[MDEV-34404] Spider: UBSAN: runtime error: null pointer passed as argument 2, which is declared to never be null in spider_create_string on SELECT - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.5, 10.6, 10.11, 11.1(EOL), 11.2(EOL), 11.4, 11.5(EOL)
Fix Version/s: 10.5.26, 10.6.19, 10.11.9, 11.1.6, 11.2.5, 11.4.3
Component/s: Storage Engine - Spider
Labels:
- UBSAN

Description

DROP DATABASE test;  # Assumes test db exists

INSTALL SONAME 'ha_spider';

SELECT spider_copy_tables ('a','','');

Leads to:

11.5.0 e4afa610539ae01164485554e2de839bea9de816 (Optimized, UBASAN)
/test/11.5_opt_san/storage/spider/spd_table.cc:6973:9: runtime error: null pointer passed as argument 2, which is declared to never be null
#0 0x146b257aff9c in spider_create_string(char const*, unsigned int) /test/11.5_opt_san/storage/spider/spd_table.cc:6973
#1 0x146b259d79d4 in spider_udf_set_copy_tables_param_default(st_spider_copy_tables*) /test/11.5_opt_san/storage/spider/spd_copy_tables.cc:54
#2 0x146b259d7e52 in spider_udf_parse_copy_tables_param(st_spider_copy_tables, char, int) /test/11.5_opt_san/storage/spider/spd_copy_tables.cc:229
#3 0x146b259e2048 in spider_copy_tables_body(st_udf_init, st_udf_args, char, char) /test/11.5_opt_san/storage/spider/spd_copy_tables.cc:794
#4 0x5618745afd61 in udf_handler::val_int(char*) /test/11.5_opt_san/sql/sql_udf.h:108
#5 0x5618745afd61 in Item_func_udf_int::val_int() /test/11.5_opt_san/sql/item_func.cc:3792
#6 0x561873916717 in Type_handler::Item_send_longlong(Item, Protocol, st_value*) const /test/11.5_opt_san/sql/sql_type.cc:7543
#7 0x5618723083cc in Protocol::send_result_set_row(List<Item>*) /test/11.5_opt_san/sql/protocol.cc:1359
#8 0x56187262a8ea in select_send::send_data(List<Item>&) /test/11.5_opt_san/sql/sql_class.cc:3189
#9 0x561872e1e051 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.5_opt_san/sql/sql_class.h:6090
#10 0x561872e1e051 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.5_opt_san/sql/sql_class.h:6080
#11 0x561872e1e051 in JOIN::exec_inner() /test/11.5_opt_san/sql/sql_select.cc:4862
#12 0x561872e22a83 in JOIN::exec() /test/11.5_opt_san/sql/sql_select.cc:4774
#13 0x561872e1015d in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.5_opt_san/sql/sql_select.cc:5304
#14 0x561872e13d60 in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.5_opt_san/sql/sql_select.cc:630
#15 0x561872981b00 in execute_sqlcom_select /test/11.5_opt_san/sql/sql_parse.cc:6093
#16 0x5618729e7149 in mysql_execute_command(THD*, bool) /test/11.5_opt_san/sql/sql_parse.cc:3942
#17 0x5618729f6382 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.5_opt_san/sql/sql_parse.cc:7815
#18 0x561872a01853 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.5_opt_san/sql/sql_parse.cc:1892
#19 0x561872a0e428 in do_command(THD*, bool) /test/11.5_opt_san/sql/sql_parse.cc:1405
#20 0x5618733866fc in do_handle_one_connection(CONNECT*, bool) /test/11.5_opt_san/sql/sql_connect.cc:1445
#21 0x561873388cfc in handle_one_connection /test/11.5_opt_san/sql/sql_connect.cc:1347
#22 0x146b4a697ad9 in start_thread nptl/pthread_create.c:444
#23 0x146b4a72847b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

2024-06-15 15:21:41 4 [ERROR] mariadbd: Can't find record in 'spider_tables'

Attachments

Activity

Ascending order - Click to sort in descending order

Yuchen Pei added a comment - 2024-06-17 01:38

I can't reproduce it at the exact commit, with ubsan+asan, in a release or debug build. But I can see where the problem could occur. Roel: before I prep the following commit for review, can you test it to see whether the bug is fixed there? Thanks

01eeea90355 upstream/bb-11.5-mdev-34404 MDEV-34404 Use safe_str to avoid NULL str passed in spider_udf_set_copy_tables_param_default

Yuchen Pei added a comment - 2024-06-17 01:38 I can't reproduce it at the exact commit, with ubsan+asan, in a release or debug build. But I can see where the problem could occur. Roel : before I prep the following commit for review, can you test it to see whether the bug is fixed there? Thanks 01eeea90355 upstream/bb-11.5-mdev-34404 MDEV-34404 Use safe_str to avoid NULL str passed in spider_udf_set_copy_tables_param_default

Roel Van de Paar added a comment - 2024-06-17 03:52 - edited

Testing. I also found an additional testcase leading to a slightly different stack, ref below. Will test if this is fixed also.

