Type:
Bug
Priority:
Major
Resolution:
Unresolved
Affects Version/s:
10.5 , 10.6 , 10.11 , 11.4 , 11.7(EOL) , 11.8
Looks related to MDEV-31499 , however the testcase in that bug does not lead to the UBSAN issue described here, and the testcase in this bug does not crash unlike the one in MDEV-31499 .
SELECT ST_WITHIN (ST_UNION (ST_GEOMFROMTEXT ( 'POINT(1 1)' ),ST_GEOMFROMTEXT ( 'MULTIPOINT(2 2,3 3)' )),ST_INTERSECTION (ST_GEOMFROMTEXT ( 'POINT(0 0)' ),ST_GEOMFROMTEXT ( 'POINT(1 1)' )));
Leads to:
CS 11.4.5 866a8ea6736d2edc0f6be552d1cdd6810c10d5ab (Debug, UBASAN)
/test/11.4_dbg_san/sql/spatial.cc:3340:10: runtime error: applying non-zero offset 1 to null pointer
CS 11.4.5 866a8ea6736d2edc0f6be552d1cdd6810c10d5ab (Debug, UBASAN)
#0 0x563c31ec12c6 in Gis_geometry_collection::init_from_opresult(String*, char const*, unsigned int) /test/11.4_dbg_san/sql/spatial.cc:3340:10
#1 0x563c31e6c26e in Geometry::create_from_opresult(Geometry_buffer*, String*, Gcalc_result_receiver&) /test/11.4_dbg_san/sql/spatial.cc:697:15
#2 0x563c3150e354 in Item_func_spatial_operation::val_str(String*) /test/11.4_dbg_san/sql/item_geofunc.cc:1582:8
#3 0x563c315047df in Geometry_ptr_with_buffer_and_mbr::construct(Item*, String*) /test/11.4_dbg_san/sql/item_geofunc.cc:1354:24
#4 0x563c31506938 in Item_func_spatial_precise_rel::val_bool() /test/11.4_dbg_san/sql/item_geofunc.cc:1411:24
#5 0x563c2dd3bb5b in Item_bool_func::val_int() /test/11.4_dbg_san/sql/item_cmpfunc.h:249:12
#6 0x563c3022d7fb in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /test/11.4_dbg_san/sql/sql_type.cc:7715:22
#7 0x563c3027938c in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const /test/11.4_dbg_san/sql/sql_type.h:5851:12
#8 0x563c2db7abd7 in Item::send(Protocol*, st_value*) /test/11.4_dbg_san/sql/item.h:1261:28
#9 0x563c2de20bc1 in Protocol::send_result_set_row(List<Item>*) /test/11.4_dbg_san/sql/protocol.cc:1333:15
#10 0x563c2e4486fa in select_send::send_data(List<Item>&) /test/11.4_dbg_san/sql/sql_class.cc:3245:17
#11 0x563c2ee382a0 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.4_dbg_san/sql/sql_class.h:6092:12
#12 0x563c2ee326a3 in JOIN::exec_inner() /test/11.4_dbg_san/sql/sql_select.cc:4916:22
#13 0x563c2ee2eaaa in JOIN::exec() /test/11.4_dbg_san/sql/sql_select.cc:4828:8
#14 0x563c2eccddf9 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.4_dbg_san/sql/sql_select.cc:5358:21
#15 0x563c2ecc94b7 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.4_dbg_san/sql/sql_select.cc:642:10
#16 0x563c2e9b33e0 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/11.4_dbg_san/sql/sql_parse.cc:6169:12
#17 0x563c2e953e7c in mysql_execute_command(THD*, bool) /test/11.4_dbg_san/sql/sql_parse.cc:3962:12
#18 0x563c2e8fa489 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.4_dbg_san/sql/sql_parse.cc:7893:18
#19 0x563c2e8db783 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.4_dbg_san/sql/sql_parse.cc:1905:7
#20 0x563c2e9043e6 in do_command(THD*, bool) /test/11.4_dbg_san/sql/sql_parse.cc:1418:17
#21 0x563c2fa4c896 in do_handle_one_connection(CONNECT*, bool) /test/11.4_dbg_san/sql/sql_connect.cc:1429:11
#22 0x563c2fa4b05d in handle_one_connection /test/11.4_dbg_san/sql/sql_connect.cc:1341:5
#23 0x563c2dade9bc in asan_thread_start(void*) asan_interceptors.cpp.o
#24 0x146875a9ca93 in start_thread nptl/pthread_create.c:447:8
#25 0x146875b29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-nonzero-offset /test/11.4_dbg_san/sql/spatial.cc:3340:10
Setup:
Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18:
# llvm-17-linker-tools installs /usr/lib/llvm-17/lib/LLVMgold.so, which is needed for compilation, and LLVMgold.so is no longer included in LLVM 18
sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev llvm-17-linker-tools
sudo ln -s /usr/lib/llvm-17/lib/LLVMgold.so /usr/lib/llvm-18/lib/LLVMgold.so
-DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
Set before execution:
export UBSAN_OPTIONS=suppressions=/home/roel/mariadb-qa/UBSAN.filter:print_stacktrace=1:report_error_type=1
Bug confirmed present in:
