[MDEV-35406] UBSAN runtime error: signed integer overflow on SELECT DATE_ADD/MAKEDATE - Jira

Details

Type: Bug
Status: Confirmed (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.5, 10.6, 10.11, 11.2(EOL), 11.4, 11.6(EOL), 11.7(EOL), 11.8
Fix Version/s: 10.5, 10.6, 10.11, 11.4
Component/s: Data types
Labels:

Description

SELECT DATE_ADD('1-1-1',INTERVAL '9223372036854775808-02' YEAR_MONTH) AS result;

Leads to:

CS 11.2.6 66b8d32b7514f46b1467d404d3f9ad688bbfeb4f (Optimized, UBASAN)
/test/11.2_opt_san/sql/sql_time.cc:1027:63: runtime error: signed integer overflow: -9223372036854775808 * 12 cannot be represented in type 'long int'

CS 11.2.6 66b8d32b7514f46b1467d404d3f9ad688bbfeb4f (Optimized, UBASAN)
#0 0x55e274bc4bb0 in date_add_interval(THD, st_mysql_time, interval_type, INTERVAL const&, bool) /test/11.2_opt_san/sql/sql_time.cc:1027
#1 0x55e27679c6be in Func_handler_date_add_interval::add(THD, Item, interval_type, bool, st_mysql_time*) const /test/11.2_opt_san/sql/item_timefunc.h:1711
#2 0x55e27679c6be in Func_handler_date_add_interval_string::get_date(THD, Item_handled_func, st_mysql_time*, date_mode_t) const /test/11.2_opt_san/sql/item_timefunc.h:1824
#3 0x55e27528e1f8 in Temporal_hybrid::Temporal_hybrid(THD, Item, date_mode_t) /test/11.2_opt_san/sql/sql_type.cc:441
#4 0x55e276702d56 in Temporal_hybrid::Temporal_hybrid(THD, Item) /test/11.2_opt_san/sql/sql_type.h:1269
#5 0x55e276702d56 in Temporal_hybrid::Temporal_hybrid(Item*) /test/11.2_opt_san/sql/sql_type.h:1272
#6 0x55e276702d56 in Item_handled_func::Handler_temporal_string::val_str_ascii(Item_handled_func, String) const /test/11.2_opt_san/sql/item_func.h:647
#7 0x55e27631b23e in Item_func::val_str_from_val_str_ascii(String, String) /test/11.2_opt_san/sql/item_strfunc.cc:104
#8 0x55e276793a9f in Item_handled_func::Handler_temporal::val_str(Item_handled_func, String) const /test/11.2_opt_san/sql/item_func.h:612
#9 0x55e2752cbbc6 in Type_handler::Item_send_str(Item, Protocol, st_value*) const /test/11.2_opt_san/sql/sql_type.cc:7657
#10 0x55e273b8fcec in Protocol::send_result_set_row(List<Item>*) /test/11.2_opt_san/sql/protocol.cc:1333
#11 0x55e273f714ba in select_send::send_data(List<Item>&) /test/11.2_opt_san/sql/sql_class.cc:3194
#12 0x55e27473da01 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.2_opt_san/sql/sql_class.h:5956
#13 0x55e27473da01 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.2_opt_san/sql/sql_class.h:5946
#14 0x55e27473da01 in JOIN::exec_inner() /test/11.2_opt_san/sql/sql_select.cc:4909
#15 0x55e274742483 in JOIN::exec() /test/11.2_opt_san/sql/sql_select.cc:4820
#16 0x55e27472f94d in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.2_opt_san/sql/sql_select.cc:5358
#17 0x55e274733550 in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.2_opt_san/sql/sql_select.cc:642
#18 0x55e274268450 in execute_sqlcom_select /test/11.2_opt_san/sql/sql_parse.cc:6177
#19 0x55e2742d875f in mysql_execute_command(THD*, bool) /test/11.2_opt_san/sql/sql_parse.cc:3984
#20 0x55e2742e9482 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.2_opt_san/sql/sql_parse.cc:7938
#21 0x55e2742fb0da in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.2_opt_san/sql/sql_parse.cc:1894
#22 0x55e27430b486 in do_command(THD*, bool) /test/11.2_opt_san/sql/sql_parse.cc:1407
#23 0x55e274cdeefc in do_handle_one_connection(CONNECT*, bool) /test/11.2_opt_san/sql/sql_connect.cc:1439
#24 0x55e274ce152c in handle_one_connection /test/11.2_opt_san/sql/sql_connect.cc:1341
#25 0x15380b89ca93 in start_thread nptl/pthread_create.c:447
#26 0x15380b929c3b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

