[MDEV-35595] UBSAN: runtime error: load of value 3, which is not a valid value for type 'wkbByteOrder' in various functions on SELECT ST_GEOMFROMWKB - Jira

XML

Word

Printable

Details

Type: Bug
Status: Open (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.5, 10.6, 10.11, 11.4, 11.7, 11.8
Fix Version/s: 10.5, 10.6, 10.11, 11.4, 11.7
Component/s: Data types, GIS
Labels:
- UBSAN
- invalid-enum-load

Description

Interestingly, changing the value, for example from "106" to "110" makes the bug non-reproducible, so there is some specific bug as to the actual value.

SELECT ST_GEOMFROMWKB (0x01060000000100000003020000000100000000000000000000000000000000000000);

Leads to:

CS 10.5.28 142851f1205d98270b917a98e1bdd483e1b8af0e (Debug, UBASAN, Clang)
/test/clang_new/10.5_opt_san/sql/spatial.cc:1629:43: runtime error: load of value 3, which is not a valid value for type 'wkbByteOrder'
#0 0x55a49f7cda4f in Gis_polygon::init_from_wkb(char const, unsigned int, Geometry::wkbByteOrder, String) /test/clang_new/10.5_opt_san/sql/spatial.cc:1629:43
#1 0x55a49f7e8f85 in Gis_multi_polygon::init_from_wkb(char const, unsigned int, Geometry::wkbByteOrder, String) /test/clang_new/10.5_opt_san/sql/spatial.cc:2893:20
#2 0x55a49f7b6807 in Geometry::create_from_wkb(Geometry_buffer, char const, unsigned int, String*) /test/clang_new/10.5_opt_san/sql/spatial.cc:485:16
#3 0x55a49f223a4e in Item_func_geometry_from_wkb::val_str(String*) /test/clang_new/10.5_opt_san/sql/item_geofunc.cc:112:11
#4 0x55a49e98e309 in Type_handler::Item_send_str(Item, Protocol, st_value*) const /test/clang_new/10.5_opt_san/sql/sql_type.cc:7563:19
#5 0x55a49da6e8a0 in Protocol::send_result_set_row(List<Item>*) /test/clang_new/10.5_opt_san/sql/protocol.cc:1086:15
#6 0x55a49dd562f5 in select_send::send_data(List<Item>&) /test/clang_new/10.5_opt_san/sql/sql_class.cc:3161:17
#7 0x55a49e157292 in JOIN::exec_inner() /test/clang_new/10.5_opt_san/sql/sql_select.cc:4529:22
#8 0x55a49e15299c in JOIN::exec() /test/clang_new/10.5_opt_san/sql/sql_select.cc:4441:3
#9 0x55a49e0b80c3 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/clang_new/10.5_opt_san/sql/sql_select.cc:4918:9
#10 0x55a49e0b687d in handle_select(THD, LEX, select_result*, unsigned long) /test/clang_new/10.5_opt_san/sql/sql_select.cc:449:10
#11 0x55a49dfcdc82 in execute_sqlcom_select(THD, TABLE_LIST) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:6437:12
#12 0x55a49dfb0aef in mysql_execute_command(THD*) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:4029:12
#13 0x55a49df78168 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:8237:18
#14 0x55a49df6b160 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:1891:7
#15 0x55a49df7aba9 in do_command(THD*) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:1375:17
#16 0x55a49e680f72 in do_handle_one_connection(CONNECT*, bool) /test/clang_new/10.5_opt_san/sql/sql_connect.cc:1386:11
#17 0x55a49e6803d4 in handle_one_connection /test/clang_new/10.5_opt_san/sql/sql_connect.cc:1298:5
#18 0x55a49d9e110c in asan_thread_start(void*) asan_interceptors.cpp.o
#19 0x1535aca9ca93 in start_thread nptl/pthread_create.c:447:8
#20 0x1535acb29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: invalid-enum-load /test/clang_new/10.5_opt_san/sql/spatial.cc:1629:43

