JSON_ARRAY_INTERSECT function crashes the server when called with empty json arrays, UBSAN runtime error: member access within null pointer of type 'struct String' in Item_func_json_array_intersect::prepare_json_and_create_hash

SELECT json_array_intersect(@a,@b);

Core was generated by `/test/mtest/MD010124-mariadb-11.4.0-linux-x86_64-opt/bin/mariadbd --no-defaults'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x000055fde5069d9d in Item_func_json_array_intersect::prepare_json_and_create_hash (this=this@entry=0x14dd5c0112d8, je1=je1@entry=0x14dda00cd270, js=0x0)

    at /test/mtest/11.4_opt/sql/item_jsonfunc.cc:5265

5265	  json_scan_start(je1, js->charset(), (const uchar *) js->ptr(),

[Current thread is 1 (Thread 0x14dda00cf700 (LWP 2799882))]

(gdb) bt

#0  0x000055fde5069d9d in Item_func_json_array_intersect::prepare_json_and_create_hash (this=this@entry=0x14dd5c0112d8, je1=je1@entry=0x14dda00cd270, js=0x0) at /test/mtest/11.4_opt/sql/item_jsonfunc.cc:5265

#1  0x000055fde506a56b in Item_func_json_array_intersect::fix_length_and_dec (this=0x14dd5c0112d8, thd=<optimized out>) at /test/mtest/11.4_opt/sql/item_jsonfunc.cc:5306

#2  0x000055fde51cc21b in Item_func::fix_fields (ref=<optimized out>, thd=0x14dd5c000c58, this=0x14dd5c0112d8) at /test/mtest/11.4_opt/sql/item_func.cc:377

#3  Item_func::fix_fields (this=this@entry=0x14dd5c0112d8, thd=thd@entry=0x14dd5c000c58, ref=<optimized out>) at /test/mtest/11.4_opt/sql/item_func.cc:326

#4  0x000055fde5202746 in Item_str_func::fix_fields (this=0x14dd5c0112d8, thd=0x14dd5c000c58, ref=<optimized out>) at /test/mtest/11.4_opt/sql/item_strfunc.cc:132

#5  0x000055fde4e6c6a0 in Item::fix_fields_if_needed (ref=0x14dd5c0114a0, thd=0x14dd5c000c58, this=0x14dd5c0112d8) at /test/mtest/11.4_opt/sql/item.h:1151

#6  Item::fix_fields_if_needed (ref=0x14dd5c0114a0, thd=0x14dd5c000c58, this=0x14dd5c0112d8) at /test/mtest/11.4_opt/sql/item.h:1151

#7  Item::fix_fields_if_needed_for_scalar (ref=0x14dd5c0114a0, thd=0x14dd5c000c58, this=0x14dd5c0112d8) at /test/mtest/11.4_opt/sql/item.h:1162

#8  setup_fields (thd=0x14dd5c000c58, ref_pointer_array=<optimized out>, fields=<optimized out>, column_usage=<optimized out>, sum_func_list=sum_func_list@entry=0x14dd5c0121b8, pre_fix=0x14dd5c010e78, allow_sum_func=true) at /test/mtest/11.4_opt/sql/sql_base.cc:8084

#9  0x000055fde4f46816 in JOIN::prepare (this=0x14dd5c011e18, tables_init=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=<optimized out>, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x14dd5c010ba8, unit_arg=0x14dd5c004f10) at /test/mtest/11.4_opt/sql/sql_select.cc:1549

#10 0x000055fde4f5a8ab in mysql_select (thd=0x14dd5c000c58, tables=0x0, fields=@0x14dd5c010e60: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14dd5c011498, last = 0x14dd5c011498, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x14dd5c011df0, unit=0x14dd5c004f10, select_lex=0x14dd5c010ba8) at /test/mtest/11.4_opt/sql/sql_select.cc:5278

#11 0x000055fde4f5aba7 in handle_select (thd=thd@entry=0x14dd5c000c58, lex=lex@entry=0x14dd5c004e30, result=result@entry=0x14dd5c011df0, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/mtest/11.4_opt/sql/sql_select.cc:630

#12 0x000055fde4ed458e in execute_sqlcom_select (thd=0x14dd5c000c58, all_tables=0x0) at /test/mtest/11.4_opt/sql/sql_parse.cc:6077

#13 0x000055fde4ee2bc1 in mysql_execute_command (thd=0x14dd5c000c58, is_called_from_prepared_stmt=<optimized out>) at /test/mtest/11.4_opt/sql/sql_parse.cc:3926

