UBSAN: runtime error: index -1 out of bounds for type 'json_path_step_t[32]' (aka 'struct st_json_path_step_t[32]')

SELECT JSON_EXTRACT('{a:true}','$.a')=TRUE;

/test/10.5_opt_san/strings/json_lib.c:1701:26: runtime error: index -1 out of bounds for type 'json_path_step_t[32]' (aka 'struct st_json_path_step_t[32]')

    #0 0x55b14a4a9b16 in json_get_path_start /test/10.5_opt_san/strings/json_lib.c:1701:26

    #1 0x55b14816c55b in Item_func_json_extract::read_json(String*, json_value_types*, char**, int*) /test/10.5_opt_san/sql/item_jsonfunc.cc:971:3

    #2 0x55b148170c95 in Item_func_json_extract::val_decimal(my_decimal*) /test/10.5_opt_san/sql/item_jsonfunc.cc:1138:7

    #3 0x55b1488b80aa in Item_cache_decimal::cache_value() /test/10.5_opt_san/sql/item.cc:10559:29

    #4 0x55b1482a05f4 in Item_cache::has_value() /test/10.5_opt_san/sql/item.h:7143:29

    #5 0x55b1488b8daa in Item_cache_decimal::val_decimal(my_decimal*) /test/10.5_opt_san/sql/item.cc:10584:8

    #6 0x55b148222887 in VDec::VDec(Item*) /test/10.5_opt_san/sql/sql_type.cc:302:16

    #7 0x55b148919ee5 in Arg_comparator::compare_decimal() /test/10.5_opt_san/sql/item_cmpfunc.cc:867:8

    #8 0x55b14892a017 in Arg_comparator::compare() /test/10.5_opt_san/sql/item_cmpfunc.h:117:33

    #9 0x55b14892a017 in Item_func_eq::val_int() /test/10.5_opt_san/sql/item_cmpfunc.cc:1812:18

    #10 0x55b1482792e0 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /test/10.5_opt_san/sql/sql_type.cc:7596:22

    #11 0x55b1473588a0 in Protocol::send_result_set_row(List<Item>*) /test/10.5_opt_san/sql/protocol.cc:1086:15

    #12 0x55b1476402f5 in select_send::send_data(List<Item>&) /test/10.5_opt_san/sql/sql_class.cc:3161:17

    #13 0x55b147a41292 in JOIN::exec_inner() /test/10.5_opt_san/sql/sql_select.cc:4529:22

    #14 0x55b147a3c99c in JOIN::exec() /test/10.5_opt_san/sql/sql_select.cc:4441:3

    #15 0x55b1479a20c3 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.5_opt_san/sql/sql_select.cc:4918:9

    #16 0x55b1479a087d in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.5_opt_san/sql/sql_select.cc:449:10

    #17 0x55b1478b7c82 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/10.5_opt_san/sql/sql_parse.cc:6437:12

    #18 0x55b14789aaef in mysql_execute_command(THD*) /test/10.5_opt_san/sql/sql_parse.cc:4029:12

    #19 0x55b147862168 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_opt_san/sql/sql_parse.cc:8237:18

    #20 0x55b147855160 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_opt_san/sql/sql_parse.cc:1891:7

    #21 0x55b147864ba9 in do_command(THD*) /test/10.5_opt_san/sql/sql_parse.cc:1375:17

    #22 0x55b147f6af72 in do_handle_one_connection(CONNECT*, bool) /test/10.5_opt_san/sql/sql_connect.cc:1386:11

    #23 0x55b147f6a3d4 in handle_one_connection /test/10.5_opt_san/sql/sql_connect.cc:1298:5

    #24 0x55b1472cb10c in asan_thread_start(void*) asan_interceptors.cpp.o

    #25 0x147cf989ca93 in start_thread nptl/pthread_create.c:447:8

    #26 0x147cf9929c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: out-of-bounds-index /test/10.5_opt_san/strings/json_lib.c:1701:26 

/test/10.5_dbg_san/strings/json_lib.c:1701:26: runtime error: index -1 out of bounds for type 'json_path_step_t[32]' (aka 'struct st_json_path_step_t[32]')

