Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-35215

ASAN errors in Item_func_vec_fromtext::val_str upon VEC_FROMTEXT with an invalid argument

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • N/A
    • 11.7.1
    • Vector search
    • None

    Description

      A patch for MDEV-35212 is already in the branch.

      CREATE TABLE t (v VECTOR(1));
      INSERT INTO t VALUES (VEC_FROMTEXT('[0.93]'));
      SELECT VEC_FROMTEXT(v) FROM t;
       
      # Cleanup
      DROP TABLE t;
      

      bb-11.6-MDEV-32887-vector 93b15e98a85ecb73d15c482e891f1942c60eb027

      ==2408056==ERROR: AddressSanitizer: unknown-crash on address 0x61900009a6ce at pc 0x556ce4bbaeaf bp 0x7fdaef8ff390 sp 0x7fdaef8ff388
      READ of size 1 at 0x61900009a6ce thread T5
          #0 0x556ce4bbaeae in my_charlen_utf8mb3 /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/strings/ctype-utf8.c:645
          #1 0x556ce4bbaeae in my_well_formed_char_length_utf8mb3 /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/strings/ctype-mb.inl:187
          #2 0x556ce4bedd0c in my_ci_well_formed_char_length /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/include/m_ctype.h:1339
          #3 0x556ce4bedd0c in my_well_formed_length /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/include/m_ctype.h:1911
          #4 0x556ce4bedd0c in process_str_arg /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/strings/my_vsnprintf.c:286
          #5 0x556ce4bf0da9 in my_vsnprintf_ex /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/strings/my_vsnprintf.c:729
          #6 0x556ce30e39f6 in push_warning_printf(THD*, Sql_state_errno_level::enum_warning_level, unsigned int, char const*, ...) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_error.cc:787
          #7 0x556ce406a74f in Item_func_vec_fromtext::val_str(String*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/item_vectorfunc.cc:209
          #8 0x556ce38638f2 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_type.cc:7635
          #9 0x556ce2f16845 in Protocol::send_result_set_row(List<Item>*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/protocol.cc:1353
          #10 0x556ce306edf5 in select_send::send_data(List<Item>&) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_class.cc:3275
          #11 0x556ce334dd42 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_class.h:6190
          #12 0x556ce334dd42 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_class.h:6180
          #13 0x556ce334dd42 in end_send /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:24984
          #14 0x556ce33a8821 in do_select /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:23094
          #15 0x556ce33a8821 in JOIN::exec_inner() /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:5026
          #16 0x556ce33a9742 in JOIN::exec() /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:4809
          #17 0x556ce33a185d in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:5342
          #18 0x556ce33a33c6 in handle_select(THD*, LEX*, select_result*, unsigned long long) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:624
          #19 0x556ce31b54ab in execute_sqlcom_select /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:6151
          #20 0x556ce31e4c84 in mysql_execute_command(THD*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:3953
          #21 0x556ce31ea151 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:7873
          #22 0x556ce31f244e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:1892
          #23 0x556ce31f7658 in do_command(THD*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:1405
          #24 0x556ce362577e in do_handle_one_connection(CONNECT*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_connect.cc:1448
          #25 0x556ce362608c in handle_one_connection /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_connect.cc:1350
          #26 0x556ce424b077 in pfs_spawn_thread /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/storage/perfschema/pfs.cc:2198
          #27 0x7fdafa8a8043 in start_thread nptl/pthread_create.c:442
          #28 0x7fdafa92861b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
       
      0x61900009a6ce is located 78 bytes inside of 1040-byte region [0x61900009a680,0x61900009aa90)
      allocated by thread T5 here:
          #0 0x7fdafb4b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
          #1 0x556ce4b01c83 in my_malloc /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/mysys/my_malloc.c:93
          #2 0x556ce4aee2ac in alloc_root /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/mysys/my_alloc.c:333
          #3 0x556ce4aef775 in strmake_root /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/mysys/my_alloc.c:668
          #4 0x556ce357fa97 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/table.cc:4322
          #5 0x556ce3035d4d in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_base.cc:2241
          #6 0x556ce303f6b9 in open_and_process_table /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_base.cc:4179
          #7 0x556ce303f6b9 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_base.cc:4665
          #8 0x556ce304236b in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_base.cc:5634
          #9 0x556ce3112ebf in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_base.h:532
          #10 0x556ce3112ebf in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_insert.cc:782
          #11 0x556ce31dc799 in mysql_execute_command(THD*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:4458
          #12 0x556ce31ea151 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:7873
          #13 0x556ce31f244e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:1892
          #14 0x556ce31f7658 in do_command(THD*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:1405
          #15 0x556ce362577e in do_handle_one_connection(CONNECT*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_connect.cc:1448
          #16 0x556ce362608c in handle_one_connection /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_connect.cc:1350
          #17 0x556ce424b077 in pfs_spawn_thread /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/storage/perfschema/pfs.cc:2198
          #18 0x7fdafa8a8043 in start_thread nptl/pthread_create.c:442
       
      Thread T5 created by T0 here:
          #0 0x7fdafb449726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
          #1 0x556ce424b2ed in my_thread_create /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/storage/perfschema/my_thread.h:38
          #2 0x556ce424b2ed in pfs_spawn_thread_v1 /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/storage/perfschema/pfs.cc:2249
          #3 0x556ce2e5a503 in inline_mysql_thread_create /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/include/mysql/psi/mysql_thread.h:1139
          #4 0x556ce2e5a503 in create_thread_to_handle_connection(CONNECT*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/mysqld.cc:6267
          #5 0x556ce2e66ee5 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/mysqld.cc:6391
          #6 0x556ce2e67b37 in handle_connections_sockets() /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/mysqld.cc:6504
          #7 0x556ce2e6963c in mysqld_main(int, char**) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/mysqld.cc:6162
          #8 0x7fdafa8461c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
       
      SUMMARY: AddressSanitizer: unknown-crash /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/strings/ctype-utf8.c:645 in my_charlen_utf8mb3
      Shadow bytes around the buggy address:
        0x0c328000b480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c328000b490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c328000b4a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c328000b4b0: 00 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa
        0x0c328000b4c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      =>0x0c328000b4d0: 00 00 00 00 00 00 f7 02 f7[06]06 f7 00 00 f7 f7
        0x0c328000b4e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c328000b4f0: 00 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 00
        0x0c328000b500: 00 00 00 00 f7 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c328000b510: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c328000b520: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==2408056==ABORTING
      

      Attachments

        Issue Links

          Activity

            People

              serg Sergei Golubchik
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.