CS 11.2.6 66b8d32b7514f46b1467d404d3f9ad688bbfeb4f (Debug, UBASAN)
/test/11.2_dbg_san/sql/sql_time.cc:1027:63: runtime error: signed integer overflow: -9223372036854775808 * 12 cannot be represented in type 'long int'

CS 11.2.6 66b8d32b7514f46b1467d404d3f9ad688bbfeb4f (Debug, UBASAN)
#0 0x564d026f7b02 in date_add_interval(THD, st_mysql_time, interval_type, INTERVAL const&, bool) /test/11.2_dbg_san/sql/sql_time.cc:1027
#1 0x564d04442930 in Func_handler_date_add_interval::add(THD, Item, interval_type, bool, st_mysql_time*) const /test/11.2_dbg_san/sql/item_timefunc.h:1711
#2 0x564d04442930 in Func_handler_date_add_interval_string::get_date(THD, Item_handled_func, st_mysql_time*, date_mode_t) const /test/11.2_dbg_san/sql/item_timefunc.h:1824
#3 0x564d02eadb60 in Item_handled_func::get_date(THD, st_mysql_time, date_mode_t) /test/11.2_dbg_san/sql/item_func.h:865
#4 0x564d02e45556 in Temporal_hybrid::Temporal_hybrid(THD, Item, date_mode_t) /test/11.2_dbg_san/sql/sql_type.cc:441
#5 0x564d0442cb32 in Temporal_hybrid::Temporal_hybrid(THD, Item) /test/11.2_dbg_san/sql/sql_type.h:1269
#6 0x564d0442cb32 in Temporal_hybrid::Temporal_hybrid(Item*) /test/11.2_dbg_san/sql/sql_type.h:1272
#7 0x564d0442cb32 in Item_handled_func::Handler_temporal_string::val_str_ascii(Item_handled_func, String) const /test/11.2_dbg_san/sql/item_func.h:647
#8 0x564d02ead2d0 in Item_handled_func::val_str_ascii(String*) /test/11.2_dbg_san/sql/item_func.h:849
#9 0x564d03fdb430 in Item_func::val_str_from_val_str_ascii(String, String) /test/11.2_dbg_san/sql/item_strfunc.cc:104
#10 0x564d0442ae8d in Item_handled_func::Handler_temporal::val_str(Item_handled_func, String) const /test/11.2_dbg_san/sql/item_func.h:612
#11 0x564d02ead0b0 in Item_handled_func::val_str(String*) /test/11.2_dbg_san/sql/item_func.h:845
#12 0x564d02e88ecb in Type_handler::Item_send_str(Item, Protocol, st_value*) const /test/11.2_dbg_san/sql/sql_type.cc:7657
#13 0x564d027b0b0e in Type_handler_string_result::Item_send(Item, Protocol, st_value*) const /test/11.2_dbg_san/sql/sql_type.h:5534
#14 0x564d014c70c0 in Item::send(Protocol, st_value) /test/11.2_dbg_san/sql/item.h:1255
#15 0x564d016c83ec in Protocol::send_result_set_row(List<Item>*) /test/11.2_dbg_san/sql/protocol.cc:1333
#16 0x564d01a72912 in select_send::send_data(List<Item>&) /test/11.2_dbg_san/sql/sql_class.cc:3194
#17 0x564d0221c46d in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.2_dbg_san/sql/sql_class.h:5956
#18 0x564d0221c46d in JOIN::exec_inner() /test/11.2_dbg_san/sql/sql_select.cc:4909
#19 0x564d02222bd6 in JOIN::exec() /test/11.2_dbg_san/sql/sql_select.cc:4820
#20 0x564d02210dc3 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.2_dbg_san/sql/sql_select.cc:5358
#21 0x564d022152d4 in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.2_dbg_san/sql/sql_select.cc:642
#22 0x564d01d68dd9 in execute_sqlcom_select /test/11.2_dbg_san/sql/sql_parse.cc:6177
#23 0x564d01dcd8fc in mysql_execute_command(THD*, bool) /test/11.2_dbg_san/sql/sql_parse.cc:3984
#24 0x564d01df8351 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.2_dbg_san/sql/sql_parse.cc:7938
#25 0x564d01e0829b in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.2_dbg_san/sql/sql_parse.cc:1894
#26 0x564d01e16b06 in do_command(THD*, bool) /test/11.2_dbg_san/sql/sql_parse.cc:1407
#27 0x564d0283e791 in do_handle_one_connection(CONNECT*, bool) /test/11.2_dbg_san/sql/sql_connect.cc:1439
#28 0x564d0283fcb3 in handle_one_connection /test/11.2_dbg_san/sql/sql_connect.cc:1341
#29 0x15147869ca93 in start_thread nptl/pthread_create.c:447
#30 0x151478729c3b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Setup:

