24 0x151ddbb8b132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
      

      Attachments

        Issue Links

          Activity

            People

              psergei Sergei Petrunia
              ramesh Ramesh Sivaraman
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.