Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-34852

MSAN use-of-uninitialized-value in key_copy / QUICK_ROR_INTERSECT_SELECT::get_next

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Major
    • Resolution: Unresolved
    • 10.5, 10.6, 10.11, 11.4
    • 10.5, 10.6, 10.11, 11.4
    • Optimizer
    • None

    Description

      Test case for 10.5-10.11 (simpler)

      --source include/have_innodb.inc
       
      CREATE TABLE t (
        pk INT AUTO_INCREMENT PRIMARY KEY,
        a varchar(10),
        b bigint,
        c varchar(64),
        KEY (a),
        KEY (b),
        KEY (c)
      ) ENGINE=InnoDB;
       
      INSERT INTO t (a,b,c) VALUES
      (NULL,NULL,NULL),('y',1,'d'),('w',4,'p'),('a',1,'s'),('w',3,'p'),('b',3,'e'),
      ('z',6,'f'),('h',1,'o'),('a',0,'d'),('g',0,'m'),('l',3,'d'),('n',8,'m'),
      ('o',9,'u'),('m',2,'v'),('z',3,'d'),('w',5,'y'),('m',2,'w'),('i',9,'e'),
      ('k',NULL,'f'),('x',NULL,'r'),(NULL,NULL,NULL),(NULL,NULL,'a'),(NULL,NULL,'b'),
      ('c',NULL,NULL);
      ANALYZE TABLE t PERSISTENT FOR ALL;
       
      explain extended SELECT * FROM t WHERE (c <> 'i' OR c IS NULL) AND b IS NULL AND (c IS NULL OR a IS NULL);
      SELECT * FROM t WHERE (c <> 'i' OR c IS NULL) AND b IS NULL AND (c IS NULL OR a IS NULL);
       
      # Cleanup
      DROP TABLE t;
      

      Test case for 11.4+

      --source include/have_innodb.inc
       
      CREATE TABLE t (
        pk INT AUTO_INCREMENT PRIMARY KEY,
        a varchar(10),
        b bigint,
        c varchar(64),
        KEY (a),
        KEY (b),
        KEY (c)
      ) ENGINE=InnoDB;
       
      INSERT INTO t (a,b,c) VALUES
      (NULL,NULL,NULL),('y',1,'d'),('w',4,'p'),('a',1,'s'),('w',3,'p'),('b',3,'e'),
      ('z',6,'f'),('h',1,'o'),('a',0,'d'),('g',0,'m'),('l',3,'d'),('n',8,'m'),
      ('o',9,'u'),('m',2,'v'),('z',3,'d'),('w',5,'y'),('m',2,'w'),('i',9,'e'),
      ('k',NULL,'f'),('x',NULL,'r'),(NULL,NULL,NULL),(NULL,NULL,'a'),(NULL,NULL,'b'),
      ('c',NULL,NULL);
      INSERT INTO t (a,b,c) SELECT a,b,c FROM t;
      INSERT INTO t (a,b,c) SELECT a,b,c FROM t;
      ANALYZE TABLE t PERSISTENT FOR ALL;
       
      explain extended SELECT * FROM t FORCE INDEX(c,a,b) WHERE (c <> 'i' OR c IS NULL) AND b IS NULL AND (c IS NULL OR a IS NULL);
      SELECT * FROM t FORCE INDEX(c,a,b) WHERE (c <> 'i' OR c IS NULL) AND b IS NULL AND (c IS NULL OR a IS NULL);
       
      # Cleanup
      DROP TABLE t;
      

      10.5 7f55c610608d45a0958f502a8b428c6d37f86692

      id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra
      1	SIMPLE	t	index_merge	a,b,c	c,a,b	67,13,9	NULL	4	29.17	Using union(c,intersect(a,b)); Using where
      Warnings:
      Note	1003	select `test`.`t`.`pk` AS `pk`,`test`.`t`.`a` AS `a`,`test`.`t`.`b` AS `b`,`test`.`t`.`c` AS `c` from `test`.`t` where (`test`.`t`.`c` <> 'i' or `test`.`t`.`c` is null) and `test`.`t`.`b` is null and (`test`.`t`.`c` is null or `test`.`t`.`a` is null)
       
