Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-35393

ASAN unknown-crash in Field_varstring::reset when inserting NULL value to a table with filename charset

Details

    Description

      ASAN unknown-crash in Field_varstring::reset when inserting NULL value to a table with filename charset . Issue occurs only when large field length is given to the char datatype after setting empty sql_mode.

      Another InnoDB issue is logged when setting large field length for char datatype after setting emplty sql_mode MDEV-35392.

      SET sql_mode='';
      		 
      CREATE TABLE t (a CHAR(205)) ENGINE=MYISAM CHARACTER SET filename;
      		 
      INSERT INTO t VALUES (NULL);

      Leads to

      CS 11.7.0 35cebfdc513f92b143b1a7229c480f4f684f1698 (Optimized, UBASAN)

      		 
      Core was generated by `/test/UBASAN_MD171024-mariadb-11.7.0-linux-x86_64-opt/bin/mariadbd --no-default'.
      		 
      Program terminated with signal SIGABRT, Aborted.
      		 
      #0  __pthread_kill (threadid=<optimized out>, signo=6)at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      		 
      [Current thread is 1 (Thread 0x150e92cfb700 (LWP 2151375))]
      		 
      (gdb) bt
      		 
      #0  __pthread_kill (threadid=<optimized out>, signo=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      		 
      #1  0x00000000015a1356 in handle_fatal_signal (sig=<optimized out>) at signal_handler.cc:366
      		 
      #2  <signal handler called>
      		 
      #3  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      		 
      #4  0x0000150eb5c7a859 in __GI_abort () at abort.c:79
      		 
      #5  0x000000000080ef37 in __sanitizer::Abort() () at sql_basic_types.h:151
      		 
      #6  0x000000000080d961 in __sanitizer::Die() () at sql_basic_types.h:151
      		 
      #7  0x00000000007f5299 in __asan::ScopedInErrorReport::~ScopedInErrorReport() () at sql_basic_types.h:151
      		 
      #8  0x00000000007f6d4e in __asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool) () at sql_basic_types.h:151
      		 
      #9  0x00000000007f0a81 in __asan_memset () at sql_basic_types.h:151
      		 
      #10 0x000000000157533c in Field_varstring::reset (this=<optimized out>) at field.h:4235
      		 
      #11 0x000000000157b268 in set_field_to_null_with_conversions (field=<optimized out>, no_conversions=<optimized out>) at field_conv.cc:213
      		 
      #12 0x0000000000a6910a in fill_record (thd=<optimized out>, table=<optimized out>, ptr=<optimized out>, values=<optimized out>, ignore_errors=<optimized out>, use_value=<optimized out>, check_for_computability=<optimized out>) at sql_base.cc:9384
      		 
      #13 0x0000000000a698b4 in fill_record_n_invoke_before_triggers (thd=0x62b00015e218, table=0x150e92cf6220, ptr=0x619000073ac8, values=@0x6290000a0f60: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6290000a1000, last = 0x6290000a1000, elements = 1}, <No data fields>}, ignore_errors=<optimized out>, event=TRG_EVENT_INSERT) at sql_base.cc:9439
      		 
      #14 0x0000000000b1a27a in mysql_insert (thd=<optimized out>, table_list=0x6290000a0358, fields=<optimized out>, values_list=<optimized out>, update_fields=<optimized out>, update_values=<optimized out>, duplic=<optimized out>, ignore=<optimized out>, result=<optimized out>) at sql_insert.cc:1122
      		 
      #15 0x0000000000c1439e in mysql_execute_command (thd=0x62b00015e218, is_called_from_prepared_stmt=<optimized out>) at sql_parse.cc:4459
      		 
      #16 0x0000000000bf88b1 in mysql_parse (thd=0x62b00015e218, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at sql_parse.cc:7889
      		 
      #17 0x0000000000bf212f in dispatch_command (command=<optimized out>, thd=0x62b00015e218, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at sql_parse.cc:1892
      		 
      #18 0x0000000000bf958a in do_command (thd=0x62b00015e218, blocking=true) at sql_parse.cc:1405
      		 
      #19 0x00000000010b3043 in do_handle_one_connection (connect=<optimized out>, put_in_cache=<optimized out>) at sql_connect.cc:1448
      		 
      #20 0x00000000010b2668 in handle_one_connection (arg=0x608000002638) at sql_connect.cc:1350
      		 
      #21 0x0000150eb6061609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      		 
      #22 0x0000150eb5d77133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

      Attachments

        Issue Links

          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-35392 Assertion `!__asan_region_is_poisoned((vo id*) dest,templ->mysql_col_len)' failed in void row_sel_field_store_in_mysql_format_func(byte *, const mysql_row_templ_t *, const byte *, ulint)

          • Major - Major loss of function.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-35392 Assertion `!__asan_region_is_poisoned((vo id*) dest,templ->mysql_col_len)' failed in void row_sel_field_store_in_mysql_format_func(byte *, const mysql_row_templ_t *, const byte *, ulint)

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-35490 MDEV-35393: 10.5: ASAN unknown-crash in Field_varstring::reset() on INSERT

          • Major - Major loss of function.
          • Open

          Activity

            People

              bar Alexander Barkov
              ramesh Ramesh Sivaraman
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.