MariaDB: 10.5.28 (dbg), 10.5.28 (opt), 10.6.21 (dbg), 10.6.21 (opt), 10.11.11 (dbg), 10.11.11 (opt), 11.4.5 (dbg), 11.4.5 (opt), 11.7.1 (dbg), 11.7.1 (opt), 11.8.0 (dbg), 11.8.0 (opt)
relates to
MDEV-3293
LP:801243 - Assertion `(0)' failed in Gis_geometry_collection::init_from_opresult on ST_UNION in maria-5.3-gis
MDEV-31499
Assertion `(0)' failed in Gis_geometry_collection::init_from_opresult
Open
{"report":{"fcp":1048.8000001907349,"ttfb":217.10000038146973,"pageVisibility":"visible","entityId":131860,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{},"userDeviceMemory":8,"userDeviceProcessors":64,"apdex":0.5,"journeyId":"a2094f1a-1ed3-4bf3-8c62-0a1e538b7481","navigationType":0,"readyForUser":1135.5,"redirectCount":0,"resourceLoadedEnd":1755.4000005722046,"resourceLoadedStart":230.4000005722046,"resourceTiming":[{"duration":276.5999994277954,"initiatorType":"link","name":"https://jira.mariadb.org/s/2c21342762a6a02add1c328bed317ffd-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/css/_super/batch.css","startTime":230.4000005722046,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":230.4000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":507,"responseStart":0,"secureConnectionStart":0},{"duration":276.6000003814697,"initiatorType":"link","name":"https://jira.mariadb.org/s/7ebd35e77e471bc30ff0eba799ebc151-CDN/lu2cib/820016/12ta74/2bf333562ca6724060a9d5f1535471f6/_/download/contextbatch/css/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":230.80000019073486,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":230.80000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":507.4000005722046,"responseStart":0,"secureConnectionStart":0},{"duration":304.5999994277954,"initiatorType":"script","name":"https://jira.mariadb.org/s/0917945aaa57108d00c5076fea35e069-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/js/_super/batch.js?locale=en","startTime":230.9000005722046,"connectEnd":230.9000005722046,"connectStart":230.9000005722046,"domainLookupEnd":230.9000005722046,"domainLookupStart":230.9000005722046,"fetchStart":230.9000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":230.9000005722046,"responseEnd":535.5,"responseStart":535.4000005722046,"secureConnectionStart":230.9000005722046},{"duration":409.0999994277954,"initiatorType":"script","name":"https://jira.mariadb.org/s/2d8175ec2fa4c816e8023260bd8c1786-CDN/lu2cib/820016/12ta74/2bf333562ca6724060a9d5f1535471f6/_/download/contextbatch/js/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true","startTime":231.10000038146973,"connectEnd":231.10000038146973,"connectStart":231.10000038146973,"domainLookupEnd":231.10000038146973,"domainLookupStart":231.10000038146973,"fetchStart":231.10000038146973,"redirectEnd":0,"redirectStart":0,"requestStart":231.10000038146973,"responseEnd":640.1999998092651,"responseStart":640.1999998092651,"secureConnectionStart":231.10000038146973},{"duration":412.69999980926514,"initiatorType":"script","name":"https://jira.mariadb.org/s/a9324d6758d385eb45c462685ad88f1d-CDN/lu2cib/820016/12ta74/c92c0caa9a024ae85b0ebdbed7fb4bd7/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en","startTime":231.4000005722046,"connectEnd":231.4000005722046,"connectStart":231.4000005722046,"domainLookupEnd":231.4000005722046,"domainLookupStart":231.4000005722046,"fetchStart":231.4000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":231.4000005722046,"responseEnd":644.1000003814697,"responseStart":644.1000003814697,"secureConnectionStart":231.4000005722046},{"duration":413,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":231.60000038146973,"connectEnd":231.60000038146973,"connectStart":231.60000038146973,"domainLookupEnd":231.60000038146973,"domainLookupStart":231.60000038146973,"fetchStart":231.60000038146973,"redirectEnd":0,"redirectStart":0,"requestStart":231.60000038146973,"responseEnd":644.6000003814697,"responseStart":644.6000003814697,"secureConnectionStart":231.60000038146973},{"duration":413.20000076293945,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":231.69999980926514,"connectEnd":231.69999980926514,"connectStart":231.69999980926514,"domainLookupEnd":231.69999980926514,"domainLookupStart":231.69999980926514,"