Compiled with a recent version of GCC (I used GCC 11.4.0) and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1

Bug confirmed present in:
MariaDB: 10.5.27 (dbg), 10.5.27 (opt), 10.6.20 (dbg), 10.6.20 (opt), 10.11.10 (dbg), 10.11.10 (opt), 11.2.6 (dbg), 11.2.6 (opt), 11.4.4 (dbg), 11.4.4 (opt), 11.6.2 (dbg), 11.6.2 (opt), 11.7.0 (dbg), 11.7.0 (opt)

Attachments

Issue Links

relates to

MDEV-30931 UBSAN: negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in get_interval_value on SELECT

Closed

MDEV-35714 UBSAN: runtime error: downcast of address 0x1549d2b0ba50 with insufficient space for an object of type 'my_decimal' in Item_dyncol_get::get_date

Confirmed

Activity

Ascending order - Click to sort in descending order

Roel Van de Paar added a comment - 2024-11-19 00:06 - edited

bar Hi! It seems that various testcases from ~~MDEV-30931~~ have not been fixed yet?
For example,

SELECT MAKEDATE(1,8e+307);

Still leads to:

CS 10.5.28 7afee25b08bf801a97ce3246bb604d388572eace (Debug, UBASAN)
2024-11-19 11:03:12 0 [Note] /test/UBASAN_MD091124-mariadb-10.5.28-linux-x86_64-dbg/bin/mariadbd: ready for connections.
Version: '10.5.28-MariaDB-debug' socket: '/test/UBASAN_MD091124-mariadb-10.5.28-linux-x86_64-dbg/socket.sock' port: 10484 MariaDB Server
/test/10.5_dbg_san/sql/item_timefunc.cc:2636:30: runtime error: signed integer overflow: 9223372036854775807 + 730851 cannot be represented in type 'long int'
#0 0x55bf5f4c8f1f in Item_func_makedate::get_date(THD, st_mysql_time, date_mode_t) /test/10.5_dbg_san/sql/item_timefunc.cc:2636
#1 0x55bf5e1d30e0 in Type_handler::Item_send_date(Item, Protocol, st_value*) const /test/10.5_dbg_san/sql/sql_type.cc:7660
#2 0x55bf5e242418 in Type_handler_temporal_with_date::Item_send(Item, Protocol, st_value*) const /test/10.5_dbg_san/sql/sql_type.h:6350
#3 0x55bf5cd07810 in Item::send(Protocol, st_value) /test/10.5_dbg_san/sql/item.h:1083
#4 0x55bf5ccf0988 in Protocol::send_result_set_row(List<Item>*) /test/10.5_dbg_san/sql/protocol.cc:1086
#5 0x55bf5d0dbe30 in select_send::send_data(List<Item>&) /test/10.5_dbg_san/sql/sql_class.cc:3161
#6 0x55bf5d784df8 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/10.5_dbg_san/sql/sql_class.h:5580
#7 0x55bf5d784df8 in JOIN::exec_inner() /test/10.5_dbg_san/sql/sql_select.cc:4529
#8 0x55bf5d78acf7 in JOIN::exec() /test/10.5_dbg_san/sql/sql_select.cc:4441
#9 0x55bf5d778f9a in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/10.5_dbg_san/sql/sql_select.cc:4918
#10 0x55bf5d77e5cb in handle_select(THD, LEX, select_result*, unsigned long) /test/10.5_dbg_san/sql/sql_select.cc:449
#11 0x55bf5d3839e2 in execute_sqlcom_select /test/10.5_dbg_san/sql/sql_parse.cc:6437
#12 0x55bf5d3e8447 in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:4029
#13 0x55bf5d416b4d in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8237
#14 0x55bf5d4262da in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891
#15 0x55bf5d434b32 in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375
#16 0x55bf5dd2c470 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1407
#17 0x55bf5dd2d62f in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1319
#18 0x14b8b0a9ca93 in start_thread nptl/pthread_create.c:447
#19 0x14b8b0b29c3b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Roel Van de Paar added a comment - 2024-11-19 00:06 - edited bar Hi! It seems that various testcases from MDEV-30931 have not been fixed yet? For example, SELECT MAKEDATE(1,8e+307); Still leads to: CS 10.5.28 7afee25b08bf801a97ce3246bb604d388572eace (Debug, UBASAN) 2024-11-19 11:03:12 0 [Note] /test/UBASAN_MD091124-mariadb-10.5.28-linux-x86_64-dbg/bin/mariadbd: ready for connections. Version: '10.5.28-MariaDB-debug' socket: '/test/UBASAN_MD091124-mariadb-10.5.28-linux-x86_64-dbg/socket.sock' port: 10484 MariaDB Server /test/10.5_dbg_san/sql/item_timefunc.cc:2636:30: runtime error: signed integer overflow: 9223372036854775807 + 730851 cannot be represented in type 'long int' #0 0x55bf5f4c8f1f in Item_func_makedate::get_date(THD*, st_mysql_time*, date_mode_t) /test/10.5_dbg_san/sql/item_timefunc.cc:2636 #1 0x55bf5e1d30e0 in Type_handler::Item_send_date(Item*, Protocol*, st_value*) const /test/10.5_dbg_san/sql/sql_type.cc:7660 #2 0x55bf5e242418 in Type_handler_temporal_with_date::Item_send(Item*, Protocol*, st_value*) const /test/10.5_dbg_san/sql/sql_type.h:6350 #3 0x55bf5cd07810 in Item::send(Protocol*, st_value*) /test/10.5_dbg_san/sql/item.h:1083 #4 0x55bf5ccf0988 in Protocol::send_result_set_row(List<Item>*) /test/10.5_dbg_san/sql/protocol.cc:1086 #5 0x55bf5d0dbe30 in select_send::send_data(List<Item>&) /test/10.5_dbg_san/sql/sql_class.cc:3161 #6 0x55bf5d784df8 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/10.5_dbg_san/sql/sql_class.h:5580 #7 0x55bf5d784df8 in JOIN::exec_inner() /test/10.5_dbg_san/sql/sql_select.cc:4529 #8 0x55bf5d78acf7 in JOIN::exec() /test/10.5_dbg_san/sql/sql_select.cc:4441 #9 0x55bf5d778f9a in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.5_dbg_san/sql/sql_select.cc:4918 #10 0x55bf5d77e5cb in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.5_dbg_san/sql/sql_select.cc:449 #11 0x55bf5d3839e2 in execute_sqlcom_select /test/10.5_dbg_san/sql/sql_parse.cc:6437 #12 0x55bf5d3e8447 in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:4029 #13 0x55bf5d416b4d in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8237 #14 0x55bf5d4262da in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891 #15 0x55bf5d434b32 in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375 #16 0x55bf5dd2c470 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1407 #17 0x55bf5dd2d62f in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1319 #18 0x14b8b0a9ca93 in start_thread nptl/pthread_create.c:447 #19 0x14b8b0b29c3b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Roel Van de Paar added a comment - 2024-12-24 04:53 - edited