DROP DATABASE test;

INSTALL PLUGIN Spider SONAME 'ha_spider.so';

SET collation_connection=ucs2_general_ci;

SELECT spider_direct_sql ('a','','b');

Leads to:

11.5.0 e4afa610539ae01164485554e2de839bea9de816 (Debug, UBASAN)
/test/11.5_dbg_san/storage/spider/spd_table.cc:6973:9: runtime error: null pointer passed as argument 2, which is declared to never be null
#0 0x152a96d691cb in spider_create_string(char const*, unsigned int) /test/11.5_dbg_san/storage/spider/spd_table.cc:6973
#1 0x152a96dd160c in spider_udf_set_direct_sql_param_default(st_spider_transaction, st_spider_direct_sql) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:1206
#2 0x152a96dd248d in spider_udf_parse_direct_sql_param(st_spider_transaction, st_spider_direct_sql, char const*, int) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:1073
#3 0x152a96ddafbf in spider_direct_sql_body(st_udf_init, st_udf_args, char, char, char) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:1498
#4 0x152a96ddd7b1 in spider_direct_sql /test/11.5_dbg_san/storage/spider/spd_udf.cc:29
#5 0x565192bcaec5 in udf_handler::val_int(char*) /test/11.5_dbg_san/sql/sql_udf.h:108
#6 0x565192bcaec5 in Item_func_udf_int::val_int() /test/11.5_dbg_san/sql/item_func.cc:3792
#7 0x565191d9239c in Type_handler::Item_send_longlong(Item, Protocol, st_value*) const /test/11.5_dbg_san/sql/sql_type.cc:7543
#8 0x565191dfb704 in Type_handler_longlong::Item_send(Item, Protocol, st_value*) const /test/11.5_dbg_san/sql/sql_type.h:5964
#9 0x565190403f6e in Item::send(Protocol, st_value) /test/11.5_dbg_san/sql/item.h:1254
#10 0x5651905cd570 in Protocol::send_result_set_row(List<Item>*) /test/11.5_dbg_san/sql/protocol.cc:1359
#11 0x56519091174e in select_send::send_data(List<Item>&) /test/11.5_dbg_san/sql/sql_class.cc:3189
#12 0x56519111eada in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.5_dbg_san/sql/sql_class.h:6090
#13 0x56519111eada in JOIN::exec_inner() /test/11.5_dbg_san/sql/sql_select.cc:4862
#14 0x5651911250ec in JOIN::exec() /test/11.5_dbg_san/sql/sql_select.cc:4774
#15 0x56519111350f in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.5_dbg_san/sql/sql_select.cc:5304
#16 0x565191117a20 in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.5_dbg_san/sql/sql_select.cc:630
#17 0x565190c88056 in execute_sqlcom_select /test/11.5_dbg_san/sql/sql_parse.cc:6093
#18 0x565190ce4007 in mysql_execute_command(THD*, bool) /test/11.5_dbg_san/sql/sql_parse.cc:3942
#19 0x565190d0b190 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.5_dbg_san/sql/sql_parse.cc:7815
#20 0x565190d1aff2 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.5_dbg_san/sql/sql_parse.cc:1892
#21 0x565190d29856 in do_command(THD*, bool) /test/11.5_dbg_san/sql/sql_parse.cc:1405
#22 0x56519175b0df in do_handle_one_connection(CONNECT*, bool) /test/11.5_dbg_san/sql/sql_connect.cc:1445
#23 0x56519175c5fa in handle_one_connection /test/11.5_dbg_san/sql/sql_connect.cc:1347
#24 0x152abba97ad9 in start_thread nptl/pthread_create.c:444
#25 0x152abbb2847b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

/test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:449:11: runtime error: null pointer passed as argument 2, which is declared to never be null
#0 0x152a96dcc28e in spider_udf_direct_sql_create_conn(st_spider_direct_sql const, int) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:449
#1 0x152a96dce4e2 in spider_udf_direct_sql_get_conn(st_spider_direct_sql const, st_spider_transaction, int*) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:666
#2 0x152a96ddbfaa in spider_direct_sql_body(st_udf_init, st_udf_args, char, char, char) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:1580
#3 0x152a96ddd7b1 in spider_direct_sql /test/11.5_dbg_san/storage/spider/spd_udf.cc:29
#4 0x565192bcaec5 in udf_handler::val_int(char*) /test/11.5_dbg_san/sql/sql_udf.h:108
#5 0x565192bcaec5 in Item_func_udf_int::val_int() /test/11.5_dbg_san/sql/item_func.cc:3792
#6 0x565191d9239c in Type_handler::Item_send_longlong(Item, Protocol, st_value*) const /test/11.5_dbg_san/sql/sql_type.cc:7543
#7 0x565191dfb704 in Type_handler_longlong::Item_send(Item, Protocol, st_value*) const /test/11.5_dbg_san/sql/sql_type.h:5964
#8 0x565190403f6e in Item::send(Protocol, st_value) /test/11.5_dbg_san/sql/item.h:1254
#9 0x5651905cd570 in Protocol::send_result_set_row(List<Item>*) /test/11.5_dbg_san/sql/protocol.cc:1359
#10 0x56519091174e in select_send::send_data(List<Item>&) /test/11.5_dbg_san/sql/sql_class.cc:3189
#11 0x56519111eada in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.5_dbg_san/sql/sql_class.h:6090
#12 0x56519111eada in JOIN::exec_inner() /test/11.5_dbg_san/sql/sql_select.cc:4862
#13 0x5651911250ec in JOIN::exec() /test/11.5_dbg_san/sql/sql_select.cc:4774
#14 0x56519111350f in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.5_dbg_san/sql/sql_select.cc:5304
#15 0x565191117a20 in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.5_dbg_san/sql/sql_select.cc:630
#16 0x565190c88056 in execute_sqlcom_select /test/11.5_dbg_san/sql/sql_parse.cc:6093
#17 0x565190ce4007 in mysql_execute_command(THD*, bool) /test/11.5_dbg_san/sql/sql_parse.cc:3942
#18 0x565190d0b190 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.5_dbg_san/sql/sql_parse.cc:7815
#19 0x565190d1aff2 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.5_dbg_san/sql/sql_parse.cc:1892
#20 0x565190d29856 in do_command(THD*, bool) /test/11.5_dbg_san/sql/sql_parse.cc:1405
#21 0x56519175b0df in do_handle_one_connection(CONNECT*, bool) /test/11.5_dbg_san/sql/sql_connect.cc:1445
#22 0x56519175c5fa in handle_one_connection /test/11.5_dbg_san/sql/sql_connect.cc:1347
#23 0x152abba97ad9 in start_thread nptl/pthread_create.c:444
#24 0x152abbb2847b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