fetchStart":231.69999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":231.69999980926514,"responseEnd":644.9000005722046,"responseStart":644.9000005722046,"secureConnectionStart":231.69999980926514},{"duration":461.69999980926514,"initiatorType":"link","name":"https://jira.mariadb.org/s/b04b06a02d1959df322d9cded3aeecc1-CDN/lu2cib/820016/12ta74/a2ff6aa845ffc9a1d22fe23d9ee791fc/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":231.9000005722046,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":231.9000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":693.6000003814697,"responseStart":0,"secureConnectionStart":0},{"duration":413.4000005722046,"initiatorType":"script","name":"https://jira.mariadb.org/rest/api/1.0/shortcuts/820016/47140b6e0a9bc2e4913da06536125810/shortcuts.js?context=issuenavigation&context=issueaction","startTime":232,"connectEnd":232,"connectStart":232,"domainLookupEnd":232,"domainLookupStart":232,"fetchStart":232,"redirectEnd":0,"redirectStart":0,"requestStart":232,"responseEnd":645.4000005722046,"responseStart":645.4000005722046,"secureConnectionStart":232},{"duration":461.6000003814697,"initiatorType":"link","name":"https://jira.mariadb.org/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.css?jira.create.linked.issue=true","startTime":232.19999980926514,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":232.19999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":693.8000001907349,"responseStart":0,"secureConnectionStart":0},{"duration":413.69999980926514,"initiatorType":"script","name":"https://jira.mariadb.org/s/5d5e8fe91fbc506585e83ea3b62ccc4b-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.js?jira.create.linked.issue=true&locale=en","startTime":232.4000005722046,"connectEnd":232.4000005722046,"connectStart":232.4000005722046,"domainLookupEnd":232.4000005722046,"domainLookupStart":232.4000005722046,"fetchStart":232.4000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":232.4000005722046,"responseEnd":646.1000003814697,"responseStart":646.1000003814697,"secureConnectionStart":232.4000005722046},{"duration":576.1000003814697,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":233.30000019073486,"connectEnd":233.30000019073486,"connectStart":233.30000019073486,"domainLookupEnd":233.30000019073486,"domainLookupStart":233.30000019073486,"fetchStart":233.30000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":233.30000019073486,"responseEnd":809.4000005722046,"responseStart":809.3000001907349,"secureConnectionStart":233.30000019073486},{"duration":1499.3999996185303,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":233.4000005722046,"connectEnd":233.4000005722046,"connectStart":233.4000005722046,"domainLookupEnd":233.4000005722046,"domainLookupStart":233.4000005722046,"fetchStart":233.4000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":233.4000005722046,"responseEnd":1732.8000001907349,"responseStart":1732.8000001907349,"secureConnectionStart":233.4000005722046},{"duration":115.89999961853027,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":710.6000003814697,"connectEnd":710.6000003814697,"connectStart":710.6000003814697,"domainLookupEnd":710.6000003814697,"domainLookupStart":710.6000003814697,"fetchStart":710.6000003814697,"redirectEnd":0,"redirectStart":0,"requestStart":710.6000003814697,"responseEnd":826.5,"responseStart":826.5,"secureConnectionStart":710.6000003814697},{"duration":750.7999992370605,"initiatorType":"link","name":"https://jira.mariadb.org/s/50bc9be5bfead1a25e72c1a9338c94f6-CDN/lu2cib/820016/12ta74/e108c7645258ccb43280ed3404e3e949/_/download/contextbatch/css/com.atlassian.jira.plugins.jira-development-integration-plugin:0,-_super,-jira.view.issue,-jira.global,-jira.general,-jira.browse.project,-project.issue.navigator,-atl.general/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":982.9000005722046,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":982.9000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1733.6999998092651,"responseStart":0,"secureConnectionStart":0},{"duration":750.4000005722046,"initiatorType":"link","name":"https://jira