      ==1364197==WARNING: MemorySanitizer: use-of-uninitialized-value
          #0 0x1e07acd in key_copy(unsigned char*, unsigned char const*, st_key const*, unsigned int, bool) /data/bld/10.5-msan/sql/key.cc:132:11
          #1 0x201021f in QUICK_ROR_INTERSECT_SELECT::get_next() /data/bld/10.5-msan/sql/opt_range.cc:12510:3
          #2 0x20117c3 in QUICK_ROR_UNION_SELECT::get_next() /data/bld/10.5-msan/sql/opt_range.cc:12639:24
          #3 0x206c1e1 in rr_quick(READ_RECORD*) /data/bld/10.5-msan/sql/records.cc:403:37
          #4 0xea662c in READ_RECORD::read_record() /data/bld/10.5-msan/sql/records.h:80:30
          #5 0xea662c in sub_select(JOIN*, st_join_table*, bool) /data/bld/10.5-msan/sql/sql_select.cc:21325:18
          #6 0xe1c6ef in do_select(JOIN*, Procedure*) /data/bld/10.5-msan/sql/sql_select.cc:20823:14
          #7 0xe1c6ef in JOIN::exec_inner() /data/bld/10.5-msan/sql/sql_select.cc:4661:50
          #8 0xe185c8 in JOIN::exec() /data/bld/10.5-msan/sql/sql_select.cc:4441:3
          #9 0xd7e470 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/10.5-msan/sql/sql_select.cc:4918:9
          #10 0xd7ce86 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/bld/10.5-msan/sql/sql_select.cc:449:10
          #11 0xcb2286 in execute_sqlcom_select(THD*, TABLE_LIST*) /data/bld/10.5-msan/sql/sql_parse.cc:6437:12
          #12 0xc8bfff in mysql_execute_command(THD*) /data/bld/10.5-msan/sql/sql_parse.cc:4029:12
          #13 0xc720c7 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/bld/10.5-msan/sql/sql_parse.cc:8237:18
          #14 0xc656de in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/bld/10.5-msan/sql/sql_parse.cc:1891:7
          #15 0xc740bb in do_command(THD*) /data/bld/10.5-msan/sql/sql_parse.cc:1375:17
          #16 0x127fdf7 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.5-msan/sql/sql_connect.cc:1407:11
          #17 0x127f534 in handle_one_connection /data/bld/10.5-msan/sql/sql_connect.cc:1319:5
          #18 0x26ac6aa in pfs_spawn_thread /data/bld/10.5-msan/storage/perfschema/pfs.cc:2201:3
          #19 0x7fad252ed043 in start_thread nptl/./nptl/pthread_create.c:442:8
          #20 0x7fad2536d61b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
       
        Uninitialized value was stored to memory at
          #0 0x30915ff in row_sel_copy_cached_fields_for_mysql(unsigned char*, unsigned char const*, row_prebuilt_t*) /data/bld/10.5-msan/storage/innobase/row/row0sel.cc:3744:5
       
        Uninitialized value was stored to memory at
          #0 0x749fc9 in __msan_memcpy (/mnt8t/bld/10.5-msan/sql/mariadbd+0x749fc9)
          #1 0x30a75fe in row_sel_dequeue_cached_row_for_mysql(unsigned char*, row_prebuilt_t*) /data/bld/10.5-msan/storage/innobase/row/row0sel.cc:3783:3
       
        Uninitialized value was stored to memory at
          #0 0x30c088c in row_sel_store_mysql_field(unsigned char*, row_prebuilt_t*, unsigned char const*, dict_index_t const*, unsigned short const*, unsigned long, mysql_row_templ_t const*) /data/bld/10.5-msan/storage/innobase/row/row0sel.cc:3010:5
       
        Memory was marked as uninitialized
          #0 0x75076e in __msan_allocated_memory (/mnt8t/bld/10.5-msan/sql/mariadbd+0x75076e)
          #1 0x308606e in row_sel_field_store_in_mysql_format_func(unsigned char*, mysql_row_templ_t const*, dict_index_t const*, unsigned long, unsigned char const*, unsigned long) /data/bld/10.5-msan/storage/innobase/row/row0sel.cc:2754:2
       
      SUMMARY: MemorySanitizer: use-of-uninitialized-value /data/bld/10.5-msan/sql/key.cc:132:11 in key_copy(unsigned char*, unsigned char const*, st_key const*, unsigned int, bool)
      

      Attachments

        Activity

          People

            psergei Sergei Petrunia
            elenst Elena Stepanova
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.