    #0 0x56170578a873 in json_get_path_start /test/10.5_dbg_san/strings/json_lib.c:1701:26

    #1 0x5617008d9c4e in Item_func_json_extract::read_json(String*, json_value_types*, char**, int*) /test/10.5_dbg_san/sql/item_jsonfunc.cc:971:3

    #2 0x5617008e0ee3 in Item_func_json_extract::val_decimal(my_decimal*) /test/10.5_dbg_san/sql/item_jsonfunc.cc:1138:7

    #3 0x5616fead064e in Item::val_decimal_result(my_decimal*) /test/10.5_dbg_san/sql/item.h:1597:12

    #4 0x561701974efd in Item_cache_decimal::cache_value() /test/10.5_dbg_san/sql/item.cc:10559:29

    #5 0x561700b36892 in Item_cache::has_value() /test/10.5_dbg_san/sql/item.h:7143:29

    #6 0x561701976068 in Item_cache_decimal::val_decimal(my_decimal*) /test/10.5_dbg_san/sql/item.cc:10584:8

    #7 0x561700a2b0b2 in VDec::VDec(Item*) /test/10.5_dbg_san/sql/sql_type.cc:302:16

    #8 0x561701a01c33 in Arg_comparator::compare_decimal() /test/10.5_dbg_san/sql/item_cmpfunc.cc:867:8

    #9 0x561701a03194 in Arg_comparator::compare() /test/10.5_dbg_san/sql/item_cmpfunc.h:117:33

    #10 0x561701a1fd35 in Item_func_eq::val_int() /test/10.5_dbg_san/sql/item_cmpfunc.cc:1812:18

    #11 0x561700adb27b in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /test/10.5_dbg_san/sql/sql_type.cc:7596:22

    #12 0x561700b2407c in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const /test/10.5_dbg_san/sql/sql_type.h:5736:12

    #13 0x5616feacd977 in Item::send(Protocol*, st_value*) /test/10.5_dbg_san/sql/item.h:1083:28

    #14 0x5616feaa2871 in Protocol::send_result_set_row(List<Item>*) /test/10.5_dbg_san/sql/protocol.cc:1086:15

    #15 0x5616ff101fca in select_send::send_data(List<Item>&) /test/10.5_dbg_san/sql/sql_class.cc:3161:17

    #16 0x5616ff9832f0 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/10.5_dbg_san/sql/sql_class.h:5580:12

    #17 0x5616ff97d76c in JOIN::exec_inner() /test/10.5_dbg_san/sql/sql_select.cc:4529:22

    #18 0x5616ff9798d1 in JOIN::exec() /test/10.5_dbg_san/sql/sql_select.cc:4441:3

    #19 0x5616ff828543 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.5_dbg_san/sql/sql_select.cc:4918:9

    #20 0x5616ff8240c7 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.5_dbg_san/sql/sql_select.cc:449:10

    #21 0x5616ff6003f0 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/10.5_dbg_san/sql/sql_parse.cc:6437:12

    #22 0x5616ff59459f in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:4029:12

    #23 0x5616ff53b4e3 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8237:18

    #24 0x5616ff51b453 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891:7

    #25 0x5616ff543a19 in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375:17

    #26 0x5617004bdf30 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1386:11

    #27 0x5617004bc6fd in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1298:5

    #28 0x5616fe9b7a8c in asan_thread_start(void*) asan_interceptors.cpp.o

    #29 0x14580929ca93 in start_thread nptl/pthread_create.c:447:8

    #30 0x145809329c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: out-of-bounds-index /test/10.5_dbg_san/strings/json_lib.c:1701:26

Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18:

# llvm-17-linker-tools installs /usr/lib/llvm-17/lib/LLVMgold.so, which is needed for compilation, and LLVMgold.so is no longer included in LLVM 18

sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev llvm-17-linker-tools

sudo ln -s /usr/lib/llvm-17/lib/LLVMgold.so /usr/lib/llvm-18/lib/LLVMgold.so

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1