I ran the original testcase through all current versions using Clang, leading to slightly different UniqueID's ('long' instead of 'long int'):

UBSAN|signed integer overflow: -X * Y cannot be represented in type 'long'|sql/sql_time.cc|date_add_interval|Func_handler_date_add_interval::add|Func_handler_date_add_interval_string::get_date|Item_handled_func::get_date

UBSAN|signed integer overflow: -X * Y cannot be represented in type 'long'|sql/sql_time.cc|date_add_interval|Func_handler_date_add_interval::add|Func_handler_date_add_interval_string::get_date|Temporal_hybrid::Temporal_hybrid

Bug confirmed present in:
MariaDB: 10.5.28 (dbg), 10.5.28 (opt), 10.6.21 (dbg), 10.6.21 (opt), 10.11.11 (dbg), 10.11.11 (opt), 11.4.5 (dbg), 11.4.5 (opt), 11.7.1 (dbg), 11.7.1 (opt), 11.8.0 (dbg), 11.8.0 (opt)

Roel Van de Paar added a comment - 2024-12-24 04:53 - edited I ran the original testcase through all current versions using Clang, leading to slightly different UniqueID's ('long' instead of 'long int'): UBSAN|signed integer overflow: -X * Y cannot be represented in type 'long'|sql/sql_time.cc|date_add_interval|Func_handler_date_add_interval::add|Func_handler_date_add_interval_string::get_date|Item_handled_func::get_date UBSAN|signed integer overflow: -X * Y cannot be represented in type 'long'|sql/sql_time.cc|date_add_interval|Func_handler_date_add_interval::add|Func_handler_date_add_interval_string::get_date|Temporal_hybrid::Temporal_hybrid Bug confirmed present in: MariaDB: 10.5.28 (dbg), 10.5.28 (opt), 10.6.21 (dbg), 10.6.21 (opt), 10.11.11 (dbg), 10.11.11 (opt), 11.4.5 (dbg), 11.4.5 (opt), 11.7.1 (dbg), 11.7.1 (opt), 11.8.0 (dbg), 11.8.0 (opt)

