Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-33434

UBSAN null pointer passed as argument 2, which is declared to never be null in spider_udf_direct_sql_create_conn

    XMLWordPrintable

Details

    Description

      INSTALL PLUGIN Spider SONAME 'ha_spider.so';
      SET character_set_connection=ucs2;
      SELECT SPIDER_DIRECT_SQL('SELECT SLEEP(1)', '', 'srv "dummy", port "3307"');
      

      Leads to:

      11.4.0 b0e77c08e55c433e443a2cfbcb7315dd6f006b3e (Optimized)

      /test/11.4_opt_san/storage/spider/spd_direct_sql.cc:449:11: runtime error: null pointer passed as argument 2, which is declared to never be null
      /test/11.4_opt_san/storage/spider/spd_direct_sql.cc:453:11: runtime error: null pointer passed as argument 2, which is declared to never be null
      

      11.4.0 b0e77c08e55c433e443a2cfbcb7315dd6f006b3e (Optimized)

          #0 0x14a42b64753d in spider_udf_direct_sql_create_conn(st_spider_direct_sql const*, int*) /test/11.4_opt_san/storage/spider/spd_direct_sql.cc:449
          #1 0x14a42b84de6c in spider_udf_direct_sql_get_conn(st_spider_direct_sql const*, st_spider_transaction*, int*) /test/11.4_opt_san/storage/spider/spd_direct_sql.cc:666
          #2 0x14a42b85b65c in spider_direct_sql_body(st_udf_init*, st_udf_args*, char*, char*, char) /test/11.4_opt_san/storage/spider/spd_direct_sql.cc:1580
          #3 0x560fcb5c9d30 in udf_handler::val_int(char*) /test/11.4_opt_san/sql/sql_udf.h:108
          #4 0x560fcb5c9d30 in Item_func_udf_int::val_int() /test/11.4_opt_san/sql/item_func.cc:3801
          #5 0x560fca915300 in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /test/11.4_opt_san/sql/sql_type.cc:7510
          #6 0x560fc938af81 in Protocol::send_result_set_row(List<Item>*) /test/11.4_opt_san/sql/protocol.cc:1333
          #7 0x560fc9683c19 in select_send::send_data(List<Item>&) /test/11.4_opt_san/sql/sql_class.cc:3136
          #8 0x560fc9e2f1b4 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.4_opt_san/sql/sql_class.h:5978
          #9 0x560fc9e2f1b4 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.4_opt_san/sql/sql_class.h:5968
          #10 0x560fc9e2f1b4 in JOIN::exec_inner() /test/11.4_opt_san/sql/sql_select.cc:4862
          #11 0x560fc9e33899 in JOIN::exec() /test/11.4_opt_san/sql/sql_select.cc:4774
          #12 0x560fc9e20d5c in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.4_opt_san/sql/sql_select.cc:5304
          #13 0x560fc9e249f3 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.4_opt_san/sql/sql_select.cc:630
          #14 0x560fc99f2a2f in execute_sqlcom_select /test/11.4_opt_san/sql/sql_parse.cc:6077
          #15 0x560fc9a42355 in mysql_execute_command(THD*, bool) /test/11.4_opt_san/sql/sql_parse.cc:3926
          #16 0x560fc99c20a0 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.4_opt_san/sql/sql_parse.cc:7798
          #17 0x560fc9a18730 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.4_opt_san/sql/sql_parse.cc:1893
          #18 0x560fc9a23efd in do_command(THD*, bool) /test/11.4_opt_san/sql/sql_parse.cc:1406
          #19 0x560fca38507d in do_handle_one_connection(CONNECT*, bool) /test/11.4_opt_san/sql/sql_connect.cc:1417
          #20 0x560fca3876ec in handle_one_connection /test/11.4_opt_san/sql/sql_connect.cc:1319
          #21 0x14a450d8c608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
          #22 0x14a450001132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
      

      Setup:

      Compiled with GCC >=7.5.0 (I use GCC 11.4.0) and:
          -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
      Set before execution:
          export UBSAN_OPTIONS=print_stacktrace=1
      

      Bug confirmed present in:
      MariaDB: 10.4.33 (dbg), 10.4.33 (opt), 10.5.24 (dbg), 10.5.24 (opt), 10.6.17 (dbg), 10.6.17 (opt), 10.11.7 (dbg), 10.11.7 (opt), 11.0.5 (opt), 11.1.4 (dbg), 11.1.4 (opt), 11.2.3 (opt), 11.3.2 (dbg), 11.3.2 (opt), 11.4.0 (dbg), 11.4.0 (opt), 11.0.5 (dbg), 11.2.3 (dbg)

      Attachments

        Issue Links

          Activity

            People

              ycp Yuchen Pei
              ramesh Ramesh Sivaraman
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.