/test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:453:11: runtime error: null pointer passed as argument 2, which is declared to never be null
#0 0x152a96dcc2fa in spider_udf_direct_sql_create_conn(st_spider_direct_sql const, int) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:453
#1 0x152a96dce4e2 in spider_udf_direct_sql_get_conn(st_spider_direct_sql const, st_spider_transaction, int*) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:666
#2 0x152a96ddbfaa in spider_direct_sql_body(st_udf_init, st_udf_args, char, char, char) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:1580
#3 0x152a96ddd7b1 in spider_direct_sql /test/11.5_dbg_san/storage/spider/spd_udf.cc:29
#4 0x565192bcaec5 in udf_handler::val_int(char*) /test/11.5_dbg_san/sql/sql_udf.h:108
#5 0x565192bcaec5 in Item_func_udf_int::val_int() /test/11.5_dbg_san/sql/item_func.cc:3792
#6 0x565191d9239c in Type_handler::Item_send_longlong(Item, Protocol, st_value*) const /test/11.5_dbg_san/sql/sql_type.cc:7543
#7 0x565191dfb704 in Type_handler_longlong::Item_send(Item, Protocol, st_value*) const /test/11.5_dbg_san/sql/sql_type.h:5964
#8 0x565190403f6e in Item::send(Protocol, st_value) /test/11.5_dbg_san/sql/item.h:1254
#9 0x5651905cd570 in Protocol::send_result_set_row(List<Item>*) /test/11.5_dbg_san/sql/protocol.cc:1359
#10 0x56519091174e in select_send::send_data(List<Item>&) /test/11.5_dbg_san/sql/sql_class.cc:3189
#11 0x56519111eada in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.5_dbg_san/sql/sql_class.h:6090
#12 0x56519111eada in JOIN::exec_inner() /test/11.5_dbg_san/sql/sql_select.cc:4862
#13 0x5651911250ec in JOIN::exec() /test/11.5_dbg_san/sql/sql_select.cc:4774
#14 0x56519111350f in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.5_dbg_san/sql/sql_select.cc:5304
#15 0x565191117a20 in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.5_dbg_san/sql/sql_select.cc:630
#16 0x565190c88056 in execute_sqlcom_select /test/11.5_dbg_san/sql/sql_parse.cc:6093
#17 0x565190ce4007 in mysql_execute_command(THD*, bool) /test/11.5_dbg_san/sql/sql_parse.cc:3942
#18 0x565190d0b190 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.5_dbg_san/sql/sql_parse.cc:7815
#19 0x565190d1aff2 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.5_dbg_san/sql/sql_parse.cc:1892
#20 0x565190d29856 in do_command(THD*, bool) /test/11.5_dbg_san/sql/sql_parse.cc:1405
#21 0x56519175b0df in do_handle_one_connection(CONNECT*, bool) /test/11.5_dbg_san/sql/sql_connect.cc:1445
#22 0x56519175c5fa in handle_one_connection /test/11.5_dbg_san/sql/sql_connect.cc:1347
#23 0x152abba97ad9 in start_thread nptl/pthread_create.c:444
#24 0x152abbb2847b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Roel Van de Paar added a comment - 2024-06-17 03:52 - edited Testing. I also found an additional testcase leading to a slightly different stack, ref below. Will test if this is fixed also. DROP DATABASE test; INSTALL PLUGIN Spider SONAME 'ha_spider.so' ; SET collation_connection=ucs2_general_ci; SELECT spider_direct_sql ( 'a' , '' , 'b' ); Leads to: 11.5.0 e4afa610539ae01164485554e2de839bea9de816 (Debug, UBASAN) /test/11.5_dbg_san/storage/spider/spd_table.cc:6973:9: runtime error: null pointer passed as argument 2, which is declared to never be null #0 0x152a96d691cb in spider_create_string(char const*, unsigned int) /test/11.5_dbg_san/storage/spider/spd_table.cc:6973 #1 0x152a96dd160c in spider_udf_set_direct_sql_param_default(st_spider_transaction*, st_spider_direct_sql*) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:1206 #2 0x152a96dd248d in spider_udf_parse_direct_sql_param(st_spider_transaction*, st_spider_direct_sql*, char const*, int) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:1073 #3 0x152a96ddafbf in spider_direct_sql_body(st_udf_init*, st_udf_args*, char*, char*, char) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:1498 #4 0x152a96ddd7b1 in spider_direct_sql /test/11.5_dbg_san/storage/spider/spd_udf.cc:29 #5 0x565192bcaec5 in udf_handler::val_int(char*) /test/11.5_dbg_san/sql/sql_udf.h:108 #6 0x565192bcaec5 in Item_func_udf_int::val_int() /test/11.5_dbg_san/sql/item_func.cc:3792 #7 0x565191d9239c in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /test/11.5_dbg_san/sql/sql_type.cc:7543 #8 0x565191dfb704 in Type_handler_longlong::Item_send(Item*, Protocol*, st_value*) const /test/11.5_dbg_san/sql/sql_type.h:5964 #9 0x565190403f6e in Item::send(Protocol*, st_value*) /test/11.5_dbg_san/sql/item.h:1254 #10 0x5651905cd570 in Protocol::send_result_set_row(List<Item>*) /test/11.5_dbg_san/sql/protocol.cc:1359 #11 0x56519091174e in select_send::send_data(List<Item>&) /test/11.5_dbg_san/sql/sql_class.cc:3189 #12 0x56519111eada in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.5_dbg_san/sql/sql_class.h:6090 #13 0x56519111eada in JOIN::exec_inner() /test/11.5_dbg_san/sql/sql_select.cc:4862 #14 0x5651911250ec in JOIN::exec() /test/11.5_dbg_san/sql/sql_select.cc:4774 #15 0x56519111350f in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.5_dbg_san/sql/sql_select.cc:5304 #16 0x565191117a20 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.5_dbg_san/sql/sql_select.cc:630 #17 0x565190c88056 in execute_sqlcom_select /test/11.5_dbg_san/sql/sql_parse.cc:6093 #18 0x565190ce4007 in mysql_execute_command(THD*, bool) /test/11.5_dbg_san/sql/sql_parse.cc:3942 #19 0x565190d0b190 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.5_dbg_san/sql/sql_parse.cc:7815 #20 0x565190d1aff2 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.5_dbg_san/sql/sql_parse.cc:1892 #21 0x565190d29856 in do_command(THD*, bool) /test/11.5_dbg_san/sql/sql_parse.cc:1405 #22 0x56519175b0df