Roel Van de Paar added a comment - 2024-12-30 20:16

SELECT TIMESTAMPADD (MONTH,1e+100,'01-01-01 01:01:01');

Leads to:

CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Debug, UBASAN, Clang)
/test/11.8_dbg_san/sql/sql_time.cc:712:26: runtime error: signed integer overflow: 24012 + 9223372036854775807 cannot be represented in type 'long'
#0 0x55865f6a484d in date_add_interval(THD, st_mysql_time, interval_type, INTERVAL const&, bool) /test/11.8_dbg_san/sql/sql_time.cc:712:26
#1 0x5586618f524b in Func_handler_date_add_interval::add(THD, Item, interval_type, bool, st_mysql_time*) const /test/11.8_dbg_san/sql/item_timefunc.h:1812:12
#2 0x5586618d5ac1 in Func_handler_date_add_interval_string::get_date(THD, Item_handled_func, st_mysql_time*, date_mode_t) const /test/11.8_dbg_san/sql/item_timefunc.h:1925:31
#3 0x55866011580b in Item_handled_func::get_date(THD, st_mysql_time, date_mode_t) /test/11.8_dbg_san/sql/item_func.h:868:28
#4 0x55865fff6b33 in Temporal_hybrid::Temporal_hybrid(THD, Item, date_mode_t) /test/11.8_dbg_san/sql/sql_type.cc:417:13
#5 0x5586618f5ceb in Temporal_hybrid::Temporal_hybrid(THD, Item) /test/11.8_dbg_san/sql/sql_type.h:1265:5
#6 0x5586618f5917 in Temporal_hybrid::Temporal_hybrid(Item*) /test/11.8_dbg_san/sql/sql_type.h:1268:5
#7 0x5586618d48b2 in Item_handled_func::Handler_temporal_string::val_str_ascii(Item_handled_func, String) const /test/11.8_dbg_san/sql/item_func.h:650:14
#8 0x5586601147b6 in Item_handled_func::val_str_ascii(String*) /test/11.8_dbg_san/sql/item_func.h:852:28
#9 0x558661445388 in Item_func::val_str_from_val_str_ascii(String, String) /test/11.8_dbg_san/sql/item_strfunc.cc:111:18
#10 0x5586618cf6eb in Item_handled_func::Handler_temporal::val_str(Item_handled_func, String) const /test/11.8_dbg_san/sql/item_func.h:615:20
#11 0x5586601141d6 in Item_handled_func::val_str(String*) /test/11.8_dbg_san/sql/item_func.h:848:28
#12 0x5586600a2b41 in Type_handler::Item_send_str(Item, Protocol, st_value*) const /test/11.8_dbg_san/sql/sql_type.cc:7664:19
#13 0x55865f7e917c in Type_handler_string_result::Item_send(Item, Protocol, st_value*) const /test/11.8_dbg_san/sql/sql_type.h:5745:12
#14 0x55865d9a7617 in Item::send(Protocol, st_value) /test/11.8_dbg_san/sql/item.h:1256:28
#15 0x55865dc51681 in Protocol::send_result_set_row(List<Item>*) /test/11.8_dbg_san/sql/protocol.cc:1353:15
#16 0x55865e28e04a in select_send::send_data(List<Item>&) /test/11.8_dbg_san/sql/sql_class.cc:3275:17
#17 0x55865ec8ffd0 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.8_dbg_san/sql/sql_class.h:6244:12
#18 0x55865ec8a163 in JOIN::exec_inner() /test/11.8_dbg_san/sql/sql_select.cc:4908:22
#19 0x55865ec8656a in JOIN::exec() /test/11.8_dbg_san/sql/sql_select.cc:4820:8
#20 0x55865eb24a79 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.8_dbg_san/sql/sql_select.cc:5353:21
#21 0x55865eb20137 in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.8_dbg_san/sql/sql_select.cc:633:10
#22 0x55865e80bee0 in execute_sqlcom_select(THD, TABLE_LIST) /test/11.8_dbg_san/sql/sql_parse.cc:6177:12
#23 0x55865e7abdcc in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:3966:12
#24 0x55865e751ef9 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18
#25 0x55865e732db8 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
#26 0x55865e75be56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
#27 0x55865f8be556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
#28 0x55865f8bcd19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
#29 0x55865d9055fc in asan_thread_start(void*) asan_interceptors.cpp.o
#30 0x1478b1a9ca93 in start_thread nptl/pthread_create.c:447:8
#31 0x1478b1b29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: signed-integer-overflow /test/11.8_dbg_san/sql/sql_time.cc:712:26

CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Optimized, UBASAN, Clang)
/test/11.8_opt_san/sql/sql_time.cc:712:26: runtime error: signed integer overflow: 24012 + 9223372036854775807 cannot be represented in type 'long'
#0 0x562aa6ca4777 in date_add_interval(THD, st_mysql_time, interval_type, INTERVAL const&, bool) /test/11.8_opt_san/sql/sql_time.cc:712:26
#1 0x562aa7d729b1 in Func_handler_date_add_interval::add(THD, Item, interval_type, bool, st_mysql_time*) const /test/11.8_opt_san/sql/item_timefunc.h:1812:12
#2 0x562aa7d729b1 in Func_handler_date_add_interval_string::get_date(THD, Item_handled_func, st_mysql_time*, date_mode_t) const /test/11.8_opt_san/sql/item_timefunc.h:1925:31
#3 0x562aa71426c9 in Temporal_hybrid::Temporal_hybrid(THD, Item, date_mode_t) /test/11.8_opt_san/sql/sql_type.cc:417:13
#4 0x562aa7d71a67 in Temporal_hybrid::Temporal_hybrid(THD, Item) /test/11.8_opt_san/sql/sql_type.h:1265:5
#5 0x562aa7d71a67 in Temporal_hybrid::Temporal_hybrid(Item*) /test/11.8_opt_san/sql/sql_type.h:1268:5
#6 0x562aa7d71a67 in Item_handled_func::Handler_temporal_string::val_str_ascii(Item_handled_func, String) const /test/11.8_opt_san/sql/item_func.h:650:14
#7 0x562aa7af0eb9 in Item_func::val_str_from_val_str_ascii(String, String) /test/11.8_opt_san/sql/item_strfunc.cc:111:18
#8 0x562aa7d6cfdf in Item_handled_func::Handler_temporal::val_str(Item_handled_func, String) const /test/11.8_opt_san/sql/item_func.h:615:20
#9 0x562aa7197b29 in Type_handler::Item_send_str(Item, Protocol, st_value*) const /test/11.8_opt_san/sql/sql_type.cc:7664:19
#10 0x562aa608ce04 in Protocol::send_result_set_row(List<Item>*) /test/11.8_opt_san/sql/protocol.cc:1353:15
#11 0x562aa63566a3 in select_send::send_data(List<Item>&) /test/11.8_opt_san/sql/sql_class.cc:3275:17
#12 0x562aa6801648 in JOIN::exec_inner() /test/11.8_opt_san/sql/sql_select.cc:4908:22
#13 0x562aa67fce21 in JOIN::exec() /test/11.8_opt_san/sql/sql_select.cc:4820:8
#14 0x562aa6759a2b in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.8_opt_san/sql/sql_select.cc:5353:21
#15 0x562aa6757c4d in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.8_opt_san/sql/sql_select.cc:633:10
#16 0x562aa660bdac in execute_sqlcom_select(THD, TABLE_LIST) /test/11.8_opt_san/sql/sql_parse.cc:6177:12
#17 0x562aa65f0fc7 in mysql_execute_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:3966:12
#18 0x562aa65b9c92 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.8_opt_san/sql/sql_parse.cc:7901:18
#19 0x562aa65aeb9e in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.8_opt_san/sql/sql_parse.cc:1903:7
#20 0x562aa65bca6e in do_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:1416:17
#21 0x562aa6d9de38 in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_san/sql/sql_connect.cc:1415:11
#22 0x562aa6d9d280 in handle_one_connection /test/11.8_opt_san/sql/sql_connect.cc:1327:5
#23 0x562aa5ee5b0c in asan_thread_start(void*) asan_interceptors.cpp.o
#24 0x15137f49ca93 in start_thread nptl/pthread_create.c:447:8
#25 0x15137f529c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: signed-integer-overflow /test/11.8_opt_san/sql/sql_time.cc:712:26

Setup:

Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18. Ubuntu instructions:

     # Note: llvm-17-linker-tools installs /usr/lib/llvm-17/lib/LLVMgold.so, which is needed for compilation, and LLVMgold.so is no longer included in LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev llvm-17-linker-tools

     sudo ln -s /usr/lib/llvm-17/lib/LLVMgold.so /usr/lib/llvm-18/lib/LLVMgold.so

Compiled with: '-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++' and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter'. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter

Roel Van de Paar added a comment - 2024-12-30 20:16 SELECT TIMESTAMPADD ( MONTH ,1e+100, '01-01-01 01:01:01' ); Leads to: CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Debug, UBASAN, Clang) /test/11.8_dbg_san/sql/sql_time.cc:712:26: runtime error: signed integer overflow: 24012 + 9223372036854775807 cannot be represented in type 'long' #0 0x55865f6a484d in date_add_interval(THD*, st_mysql_time*, interval_type, INTERVAL const&, bool) /test/11.8_dbg_san/sql/sql_time.cc:712:26 #1 0x5586618f524b in Func_handler_date_add_interval::add(THD*, Item*, interval_type, bool, st_mysql_time*) const /test/11.8_dbg_san/sql/item_timefunc.h:1812:12 #2 0x5586618d5ac1 in Func_handler_date_add_interval_string::get_date(THD*, Item_handled_func*, st_mysql_time*, date_mode_t) const /test/11.8_dbg_san/sql/item_timefunc.h:1925:31 #3 0x55866011580b in Item_handled_func::get_date(THD*, st_mysql_time*, date_mode_t) /test/11.8_dbg_san/sql/item_func.h:868:28 #4 0x55865fff6b33 in Temporal_hybrid::Temporal_hybrid(THD*, Item*, date_mode_t) /test/11.8_dbg_san/sql/sql_type.cc:417:13 #5 0x5586618f5ceb in Temporal_hybrid::Temporal_hybrid(THD*, Item*) /test/11.8_dbg_san/sql/sql_type.h:1265:5 #6 0x5586618f5917 in Temporal_hybrid::Temporal_hybrid(Item*) /test/11.8_dbg_san/sql/sql_type.h:1268:5 #7 0x5586618d48b2 in Item_handled_func::Handler_temporal_string::val_str_ascii(Item_handled_func*, String*) const /test/11.8_dbg_san/sql/item_func.h:650:14 #8 0x5586601147b6 in Item_handled_func::val_str_ascii(String*) /test/11.8_dbg_san/sql/item_func.h:852:28 #9 0x558661445388 in Item_func::val_str_from_val_str_ascii(String*, String*) /test/11.8_dbg_san/sql/item_strfunc.cc:111:18 #10 0x5586618cf6eb in Item_handled_func::Handler_temporal::val_str(Item_handled_func*, String*) const /test/11.8_dbg_san/sql/item_func.h:615:20 #11 0x5586601141d6 in Item_handled_func::val_str(String*) /test/11.8_dbg_san/sql/item_func.h:848:28 #12 0x5586600a2b41 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.8_dbg_san/sql/sql_type.cc:7664:19 #13 0x55865f7e917c in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /test/11.8_dbg_san/sql/sql_type.h:5745:12 #14 0x55865d9a7617 in Item::send(Protocol*, st_value*) /test/11.8_dbg_san/sql/item.h:1256:28 #15 0x55865dc51681 in Protocol::send_result_set_row(List<Item>*) /test/11.8_dbg_san/sql/protocol.cc:1353:15 #16 0x55865e28e04a in select_send::send_data(List<Item>&) /test/11.8_dbg_san/sql/sql_class.cc:3275:17 #17 0x55865ec8ffd0 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.8_dbg_san/sql/sql_class.h:6244:12 #18 0x55865ec8a163 in JOIN::exec_inner() /test/11.8_dbg_san/sql/sql_select.cc:4908:22 #19 0x55865ec8656a in JOIN::exec() /test/11.8_dbg_san/sql/sql_select.cc:4820:8 #20 0x55865eb24a79 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_dbg_san/sql/sql_select.cc:5353:21 #21 0x55865eb20137 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_dbg_san/sql/sql_select.cc:633:10 #22 0x55865e80bee0 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/11.8_dbg_san/sql/sql_parse.cc:6177:12 #23 0x55865e7abdcc in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:3966:12 #24 0x55865e751ef9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18 #25 0x55865e732db8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7 #26 0x55865e75be56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17 #27 0x55865f8be556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11 #28 0x55865f8bcd19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5 #29 0x55865d9055fc in asan_thread_start(void*) asan_interceptors.cpp.o #30 0x1478b1a9ca93 in start_thread nptl/pthread_create.c:447:8 #31 0x1478b1b29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 SUMMARY: UndefinedBehaviorSanitizer: signed-integer-overflow /test/11.8_dbg_san/sql/sql_time.cc:712:26 CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Optimized, UBASAN, Clang) /test/11.8_opt_san/sql/sql_time.cc:712:26: runtime error: signed integer overflow: 24012 + 9223372036854775807 cannot be represented in type 'long' #0 0x562aa6ca4777 in