Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
10.5, 10.6, 10.11, 11.1(EOL), 11.2(EOL), 11.4, 11.5(EOL), 11.6(EOL)
Description
SET sql_mode=''; |
INSTALL PLUGIN Spider SONAME 'ha_spider.so'; |
GRANT ALL ON * TO Spider@localhost; |
CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE'',USER 'Spider',PASSWORD''); |
CREATE TABLE t1 (c INT) ENGINE=MyISAM; |
CREATE TABLE t2 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",SRV "srv",TABLE "t1"'; |
SELECT * FROM t2 ORDER BY CAST(c AS INET6); |
Leads to:
11.2.5 03807c8449cdccbf5b8afc0dddabb1d8ec7ba85a (Optimized) |
Core was generated by `/test/MD200724-mariadb-11.2.5-linux-x86_64-opt/bin/mariadbd --no-defaults --max'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
Download failed: Invalid argument. Continuing without source file ./string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S.
|
#0 __memcpy_evex_unaligned_erms ()at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:523
|
 |
warning: 523 ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S: No such file or directory
|
[Current thread is 1 (LWP 3957002)]
|
(gdb) bt
|
#0 __memcpy_evex_unaligned_erms ()at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:523
|
#1 0x000014f7006ac554 in memcpy (__len=4294967295, __src=0x14f700766900, __dest=<optimized out>)at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29
|
#2 Binary_string::q_append (data_len=4294967295, data=0x14f700766900 "@x,\037\311U", this=0x14f6a0046860)at /test/11.2_opt/sql/sql_string.h:466
|
#3 spider_string::q_append (this=this@entry=0x14f6a0046850, data=data@entry=0x14f6a00437b7 "", data_len=data_len@entry=4294967295)at /test/11.2_opt/storage/spider/spd_malloc.cc:1095
|
#4 0x000014f7006d16cb in spider_db_mbase_util::print_item_func (this=0x14f70071e1e0 <spider_db_mysql_utility>, item_func=0x14f6a00122e8, spider=0x14f6a004a450, str=0x14f6a0046850, alias=0x0, alias_length=0, use_fields=true, fields=0x14f6a00a7da0)at /test/11.2_opt/storage/spider/spd_db_mysql.cc:6655
|
#5 0x000014f7006e3473 in spider_mbase_handler::append_list_item_select (this=0x14f6a00467f0, select=<optimized out>, str=0x14f6a0046850, alias=0x0, alias_length=0, use_fields=true, fields=0x14f6a00a7da0)at /test/11.2_opt/storage/spider/spd_db_mysql.cc:14727
|
#6 0x000014f7006e6753 in spider_make_query (table=0x14f6a004e790, spider=0x14f6a004a450, fields=0x14f6a00a7da0, query=@0x14f6a00a8280: {select = 0x14f6a0012990, distinct = false, from = 0x14f6a0011250, where = 0x0, group_by = 0x0, order_by = 0x14f6a00123b0, having = 0x0, limit = 0x14f6a0005770})at /test/11.2_opt/storage/spider/spd_group_by_handler.cc:1095
|
#7 spider_group_by_handler::init_scan (this=0x14f6a00a8260)at /test/11.2_opt/storage/spider/spd_group_by_handler.cc:1292
|
#8 0x000055c91dfd898d in Pushdown_query::execute (this=0x14f6a00141e0, join=join@entry=0x14f6a00125e8)at /test/11.2_opt/sql/group_by_handler.cc:49
|
#9 0x000055c91dfb9110 in do_select (procedure=<optimized out>, join=0x14f6a00125e8) at /test/11.2_opt/sql/sql_select.cc:23043
|
#10 JOIN::exec_inner (this=this@entry=0x14f6a00125e8)at /test/11.2_opt/sql/sql_select.cc:5021
|
#11 0x000055c91dfb9aae in JOIN::exec (this=this@entry=0x14f6a00125e8)at /test/11.2_opt/sql/sql_select.cc:4798
|
#12 0x000055c91dfb7a2c in mysql_select (thd=thd@entry=0x14f6a0000c68, tables=0x14f6a0011250, fields=@0x14f6a0010ed0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f6a0011200, last = 0x14f6a0011200, elements = 1}, <No data fields>}, conds=0x0, og_num=1, order=0x14f6a00123b0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x14f6a00125c0, unit=0x14f6a0004fe8, select_lex=0x14f6a0010c18)at /test/11.2_opt/sql/sql_select.cc:5336
|
#13 0x000055c91dfb8222 in handle_select (thd=thd@entry=0x14f6a0000c68, lex=lex@entry=0x14f6a0004f08, result=result@entry=0x14f6a00125c0, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/11.2_opt/sql/sql_select.cc:628
|
#14 0x000055c91df2af95 in execute_sqlcom_select (thd=thd@entry=0x14f6a0000c68, all_tables=0x14f6a0011250) at /test/11.2_opt/sql/sql_parse.cc:6161
|
#15 0x000055c91df3a17f in mysql_execute_command (thd=thd@entry=0x14f6a0000c68, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.2_opt/sql/sql_parse.cc:3984
|
#16 0x000055c91df3b6f6 in mysql_parse (thd=0x14f6a0000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/11.2_opt/sql/sql_parse.cc:7920
|
#17 0x000055c91df3d905 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14f6a0000c68, packet=packet@entry=0x14f6a0008839 "", packet_length=packet_length@entry=42, blocking=blocking@entry=true)at /test/11.2_opt/sql/sql_parse.cc:1993
|
#18 0x000055c91df3fdd3 in do_command (thd=0x14f6a0000c68, blocking=blocking@entry=true) at /test/11.2_opt/sql/sql_parse.cc:1407
|
#19 0x000055c91e06cc7f in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55c921409738, put_in_cache=put_in_cache@entry=true)at /test/11.2_opt/sql/sql_connect.cc:1439
|
#20 0x000055c91e06cfcd in handle_one_connection (arg=arg@entry=0x55c921409738)at /test/11.2_opt/sql/sql_connect.cc:1341
|
#21 0x000055c91e419081 in pfs_spawn_thread (arg=0x55c9213ea888)at /test/11.2_opt/storage/perfschema/pfs.cc:2201
|
#22 0x000014f70169ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#23 0x000014f701729c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
Bug confirmed present in:
MariaDB: 10.5.26 (dbg), 10.5.26 (opt), 10.6.19 (opt), 10.6.19 (dbg), 10.11.9 (dbg), 10.11.9 (opt), 11.1.6 (opt), 11.2.5 (opt), 11.2.5 (dbg), 11.4.3 (dbg), 11.4.3 (opt), 11.5.2 (dbg), 11.5.2 (opt), 11.6.0 (dbg), 11.6.0 (opt), 11.1.6 (dbg)
Bug is very lightly sporadic and can sometimes on debug builds produce error 1064 rather than crashing - observed in 11.1.6 (dbg) and 11.2.5 (dbg):
11.1.6 88711ee50906b8e2d793ad9b10cd1139f122ec11 (Debug) |
11.1.6-dbg>SELECT * FROM t2 ORDER BY CAST(c AS INET6);
|
ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '\008Fcast(`test`.`t2`.`c` as inet6) ``,t0.`c` `c` from `test`.`t1` t0 order by ``' at line 1
|
Attachments
Issue Links
- relates to
-
MDEV-29502 ASAN: heap-buffer-overflow & stack-buffer-overflow in spider_db_mbase_row::append_to_str | SIGSEGV's in __memmove_avx_unaligned_erms from memcpy in Binary_string::q_append, in Static_binary_string::q_append and my_strntoull10rnd_8bit | Unknown error 12801
- Closed