in do_handle_one_connection(CONNECT*, bool) /test/11.5_dbg_san/sql/sql_connect.cc:1445 #23 0x56519175c5fa in handle_one_connection /test/11.5_dbg_san/sql/sql_connect.cc:1347 #24 0x152abba97ad9 in start_thread nptl/pthread_create.c:444 #25 0x152abbb2847b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:449:11: runtime error: null pointer passed as argument 2, which is declared to never be null #0 0x152a96dcc28e in spider_udf_direct_sql_create_conn(st_spider_direct_sql const*, int*) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:449 #1 0x152a96dce4e2 in spider_udf_direct_sql_get_conn(st_spider_direct_sql const*, st_spider_transaction*, int*) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:666 #2 0x152a96ddbfaa in spider_direct_sql_body(st_udf_init*, st_udf_args*, char*, char*, char) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:1580 #3 0x152a96ddd7b1 in spider_direct_sql /test/11.5_dbg_san/storage/spider/spd_udf.cc:29 #4 0x565192bcaec5 in udf_handler::val_int(char*) /test/11.5_dbg_san/sql/sql_udf.h:108 #5 0x565192bcaec5 in Item_func_udf_int::val_int() /test/11.5_dbg_san/sql/item_func.cc:3792 #6 0x565191d9239c in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /test/11.5_dbg_san/sql/sql_type.cc:7543 #7 0x565191dfb704 in Type_handler_longlong::Item_send(Item*, Protocol*, st_value*) const /test/11.5_dbg_san/sql/sql_type.h:5964 #8 0x565190403f6e in Item::send(Protocol*, st_value*) /test/11.5_dbg_san/sql/item.h:1254 #9 0x5651905cd570 in Protocol::send_result_set_row(List<Item>*) /test/11.5_dbg_san/sql/protocol.cc:1359 #10 0x56519091174e in select_send::send_data(List<Item>&) /test/11.5_dbg_san/sql/sql_class.cc:3189 #11 0x56519111eada in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.5_dbg_san/sql/sql_class.h:6090 #12 0x56519111eada in JOIN::exec_inner() /test/11.5_dbg_san/sql/sql_select.cc:4862 #13 0x5651911250ec in JOIN::exec() /test/11.5_dbg_san/sql/sql_select.cc:4774 #14 0x56519111350f in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.5_dbg_san/sql/sql_select.cc:5304 #15 0x565191117a20 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.5_dbg_san/sql/sql_select.cc:630 #16 0x565190c88056 in execute_sqlcom_select /test/11.5_dbg_san/sql/sql_parse.cc:6093 #17 0x565190ce4007 in mysql_execute_command(THD*, bool) /test/11.5_dbg_san/sql/sql_parse.cc:3942 #18 0x565190d0b190 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.5_dbg_san/sql/sql_parse.cc:7815 #19 0x565190d1aff2 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.5_dbg_san/sql/sql_parse.cc:1892 #20 0x565190d29856 in do_command(THD*, bool) /test/11.5_dbg_san/sql/sql_parse.cc:1405 #21 0x56519175b0df in do_handle_one_connection(CONNECT*, bool) /test/11.5_dbg_san/sql/sql_connect.cc:1445 #22 0x56519175c5fa in handle_one_connection /test/11.5_dbg_san/sql/sql_connect.cc:1347 #23 0x152abba97ad9 in start_thread nptl/pthread_create.c:444 #24 0x152abbb2847b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:453:11: runtime error: null pointer passed as argument 2, which is declared to never be null #0 0x152a96dcc2fa in spider_udf_direct_sql_create_conn(st_spider_direct_sql const*, int*) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:453 #1 0x152a96dce4e2 in spider_udf_direct_sql_get_conn(st_spider_direct_sql const*, st_spider_transaction*, int*) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:666 #2 0x152a96ddbfaa in spider_direct_sql_body(st_udf_init*, st_udf_args*, char*, char*, char) /test/11.5_dbg_san/storage/spider/spd_direct_sql.cc:1580 #3 0x152a96ddd7b1 in spider_direct_sql /test/11.5_dbg_san/storage/spider/spd_udf.cc:29 #4 0x565192bcaec5 in udf_handler::val_int(char*) /test/11.5_dbg_san/sql/sql_udf.h:108 #5 0x565192bcaec5 in Item_func_udf_int::val_int() /test/11.5_dbg_san/sql/item_func.cc:3792 #6 0x565191d9239c in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /test/11.5_dbg_san/sql/sql_type.cc:7543 #7 0x565191dfb704 in Type_handler_longlong::Item_send(Item*, Protocol*, st_value*) const /test/11.5_dbg_san/sql/sql_type.h:5964 #8 0x565190403f6e in Item::send(Protocol*, st_value*) /test/11.5_dbg_san/sql/item.h:1254 #9 0x5651905cd570 in Protocol::send_result_set_row(List<Item>*) /test/11.5_dbg_san/sql/protocol.cc:1359 #10 0x56519091174e in select_send::send_data(List<Item>&) /test/11.5_dbg_san/sql/sql_class.cc:3189 #11 0x56519111eada in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.5_dbg_san/sql/sql_class.h:6090 #12 0x56519111eada in JOIN::exec_inner() /test/11.5_dbg_san/sql/sql_select.cc:4862 #13 0x5651911250ec in JOIN::exec() /test/11.5_dbg_san/sql/sql_select.cc:4774 #14 0x56519111350f in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.5_dbg_san/sql/sql_select.cc:5304 #15 0x565191117a20 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.5_dbg_san/sql/sql_select.cc:630 #16 0x565190c88056 in execute_sqlcom_select /test/11.5_dbg_san/sql/sql_parse.cc:6093 #17 0x565190ce4007 in mysql_execute_command(THD*, bool) /test/11.5_dbg_san/sql/sql_parse.cc:3942 #18 0x565190d0b190 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.5_dbg_san/sql/sql_parse.cc:7815 #19 0x565190d1aff2 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.5_dbg_san/sql/sql_parse.cc:1892 #20 0x565190d29856 in do_command(THD*, bool) /test/11.5_dbg_san/sql/sql_parse.cc:1405 #21 0x56519175b0df in do_handle_one_connection(CONNECT*, bool) /test/11.5_dbg_san/sql/sql_connect.cc:1445 #22 0x56519175c5fa in handle_one_connection /test/11.5_dbg_san/sql/sql_connect.cc:1347 #23 0x152abba97ad9 in start_thread nptl/pthread_create.c:444 #24 0x152abbb2847b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Roel Van de Paar added a comment - 2024-06-17 04:16 - edited