CS 10.5.28 142851f1205d98270b917a98e1bdd483e1b8af0e (Debug, UBASAN, Clang)
/test/clang_new/10.5_opt_san/sql/spatial.cc:455:7: runtime error: load of value 3, which is not a valid value for type 'Geometry::wkbByteOrder'
#0 0x55a49f7b6f9c in wkb_get_uint(char const*, Geometry::wkbByteOrder) /test/clang_new/10.5_opt_san/sql/spatial.cc:455:7
#1 0x55a49f7cd26d in Gis_polygon::init_from_wkb(char const, unsigned int, Geometry::wkbByteOrder, String) /test/clang_new/10.5_opt_san/sql/spatial.cc:1629:25
#2 0x55a49f7e8f85 in Gis_multi_polygon::init_from_wkb(char const, unsigned int, Geometry::wkbByteOrder, String) /test/clang_new/10.5_opt_san/sql/spatial.cc:2893:20
#3 0x55a49f7b6807 in Geometry::create_from_wkb(Geometry_buffer, char const, unsigned int, String*) /test/clang_new/10.5_opt_san/sql/spatial.cc:485:16
#4 0x55a49f223a4e in Item_func_geometry_from_wkb::val_str(String*) /test/clang_new/10.5_opt_san/sql/item_geofunc.cc:112:11
#5 0x55a49e98e309 in Type_handler::Item_send_str(Item, Protocol, st_value*) const /test/clang_new/10.5_opt_san/sql/sql_type.cc:7563:19
#6 0x55a49da6e8a0 in Protocol::send_result_set_row(List<Item>*) /test/clang_new/10.5_opt_san/sql/protocol.cc:1086:15
#7 0x55a49dd562f5 in select_send::send_data(List<Item>&) /test/clang_new/10.5_opt_san/sql/sql_class.cc:3161:17
#8 0x55a49e157292 in JOIN::exec_inner() /test/clang_new/10.5_opt_san/sql/sql_select.cc:4529:22
#9 0x55a49e15299c in JOIN::exec() /test/clang_new/10.5_opt_san/sql/sql_select.cc:4441:3
#10 0x55a49e0b80c3 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/clang_new/10.5_opt_san/sql/sql_select.cc:4918:9
#11 0x55a49e0b687d in handle_select(THD, LEX, select_result*, unsigned long) /test/clang_new/10.5_opt_san/sql/sql_select.cc:449:10
#12 0x55a49dfcdc82 in execute_sqlcom_select(THD, TABLE_LIST) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:6437:12
#13 0x55a49dfb0aef in mysql_execute_command(THD*) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:4029:12
#14 0x55a49df78168 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:8237:18
#15 0x55a49df6b160 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:1891:7
#16 0x55a49df7aba9 in do_command(THD*) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:1375:17
#17 0x55a49e680f72 in do_handle_one_connection(CONNECT*, bool) /test/clang_new/10.5_opt_san/sql/sql_connect.cc:1386:11
#18 0x55a49e6803d4 in handle_one_connection /test/clang_new/10.5_opt_san/sql/sql_connect.cc:1298:5
#19 0x55a49d9e110c in asan_thread_start(void*) asan_interceptors.cpp.o
#20 0x1535aca9ca93 in start_thread nptl/pthread_create.c:447:8
#21 0x1535acb29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: invalid-enum-load /test/clang_new/10.5_opt_san/sql/spatial.cc:455:7

CS 10.5.28 142851f1205d98270b917a98e1bdd483e1b8af0e (Debug, UBASAN, Clang)
/test/clang_new/10.5_opt_san/sql/spatial.cc:1645:46: runtime error: load of value 3, which is not a valid value for type 'wkbByteOrder'
#0 0x55a49f7cd830 in Gis_polygon::init_from_wkb(char const, unsigned int, Geometry::wkbByteOrder, String) /test/clang_new/10.5_opt_san/sql/spatial.cc:1645:46
#1 0x55a49f7e8f85 in Gis_multi_polygon::init_from_wkb(char const, unsigned int, Geometry::wkbByteOrder, String) /test/clang_new/10.5_opt_san/sql/spatial.cc:2893:20
#2 0x55a49f7b6807 in Geometry::create_from_wkb(Geometry_buffer, char const, unsigned int, String*) /test/clang_new/10.5_opt_san/sql/spatial.cc:485:16
#3 0x55a49f223a4e in Item_func_geometry_from_wkb::val_str(String*) /test/clang_new/10.5_opt_san/sql/item_geofunc.cc:112:11
#4 0x55a49e98e309 in Type_handler::Item_send_str(Item, Protocol, st_value*) const /test/clang_new/10.5_opt_san/sql/sql_type.cc:7563:19
#5 0x55a49da6e8a0 in Protocol::send_result_set_row(List<Item>*) /test/clang_new/10.5_opt_san/sql/protocol.cc:1086:15
#6 0x55a49dd562f5 in select_send::send_data(List<Item>&) /test/clang_new/10.5_opt_san/sql/sql_class.cc:3161:17
#7 0x55a49e157292 in JOIN::exec_inner() /test/clang_new/10.5_opt_san/sql/sql_select.cc:4529:22
#8 0x55a49e15299c in JOIN::exec() /test/clang_new/10.5_opt_san/sql/sql_select.cc:4441:3
#9 0x55a49e0b80c3 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/clang_new/10.5_opt_san/sql/sql_select.cc:4918:9
#10 0x55a49e0b687d in handle_select(THD, LEX, select_result*, unsigned long) /test/clang_new/10.5_opt_san/sql/sql_select.cc:449:10
#11 0x55a49dfcdc82 in execute_sqlcom_select(THD, TABLE_LIST) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:6437:12
#12 0x55a49dfb0aef in mysql_execute_command(THD*) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:4029:12
#13 0x55a49df78168 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:8237:18
#14 0x55a49df6b160 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:1891:7
#15 0x55a49df7aba9 in do_command(THD*) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:1375:17
#16 0x55a49e680f72 in do_handle_one_connection(CONNECT*, bool) /test/clang_new/10.5_opt_san/sql/sql_connect.cc:1386:11
#17 0x55a49e6803d4 in handle_one_connection /test/clang_new/10.5_opt_san/sql/sql_connect.cc:1298:5
#18 0x55a49d9e110c in asan_thread_start(void*) asan_interceptors.cpp.o
#19 0x1535aca9ca93 in start_thread nptl/pthread_create.c:447:8
#20 0x1535acb29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: invalid-enum-load /test/clang_new/10.5_opt_san/sql/spatial.cc:1645:46