#14 0x000055fde4ecf156 in mysql_parse (thd=0x14dd5c000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/mtest/11.4_opt/sql/sql_parse.cc:7798

#15 0x000055fde4edb6d5 in dispatch_command (command=COM_QUERY, thd=0x14dd5c000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/mtest/11.4_opt/sql/sql_class.h:1552

#16 0x000055fde4edd91e in do_command (thd=0x14dd5c000c58, blocking=blocking@entry=true) at /test/mtest/11.4_opt/sql/sql_parse.cc:1406

#17 0x000055fde500d397 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/mtest/11.4_opt/sql/sql_connect.cc:1417

#18 0x000055fde500d6dd in handle_one_connection (arg=arg@entry=0x55fde8702d08) at /test/mtest/11.4_opt/sql/sql_connect.cc:1319

#19 0x000055fde53b599c in pfs_spawn_thread (arg=0x55fde86b7cb8) at /test/mtest/11.4_opt/storage/perfschema/pfs.cc:2201

#20 0x000014dda3576609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#21 0x000014dda3162133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Core was generated by `/test/mtest/MD010124-mariadb-11.4.0-linux-x86_64-dbg/bin/mariadbd --no-defaults'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  Binary_string::ptr (this=0x8) at /test/mtest/11.4_dbg/sql/sql_string.h:359

359	  inline const char *ptr() const { return Ptr; }

[Current thread is 1 (Thread 0x1489fc09c700 (LWP 1846667))]

(gdb) bt

#0  Binary_string::ptr (this=0x8) at /test/mtest/11.4_dbg/sql/sql_string.h:359

#1  Item_func_json_array_intersect::prepare_json_and_create_hash (this=this@entry=0x1489b4013cd8, je1=je1@entry=0x1489fc09a1c0, js=0x0) at /test/mtest/11.4_dbg/sql/item_jsonfunc.cc:5266

#2  0x00005594b2cc4515 in Item_func_json_array_intersect::fix_length_and_dec (this=0x1489b4013cd8, thd=<optimized out>) at /test/mtest/11.4_dbg/sql/item_jsonfunc.cc:5306

#3  0x00005594b2e7cb2d in Item_func::fix_fields (this=this@entry=0x1489b4013cd8, thd=thd@entry=0x1489b4000d48, ref=<optimized out>) at /test/mtest/11.4_dbg/sql/item_func.cc:377

#4  0x00005594b2ec75c2 in Item_str_func::fix_fields (this=0x1489b4013cd8, thd=0x1489b4000d48, ref=<optimized out>) at /test/mtest/11.4_dbg/sql/item_strfunc.cc:132

#5  0x00005594b2a49034 in Item::fix_fields_if_needed (ref=0x1489b4013ea0, thd=0x1489b4000d48, this=0x1489b4013cd8) at /test/mtest/11.4_dbg/sql/item.h:1162

#6  Item::fix_fields_if_needed_for_scalar (ref=0x1489b4013ea0, thd=0x1489b4000d48, this=0x1489b4013cd8) at /test/mtest/11.4_dbg/sql/item.h:1162

#7  setup_fields (thd=0x1489b4000d48, ref_pointer_array=<optimized out>, fields=<optimized out>, column_usage=<optimized out>, sum_func_list=sum_func_list@entry=0x1489b4014bc0, pre_fix=0x1489b4013878, allow_sum_func=true) at /test/mtest/11.4_dbg/sql/sql_base.cc:8084

#8  0x00005594b2b4aa31 in JOIN::prepare (this=this@entry=0x1489b4014818, tables_init=tables_init@entry=0x0, conds_init=conds_init@entry=0x0, og_num=og_num@entry=0, order_init=order_init@entry=0x0, skip_order_by=skip_order_by@entry=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x1489b40135a8, unit_arg=0x1489b40051c8) at /test/mtest/11.4_dbg/sql/sql_select.cc:1549

#9  0x00005594b2b633d9 in mysql_select (thd=thd@entry=0x1489b4000d48, tables=0x0, fields=@0x1489b4013860: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1489b4013e98, last = 0x1489b4013e98, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x1489b40147f0, unit=0x1489b40051c8, select_lex=0x1489b40135a8) at /test/mtest/11.4_dbg/sql/sql_select.cc:5278

#10 0x00005594b2b63603 in handle_select (thd=thd@entry=0x1489b4000d48, lex=lex@entry=0x1489b40050e8, result=result@entry=0x1489b40147f0, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/mtest/11.4_dbg/sql/sql_select.cc:630