The first issue looks resolved:

bb-11.5-mdev-34404 11.5.0 01eeea90355be79cff919778634f3ba284807035 (Optimized, UBASAN)
11.5.0-opt>SELECT spider_copy_tables ('a','','');
ERROR 1032 (HY000): Can't find record in 'spider_tables'

And no UBSAN stack.

However, the second testcase still produces a UBSAN trace:

bb-11.5-mdev-34404 11.5.0 01eeea90355be79cff919778634f3ba284807035 (Optimized, UBASAN)
11.5.0-opt>SELECT spider_direct_sql ('a','','b');
ERROR 1429 (HY000): Unable to connect to foreign data source: localhost # Crashed

bb-11.5-mdev-34404 11.5.0 01eeea90355be79cff919778634f3ba284807035 (Optimized, UBASAN)
/test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_table.cc:6973:9: runtime error: null pointer passed as argument 2, which is declared to never be null
#0 0x149b14faff9c in spider_create_string(char const*, unsigned int) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_table.cc:6973
#1 0x149b151b669a in spider_udf_set_direct_sql_param_default(st_spider_transaction, st_spider_direct_sql) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:1206
#2 0x149b151b92fd in spider_udf_parse_direct_sql_param(st_spider_transaction, st_spider_direct_sql, char const*, int) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:1073
#3 0x149b151c0cb9 in spider_direct_sql_body(st_udf_init, st_udf_args, char, char, char) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:1498
#4 0x55bfd3ee7d61 in udf_handler::val_int(char*) /test/bb-11.5-mdev-34404_opt_san/sql/sql_udf.h:108
#5 0x55bfd3ee7d61 in Item_func_udf_int::val_int() /test/bb-11.5-mdev-34404_opt_san/sql/item_func.cc:3792
#6 0x55bfd324e717 in Type_handler::Item_send_longlong(Item, Protocol, st_value*) const /test/bb-11.5-mdev-34404_opt_san/sql/sql_type.cc:7543
#7 0x55bfd1c403cc in Protocol::send_result_set_row(List<Item>*) /test/bb-11.5-mdev-34404_opt_san/sql/protocol.cc:1359
#8 0x55bfd1f628ea in select_send::send_data(List<Item>&) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.cc:3189
#9 0x55bfd2756051 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.h:6090
#10 0x55bfd2756051 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.h:6080
#11 0x55bfd2756051 in JOIN::exec_inner() /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:4862
#12 0x55bfd275aa83 in JOIN::exec() /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:4774
#13 0x55bfd274815d in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:5304
#14 0x55bfd274bd60 in handle_select(THD, LEX, select_result*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:630
#15 0x55bfd22b9b00 in execute_sqlcom_select /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:6093
#16 0x55bfd231f149 in mysql_execute_command(THD*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:3942
#17 0x55bfd232e382 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:7815
#18 0x55bfd2339853 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:1892
#19 0x55bfd2346428 in do_command(THD*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:1405
#20 0x55bfd2cbe6fc in do_handle_one_connection(CONNECT*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_connect.cc:1445
#21 0x55bfd2cc0cfc in handle_one_connection /test/bb-11.5-mdev-34404_opt_san/sql/sql_connect.cc:1347
#22 0x149b39a97ad9 in start_thread nptl/pthread_create.c:444
#23 0x149b39b2847b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

/test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:449:11: runtime error: null pointer passed as argument 2, which is declared to never be null
#0 0x149b14fb458e in spider_udf_direct_sql_create_conn(st_spider_direct_sql const, int) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:449
#1 0x149b151b463c in spider_udf_direct_sql_get_conn(st_spider_direct_sql const, st_spider_transaction, int*) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:666
#2 0x149b151c1cdc in spider_direct_sql_body(st_udf_init, st_udf_args, char, char, char) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:1580
#3 0x55bfd3ee7d61 in udf_handler::val_int(char*) /test/bb-11.5-mdev-34404_opt_san/sql/sql_udf.h:108
#4 0x55bfd3ee7d61 in Item_func_udf_int::val_int() /test/bb-11.5-mdev-34404_opt_san/sql/item_func.cc:3792
#5 0x55bfd324e717 in Type_handler::Item_send_longlong(Item, Protocol, st_value*) const /test/bb-11.5-mdev-34404_opt_san/sql/sql_type.cc:7543
#6 0x55bfd1c403cc in Protocol::send_result_set_row(List<Item>*) /test/bb-11.5-mdev-34404_opt_san/sql/protocol.cc:1359
#7 0x55bfd1f628ea in select_send::send_data(List<Item>&) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.cc:3189
#8 0x55bfd2756051 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.h:6090
#9 0x55bfd2756051 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.h:6080
#10 0x55bfd2756051 in JOIN::exec_inner() /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:4862
#11 0x55bfd275aa83 in JOIN::exec() /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:4774
#12 0x55bfd274815d in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:5304
#13 0x55bfd274bd60 in handle_select(THD, LEX, select_result*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:630
#14 0x55bfd22b9b00 in execute_sqlcom_select /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:6093
#15 0x55bfd231f149 in mysql_execute_command(THD*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:3942
#16 0x55bfd232e382 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:7815
#17 0x55bfd2339853 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:1892
#18 0x55bfd2346428 in do_command(THD*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:1405
#19 0x55bfd2cbe6fc in do_handle_one_connection(CONNECT*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_connect.cc:1445
#20 0x55bfd2cc0cfc in handle_one_connection /test/bb-11.5-mdev-34404_opt_san/sql/sql_connect.cc:1347
#21 0x149b39a97ad9 in start_thread nptl/pthread_create.c:444
#22 0x149b39b2847b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

/test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:453:11: runtime error: null pointer passed as argument 2, which is declared to never be null
#0 0x149b14fb4913 in spider_udf_direct_sql_create_conn(st_spider_direct_sql const, int) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:453
#1 0x149b151b463c in spider_udf_direct_sql_get_conn(st_spider_direct_sql const, st_spider_transaction, int*) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:666
#2 0x149b151c1cdc in spider_direct_sql_body(st_udf_init, st_udf_args, char, char, char) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:1580
#3 0x55bfd3ee7d61 in udf_handler::val_int(char*) /test/bb-11.5-mdev-34404_opt_san/sql/sql_udf.h:108
#4 0x55bfd3ee7d61 in Item_func_udf_int::val_int() /test/bb-11.5-mdev-34404_opt_san/sql/item_func.cc:3792
#5 0x55bfd324e717 in Type_handler::Item_send_longlong(Item, Protocol, st_value*) const /test/bb-11.5-mdev-34404_opt_san/sql/sql_type.cc:7543
#6 0x55bfd1c403cc in Protocol::send_result_set_row(List<Item>*) /test/bb-11.5-mdev-34404_opt_san/sql/protocol.cc:1359
#7 0x55bfd1f628ea in select_send::send_data(List<Item>&) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.cc:3189
#8 0x55bfd2756051 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.h:6090
#9 0x55bfd2756051 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.h:6080
#10 0x55bfd2756051 in JOIN::exec_inner() /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:4862
#11 0x55bfd275aa83 in JOIN::exec() /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:4774
#12 0x55bfd274815d in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:5304
#13 0x55bfd274bd60 in handle_select(THD, LEX, select_result*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:630
#14 0x55bfd22b9b00 in execute_sqlcom_select /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:6093
#15 0x55bfd231f149 in mysql_execute_command(THD*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:3942
#16 0x55bfd232e382 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:7815
#17 0x55bfd2339853 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:1892
#18 0x55bfd2346428 in do_command(THD*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:1405
#19 0x55bfd2cbe6fc in do_handle_one_connection(CONNECT*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_connect.cc:1445
#20 0x55bfd2cc0cfc in handle_one_connection /test/bb-11.5-mdev-34404_opt_san/sql/sql_connect.cc:1347
#21 0x149b39a97ad9 in start_thread nptl/pthread_create.c:444
#22 0x149b39b2847b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

ycp FYI, and thank you for the work on the fix. Perhaps the same fix is required for additional code paths/functions?