date_add_interval(THD*, st_mysql_time*, interval_type, INTERVAL const&, bool) /test/11.8_opt_san/sql/sql_time.cc:712:26 #1 0x562aa7d729b1 in Func_handler_date_add_interval::add(THD*, Item*, interval_type, bool, st_mysql_time*) const /test/11.8_opt_san/sql/item_timefunc.h:1812:12 #2 0x562aa7d729b1 in Func_handler_date_add_interval_string::get_date(THD*, Item_handled_func*, st_mysql_time*, date_mode_t) const /test/11.8_opt_san/sql/item_timefunc.h:1925:31 #3 0x562aa71426c9 in Temporal_hybrid::Temporal_hybrid(THD*, Item*, date_mode_t) /test/11.8_opt_san/sql/sql_type.cc:417:13 #4 0x562aa7d71a67 in Temporal_hybrid::Temporal_hybrid(THD*, Item*) /test/11.8_opt_san/sql/sql_type.h:1265:5 #5 0x562aa7d71a67 in Temporal_hybrid::Temporal_hybrid(Item*) /test/11.8_opt_san/sql/sql_type.h:1268:5 #6 0x562aa7d71a67 in Item_handled_func::Handler_temporal_string::val_str_ascii(Item_handled_func*, String*) const /test/11.8_opt_san/sql/item_func.h:650:14 #7 0x562aa7af0eb9 in Item_func::val_str_from_val_str_ascii(String*, String*) /test/11.8_opt_san/sql/item_strfunc.cc:111:18 #8 0x562aa7d6cfdf in Item_handled_func::Handler_temporal::val_str(Item_handled_func*, String*) const /test/11.8_opt_san/sql/item_func.h:615:20 #9 0x562aa7197b29 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.8_opt_san/sql/sql_type.cc:7664:19 #10 0x562aa608ce04 in Protocol::send_result_set_row(List<Item>*) /test/11.8_opt_san/sql/protocol.cc:1353:15 #11 0x562aa63566a3 in select_send::send_data(List<Item>&) /test/11.8_opt_san/sql/sql_class.cc:3275:17 #12 0x562aa6801648 in JOIN::exec_inner() /test/11.8_opt_san/sql/sql_select.cc:4908:22 #13 0x562aa67fce21 in JOIN::exec() /test/11.8_opt_san/sql/sql_select.cc:4820:8 #14 0x562aa6759a2b in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_opt_san/sql/sql_select.cc:5353:21 #15 0x562aa6757c4d in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_opt_san/sql/sql_select.cc:633:10 #16 0x562aa660bdac in execute_sqlcom_select(THD*, TABLE_LIST*) /test/11.8_opt_san/sql/sql_parse.cc:6177:12 #17 0x562aa65f0fc7 in mysql_execute_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:3966:12 #18 0x562aa65b9c92 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_opt_san/sql/sql_parse.cc:7901:18 #19 0x562aa65aeb9e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_opt_san/sql/sql_parse.cc:1903:7 #20 0x562aa65bca6e in do_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:1416:17 #21 0x562aa6d9de38 in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_san/sql/sql_connect.cc:1415:11 #22 0x562aa6d9d280 in handle_one_connection /test/11.8_opt_san/sql/sql_connect.cc:1327:5 #23 0x562aa5ee5b0c in asan_thread_start(void*) asan_interceptors.cpp.o #24 0x15137f49ca93 in start_thread nptl/pthread_create.c:447:8 #25 0x15137f529c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 SUMMARY: UndefinedBehaviorSanitizer: signed-integer-overflow /test/11.8_opt_san/sql/sql_time.cc:712:26 Setup: Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18. Ubuntu instructions: # Note: llvm-17-linker-tools installs /usr/lib/llvm-17/lib/LLVMgold.so, which is needed for compilation, and LLVMgold.so is no longer included in LLVM 18 sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev llvm-17-linker-tools sudo ln -s /usr/lib/llvm-17/lib/LLVMgold.so /usr/lib/llvm-18/lib/LLVMgold.so Compiled with: '-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++' and: -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON Set before execution: export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1 # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter'. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter Bug confirmed present in: MariaDB: 10.5.28 (dbg), 10.5.28 (opt), 10.6.21 (dbg), 10.6.21 (opt), 10.11.11 (dbg), 10.11.11 (opt), 11.4.5 (dbg), 11.4.5 (opt), 11.7.1 (dbg), 11.7.1 (opt), 11.8.0 (dbg), 11.8.0 (opt)

People

Assignee:: Alexander Barkov

Reporter:: Roel Van de Paar

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2024-11-12 21:18

Updated:: 2025-02-14 11:39

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.