CS 10.5.28 142851f1205d98270b917a98e1bdd483e1b8af0e (Debug, UBASAN, Clang)
/test/clang_new/10.5_opt_san/sql/spatial.cc:1245:47: runtime error: load of value 3, which is not a valid value for type 'wkbByteOrder'
#0 0x55a49f7c360e in Gis_line_string::init_from_wkb(char const, unsigned int, Geometry::wkbByteOrder, String) /test/clang_new/10.5_opt_san/sql/spatial.cc:1245:47
#1 0x55a49f7cd4e1 in Gis_polygon::init_from_wkb(char const, unsigned int, Geometry::wkbByteOrder, String) /test/clang_new/10.5_opt_san/sql/spatial.cc:1645:22
#2 0x55a49f7e8f85 in Gis_multi_polygon::init_from_wkb(char const, unsigned int, Geometry::wkbByteOrder, String) /test/clang_new/10.5_opt_san/sql/spatial.cc:2893:20
#3 0x55a49f7b6807 in Geometry::create_from_wkb(Geometry_buffer, char const, unsigned int, String*) /test/clang_new/10.5_opt_san/sql/spatial.cc:485:16
#4 0x55a49f223a4e in Item_func_geometry_from_wkb::val_str(String*) /test/clang_new/10.5_opt_san/sql/item_geofunc.cc:112:11
#5 0x55a49e98e309 in Type_handler::Item_send_str(Item, Protocol, st_value*) const /test/clang_new/10.5_opt_san/sql/sql_type.cc:7563:19
#6 0x55a49da6e8a0 in Protocol::send_result_set_row(List<Item>*) /test/clang_new/10.5_opt_san/sql/protocol.cc:1086:15
#7 0x55a49dd562f5 in select_send::send_data(List<Item>&) /test/clang_new/10.5_opt_san/sql/sql_class.cc:3161:17
#8 0x55a49e157292 in JOIN::exec_inner() /test/clang_new/10.5_opt_san/sql/sql_select.cc:4529:22
#9 0x55a49e15299c in JOIN::exec() /test/clang_new/10.5_opt_san/sql/sql_select.cc:4441:3
#10 0x55a49e0b80c3 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/clang_new/10.5_opt_san/sql/sql_select.cc:4918:9
#11 0x55a49e0b687d in handle_select(THD, LEX, select_result*, unsigned long) /test/clang_new/10.5_opt_san/sql/sql_select.cc:449:10
#12 0x55a49dfcdc82 in execute_sqlcom_select(THD, TABLE_LIST) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:6437:12
#13 0x55a49dfb0aef in mysql_execute_command(THD*) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:4029:12
#14 0x55a49df78168 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:8237:18
#15 0x55a49df6b160 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:1891:7
#16 0x55a49df7aba9 in do_command(THD*) /test/clang_new/10.5_opt_san/sql/sql_parse.cc:1375:17
#17 0x55a49e680f72 in do_handle_one_connection(CONNECT*, bool) /test/clang_new/10.5_opt_san/sql/sql_connect.cc:1386:11
#18 0x55a49e6803d4 in handle_one_connection /test/clang_new/10.5_opt_san/sql/sql_connect.cc:1298:5
#19 0x55a49d9e110c in asan_thread_start(void*) asan_interceptors.cpp.o
#20 0x1535aca9ca93 in start_thread nptl/pthread_create.c:447:8
#21 0x1535acb29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: invalid-enum-load /test/clang_new/10.5_opt_san/sql/spatial.cc:1245:47

Setup:

Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18:

# llvm-17-linker-tools installs /usr/lib/llvm-17/lib/LLVMgold.so, which is needed for compilation, and LLVMgold.so is no longer included in LLVM 18

sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev llvm-17-linker-tools

sudo ln -s /usr/lib/llvm-17/lib/LLVMgold.so /usr/lib/llvm-18/lib/LLVMgold.so

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1

Bug confirmed present in:
MariaDB: 10.5.28 (dbg), 10.5.28 (opt), 10.6.21 (dbg), 10.6.21 (opt), 10.11.11 (dbg), 10.11.11 (opt), 11.4.5 (dbg), 11.4.5 (opt), 11.7.1 (dbg), 11.7.1 (opt), 11.8.0 (dbg), 11.8.0 (opt)

Attachments

Activity

People

Assignee:: Alexander Barkov

Reporter:: Roel Van de Paar

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2024-12-06 18:33

Updated:: 2024-12-06 19:08

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.