Roel Van de Paar added a comment - 2024-06-17 04:16 - edited The first issue looks resolved: bb-11.5-mdev-34404 11.5.0 01eeea90355be79cff919778634f3ba284807035 (Optimized, UBASAN) 11.5.0-opt>SELECT spider_copy_tables ('a','',''); ERROR 1032 (HY000): Can't find record in 'spider_tables' And no UBSAN stack. However, the second testcase still produces a UBSAN trace: bb-11.5-mdev-34404 11.5.0 01eeea90355be79cff919778634f3ba284807035 (Optimized, UBASAN) 11.5.0-opt>SELECT spider_direct_sql ('a','','b'); ERROR 1429 (HY000): Unable to connect to foreign data source: localhost # Crashed bb-11.5-mdev-34404 11.5.0 01eeea90355be79cff919778634f3ba284807035 (Optimized, UBASAN) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_table.cc:6973:9: runtime error: null pointer passed as argument 2, which is declared to never be null #0 0x149b14faff9c in spider_create_string(char const*, unsigned int) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_table.cc:6973 #1 0x149b151b669a in spider_udf_set_direct_sql_param_default(st_spider_transaction*, st_spider_direct_sql*) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:1206 #2 0x149b151b92fd in spider_udf_parse_direct_sql_param(st_spider_transaction*, st_spider_direct_sql*, char const*, int) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:1073 #3 0x149b151c0cb9 in spider_direct_sql_body(st_udf_init*, st_udf_args*, char*, char*, char) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:1498 #4 0x55bfd3ee7d61 in udf_handler::val_int(char*) /test/bb-11.5-mdev-34404_opt_san/sql/sql_udf.h:108 #5 0x55bfd3ee7d61 in Item_func_udf_int::val_int() /test/bb-11.5-mdev-34404_opt_san/sql/item_func.cc:3792 #6 0x55bfd324e717 in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /test/bb-11.5-mdev-34404_opt_san/sql/sql_type.cc:7543 #7 0x55bfd1c403cc in Protocol::send_result_set_row(List<Item>*) /test/bb-11.5-mdev-34404_opt_san/sql/protocol.cc:1359 #8 0x55bfd1f628ea in select_send::send_data(List<Item>&) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.cc:3189 #9 0x55bfd2756051 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.h:6090 #10 0x55bfd2756051 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.h:6080 #11 0x55bfd2756051 in JOIN::exec_inner() /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:4862 #12 0x55bfd275aa83 in JOIN::exec() /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:4774 #13 0x55bfd274815d in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:5304 #14 0x55bfd274bd60 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:630 #15 0x55bfd22b9b00 in execute_sqlcom_select /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:6093 #16 0x55bfd231f149 in mysql_execute_command(THD*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:3942 #17 0x55bfd232e382 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:7815 #18 0x55bfd2339853 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:1892 #19 0x55bfd2346428 in do_command(THD*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:1405 #20 0x55bfd2cbe6fc in do_handle_one_connection(CONNECT*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_connect.cc:1445 #21 0x55bfd2cc0cfc in handle_one_connection /test/bb-11.5-mdev-34404_opt_san/sql/sql_connect.cc:1347 #22 0x149b39a97ad9 in start_thread nptl/pthread_create.c:444 #23 0x149b39b2847b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:449:11: runtime error: null pointer passed as argument 2, which is declared to never be null #0 0x149b14fb458e in spider_udf_direct_sql_create_conn(st_spider_direct_sql const*, int*) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:449 #1 0x149b151b463c in spider_udf_direct_sql_get_conn(st_spider_direct_sql const*, st_spider_transaction*, int*) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:666 #2 0x149b151c1cdc in spider_direct_sql_body(st_udf_init*, st_udf_args*, char*, char*, char) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:1580 #3 0x55bfd3ee7d61 in udf_handler::val_int(char*) /test/bb-11.5-mdev-34404_opt_san/sql/sql_udf.h:108 #4 0x55bfd3ee7d61 in Item_func_udf_int::val_int() /test/bb-11.5-mdev-34404_opt_san/sql/item_func.cc:3792 #5 0x55bfd324e717 in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /test/bb-11.5-mdev-34404_opt_san/sql/sql_type.cc:7543 #6 0x55bfd1c403cc in Protocol::send_result_set_row(List<Item>*) /test/bb-11.5-mdev-34404_opt_san/sql/protocol.cc:1359 #7 0x55bfd1f628ea in select_send::send_data(List<Item>&) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.cc:3189 #8 0x55bfd2756051 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.h:6090 #9 0x55bfd2756051 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.h:6080 #10 0x55bfd2756051 in JOIN::exec_inner() /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:4862 #11 0x55bfd275aa83 in JOIN::exec() /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:4774 #12 0x55bfd274815d in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:5304 #13 0x55bfd274bd60 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:630 #14 0x55bfd22b9b00 in execute_sqlcom_select /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:6093 #15 0x55bfd231f149 in mysql_execute_command(THD*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:3942 #16 0x55bfd232e382 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:7815 #17 0x55bfd2339853 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:1892 #18 0x55bfd2346428 in do_command(THD*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:1405 #19 0x55bfd2cbe6fc in do_handle_one_connection(CONNECT*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_connect.cc:1445 #20 0x55bfd2cc0cfc in handle_one_connection /test/bb-11.5-mdev-34404_opt_san/sql/sql_connect.cc:1347 #21 0x149b39a97ad9 in start_thread nptl/pthread_create.c:444 #22 0x149b39b2847b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:453:11: runtime error: null pointer passed as argument 2, which is declared to never be null #0 0x149b14fb4913 in spider_udf_direct_sql_create_conn(st_spider_direct_sql const*, int*) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:453 #1 0x149b151b463c in spider_udf_direct_sql_get_conn(st_spider_direct_sql const*, st_spider_transaction*, int*) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:666 #2 0x149b151c1cdc in spider_direct_sql_body(st_udf_init*, st_udf_args*, char*, char*, char) /test/bb-11.5-mdev-34404_opt_san/storage/spider/spd_direct_sql.cc:1580 #3 0x55bfd3ee7d61 in udf_handler::val_int(char*) /test/bb-11.5-mdev-34404_opt_san/sql/sql_udf.h:108 #4 0x55bfd3ee7d61 in Item_func_udf_int::val_int() /test/bb-11.5-mdev-34404_opt_san/sql/item_func.cc:3792 #5 0x55bfd324e717 in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /test/bb-11.5-mdev-34404_opt_san/sql/sql_type.cc:7543 #6 0x55bfd1c403cc in Protocol::send_result_set_row(List<Item>*) /test/bb-11.5-mdev-34404_opt_san/sql/protocol.cc:1359 #7 0x55bfd1f628ea in select_send::send_data(List<Item>&) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.cc:3189 #8 0x55bfd2756051 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.h:6090 #9 0x55bfd2756051 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_class.h:6080 #10 0x55bfd2756051 in JOIN::exec_inner() /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:4862 #11 0x55bfd275aa83 in JOIN::exec() /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:4774 #12 0x55bfd274815d in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:5304 #13 0x55bfd274bd60 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/bb-11.5-mdev-34404_opt_san/sql/sql_select.cc:630 #14 0x55bfd22b9b00 in execute_sqlcom_select /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:6093 #15 0x55bfd231f149 in mysql_execute_command(THD*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:3942 #16 0x55bfd232e382 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:7815 #17 0x55bfd2339853 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:1892 #18 0x55bfd2346428 in do_command(THD*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_parse.cc:1405 #19 0x55bfd2cbe6fc in do_handle_one_connection(CONNECT*, bool) /test/bb-11.5-mdev-34404_opt_san/sql/sql_connect.cc:1445 #20 0x55bfd2cc0cfc in handle_one_connection /test/bb-11.5-mdev-34404_opt_san/sql/sql_connect.cc:1347 #21 0x149b39a97ad9 in start_thread nptl/pthread_create.c:444 #22 0x149b39b2847b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 ycp FYI, and thank you for the work on the fix. Perhaps the same fix is required for additional code paths/functions?