#11 0x00005594b2ac2da4 in execute_sqlcom_select (thd=thd@entry=0x1489b4000d48, all_tables=0x0) at /test/mtest/11.4_dbg/sql/sql_parse.cc:6077

#12 0x00005594b2acf89d in mysql_execute_command (thd=thd@entry=0x1489b4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/mtest/11.4_dbg/sql/sql_parse.cc:3926

#13 0x00005594b2abcd20 in mysql_parse (thd=thd@entry=0x1489b4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1489fc09b2b0) at /test/mtest/11.4_dbg/sql/sql_parse.cc:7798

#14 0x00005594b2acabfc in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1489b4000d48, packet=packet@entry=0x1489b400b1b9 "SELECT json_array_intersect(@json1,@json2)", packet_length=packet_length@entry=42, blocking=blocking@entry=true) at /test/mtest/11.4_dbg/sql/sql_class.h:1552

#15 0x00005594b2acd328 in do_command (thd=0x1489b4000d48, blocking=blocking@entry=true) at /test/mtest/11.4_dbg/sql/sql_parse.cc:1406

#16 0x00005594b2c47eb5 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5594b6aebd08, put_in_cache=put_in_cache@entry=true) at /test/mtest/11.4_dbg/sql/sql_connect.cc:1417

#17 0x00005594b2c4846a in handle_one_connection (arg=arg@entry=0x5594b6aebd08) at /test/mtest/11.4_dbg/sql/sql_connect.cc:1319

#18 0x00005594b30b654c in pfs_spawn_thread (arg=0x5594b6a3f2b8) at /test/mtest/11.4_dbg/storage/perfschema/pfs.cc:2201

#19 0x00001489ffb7d609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#20 0x00001489ff769133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

/test/11.4_opt_san/sql/item_jsonfunc.cc:5266:42: runtime error: member access within null pointer of type 'struct String'

    #0 0x555fd0ba97c4 in Item_func_json_array_intersect::prepare_json_and_create_hash(st_json_engine_t*, String*) /test/11.4_opt_san/sql/item_jsonfunc.cc:5266

    #1 0x555fd0bac5ca in Item_func_json_array_intersect::fix_length_and_dec(THD*) /test/11.4_opt_san/sql/item_jsonfunc.cc:5306

    #2 0x555fd1a41d29 in Item_func::fix_fields(THD*, Item**) /test/11.4_opt_san/sql/item_func.cc:377

    #3 0x555fd1cec0cb in Item_str_func::fix_fields(THD*, Item**) /test/11.4_opt_san/sql/item_strfunc.cc:132

    #4 0x555fcfb0ad30 in Item::fix_fields_if_needed(THD*, Item**) /test/11.4_opt_san/sql/item.h:1166

    #5 0x555fcfb0ad30 in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /test/11.4_opt_san/sql/item.h:1175

    #6 0x555fcfb0ad30 in setup_fields(THD*, Bounds_checked_array<Item*>, List<Item>&, enum_column_usage, List<Item>*, List<Item>*, bool) /test/11.4_opt_san/sql/sql_base.cc:8084

    #7 0x555fd023c1b5 in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /test/11.4_opt_san/sql/sql_select.cc:1549

    #8 0x555fd0338297 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.4_opt_san/sql/sql_select.cc:5279

    #9 0x555fd033a390 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.4_opt_san/sql/sql_select.cc:630

    #10 0x555fcfeacf40 in execute_sqlcom_select /test/11.4_opt_san/sql/sql_parse.cc:6094

    #11 0x555fcff10e35 in mysql_execute_command(THD*, bool) /test/11.4_opt_san/sql/sql_parse.cc:3943

    #12 0x555fcff1fba2 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.4_opt_san/sql/sql_parse.cc:7815

    #13 0x555fcff2bbbb in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.4_opt_san/sql/sql_parse.cc:1893

    #14 0x555fcff37608 in do_command(THD*, bool) /test/11.4_opt_san/sql/sql_parse.cc:1406

    #15 0x555fd088ecbc in do_handle_one_connection(CONNECT*, bool) /test/11.4_opt_san/sql/sql_connect.cc:1437

    #16 0x555fd08912bc in handle_one_connection /test/11.4_opt_san/sql/sql_connect.cc:1339

    #17 0x14e92ec94ac2 in start_thread nptl/pthread_create.c:442

    #18 0x14e92ed2684f  (/lib/x86_64-linux-gnu/libc.so.6+0x12684f)