.mariadb.org/s/d5715adaadd168a9002b108b2b039b50-CDN/lu2cib/820016/12ta74/be4b45e9cec53099498fa61c8b7acba4/_/download/contextbatch/css/jira.project.sidebar,-_super,-project.issue.navigator,-jira.general,-jira.browse.project,-jira.view.issue,-jira.global,-atl.general,-com.atlassian.jira.projects.sidebar.init/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":983.5,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":983.5,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1733.9000005722046,"responseStart":0,"secureConnectionStart":0},{"duration":769.7999992370605,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/e65b778d185daf5aee24936755b43da6/_/download/contextbatch/js/browser-metrics-plugin.contrib,-_super,-project.issue.navigator,-jira.view.issue,-atl.general/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":984.4000005722046,"connectEnd":984.4000005722046,"connectStart":984.4000005722046,"domainLookupEnd":984.4000005722046,"domainLookupStart":984.4000005722046,"fetchStart":984.4000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":984.4000005722046,"responseEnd":1754.1999998092651,"responseStart":1754.1999998092651,"secureConnectionStart":984.4000005722046},{"duration":770.6000003814697,"initiatorType":"script","name":"https://jira.mariadb.org/s/e0bf5781d46ea69fb123572974cf39de-CDN/lu2cib/820016/12ta74/e108c7645258ccb43280ed3404e3e949/_/download/contextbatch/js/com.atlassian.jira.plugins.jira-development-integration-plugin:0,-_super,-jira.view.issue,-jira.global,-jira.general,-jira.browse.project,-project.issue.navigator,-atl.general/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true","startTime":984.8000001907349,"connectEnd":984.8000001907349,"connectStart":984.8000001907349,"domainLookupEnd":984.8000001907349,"domainLookupStart":984.8000001907349,"fetchStart":984.8000001907349,"redirectEnd":0,"redirectStart":0,"requestStart":984.8000001907349,"responseEnd":1755.4000005722046,"responseStart":1755.4000005722046,"secureConnectionStart":984.8000001907349},{"duration":774.5,"initiatorType":"script","name":"https://jira.mariadb.org/s/097ae97cb8fbec7d6ea4bbb1f26955b9-CDN/lu2cib/820016/12ta74/be4b45e9cec53099498fa61c8b7acba4/_/download/contextbatch/js/jira.project.sidebar,-_super,-project.issue.navigator,-jira.general,-jira.browse.project,-jira.view.issue,-jira.global,-atl.general,-com.atlassian.jira.projects.sidebar.init/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true","startTime":985.1999998092651,"connectEnd":985.1999998092651,"connectStart":985.1999998092651,"domainLookupEnd":985.1999998092651,"domainLookupStart":985.1999998092651,"fetchStart":985.1999998092651,"redirectEnd":0,"redirectStart":0,"requestStart":985.1999998092651,"responseEnd":1759.6999998092651,"responseStart":1759.6999998092651,"secureConnectionStart":985.1999998092651},{"duration":770.7999992370605,"initiatorType":"script","name":"https://www.google-analytics.com/analytics.js","startTime":1041.9000005722046,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1041.9000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1812.6999998092651,"responseStart":0,"secureConnectionStart":0}],"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":58,"responseStart":217,"responseEnd":221,"domLoading":228,"domInteractive":1756,"domContentLoadedEventStart":1756,"domContentLoadedEventEnd":1802,"domComplete":2435,"loadEventStart":2435,"loadEventEnd":2435,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[{"name":"bigPipe.sidebar-id.start","time":1735.4000005722046},{"name":"bigPipe.sidebar-id.end","time":1736.3000001907349},{"name":"bigPipe.activity-panel-pipe-id.start","time":1736.5},{"name":"bigPipe.activity-panel-pipe-id.end","time":1737.3000001907349},{"name":"activityTabFullyLoaded","time":1823.6999998092651}],"measures":[],"correlationId":"879d1ba08e3157","effectiveType":"4g","downlink":9.3,"rtt":0,"serverDuration":93,"dbReadsTimeInMs":14,"dbConnsTimeInMs":21,"applicationHash":"9d11dbea5f4be3d4cc21f03a88dd11d8c8687422","experiments":[]}}
A suppression filter for pointer-overflow:Gis_geometry_collection::init_from_opresult was added for this bug.