Yuchen Pei added a comment - 2024-06-17 06:11

Thanks Roel, the second case seems to be the exact same issue.

Hi holyfoot, ptal thanks:

bb-10.5-mdev-34404 b285a1143bbed0467ab327a89cdae48c276ba405

MDEV-34404 Use safe_str in spider udfs to avoid passing NULL str

I did not include any test because I could not reproduce it locally, but also the issue looks trivial enough. Let me know if you want me to include the tests.

Yuchen Pei added a comment - 2024-06-17 06:11 Thanks Roel , the second case seems to be the exact same issue. Hi holyfoot , ptal thanks: bb-10.5-mdev-34404 b285a1143bbed0467ab327a89cdae48c276ba405 MDEV-34404 Use safe_str in spider udfs to avoid passing NULL str I did not include any test because I could not reproduce it locally, but also the issue looks trivial enough. Let me know if you want me to include the tests.

Roel Van de Paar added a comment - 2024-06-17 07:28

ycp Great to hear it is the same issue - I see your patch in both functions now.

Roel Van de Paar added a comment - 2024-06-17 07:28 ycp Great to hear it is the same issue - I see your patch in both functions now.

Alexey Botchkov added a comment - 2024-06-23 16:18

ok to push.

Alexey Botchkov added a comment - 2024-06-23 16:18 ok to push.

Yuchen Pei added a comment - 2024-06-25 06:26

Thanks for the review - pushed aebd2397cce9b9b14a171ad9e3718fb07a017622 to 10.5

Yuchen Pei added a comment - 2024-06-25 06:26 Thanks for the review - pushed aebd2397cce9b9b14a171ad9e3718fb07a017622 to 10.5

People

Assignee:: Yuchen Pei

Reporter:: Roel Van de Paar

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Dates

Created:: 2024-06-15 05:29

Updated:: 2024-06-25 06:26

Resolved:: 2024-06-25 06:26

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server