Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-35723

UBSAN: applying non-zero offset to null pointer in my_charpos_mb/my_uca_scanner_next_utf8mb4, applying zero offset to null pointer in my_strnncollsp_simple, my_uca_strnncollsp_onelevel_utf8mb4/my_uca_scanner_init_any/my_uca_scanner_next_utf8mb4 on INSERT

    XMLWordPrintable

Details

    Description

      CREATE  TABLE t (c TEXT(1) NOT NULL, INDEX (c)) ENGINE=InnoDB;
      INSERT INTO t SET c='';
      

      Leads to:

      CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Optimized, UBASAN, Clang)

      /test/11.8_opt_san/strings/ctype-mb.c:259:32: runtime error: applying non-zero offset 2 to null pointer
          #0 0x55813b9a1558 in my_charpos_mb /test/11.8_opt_san/strings/ctype-mb.c:259:32
          #1 0x55813aee29bc in charset_info_st::charpos(char const*, char const*, unsigned long) const /test/11.8_opt_san/include/m_ctype.h:855:12
          #2 0x55813aee29bc in innobase_get_at_most_n_mbchars(unsigned long, unsigned long, unsigned long, char const*) /test/11.8_opt_san/storage/innobase/handler/ha_innodb.cc:17003:25
          #3 0x55813b1d11f8 in row_ins_index_entry_set_vals(ins_node_t const*, que_thr_t*) /test/11.8_opt_san/storage/innobase/row/row0ins.cc:3513:10
          #4 0x55813b1d11f8 in row_ins_index_entry_step(ins_node_t*, que_thr_t*) /test/11.8_opt_san/storage/innobase/row/row0ins.cc:3563:8
          #5 0x55813b1d11f8 in row_ins(ins_node_t*, que_thr_t*) /test/11.8_opt_san/storage/innobase/row/row0ins.cc:3688:28
          #6 0x55813b1d11f8 in row_ins_step(que_thr_t*) /test/11.8_opt_san/storage/innobase/row/row0ins.cc:3817:8
          #7 0x55813b21a541 in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t) /test/11.8_opt_san/storage/innobase/row/row0mysql.cc:1290:2
          #8 0x55813ae7414f in ha_innobase::write_row(unsigned char const*) /test/11.8_opt_san/storage/innobase/handler/ha_innodb.cc:7757:10
          #9 0x558139f23745 in handler::ha_write_row(unsigned char const*) /test/11.8_opt_san/sql/handler.cc:8182:3
          #10 0x558138c2c6d2 in write_record(THD*, TABLE*, st_copy_info*, select_result*) /test/11.8_opt_san/sql/sql_insert.cc:2321:12
          #11 0x558138c1a086 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/11.8_opt_san/sql/sql_insert.cc:1181:14
          #12 0x558138de7a2a in mysql_execute_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:4471:10
          #13 0x558138da7c92 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_opt_san/sql/sql_parse.cc:7901:18
          #14 0x558138d9cb9e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_opt_san/sql/sql_parse.cc:1903:7
          #15 0x558138daaa6e in do_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:1416:17
          #16 0x55813958be38 in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_san/sql/sql_connect.cc:1415:11
          #17 0x55813958b280 in handle_one_connection /test/11.8_opt_san/sql/sql_connect.cc:1327:5
          #18 0x5581386d3b0c in asan_thread_start(void*) asan_interceptors.cpp.o
          #19 0x147f7009ca93 in start_thread nptl/pthread_create.c:447:8
          #20 0x147f70129c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
      SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-nonzero-offset /test/11.8_opt_san/strings/ctype-mb.c:259:32 
      

      CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Debug, UBASAN, Clang)

      /test/11.8_dbg_san/strings/ctype-mb.c:259:32: runtime error: applying non-zero offset 2 to null pointer
          #0 0x55775c1a29e7 in my_charpos_mb /test/11.8_dbg_san/strings/ctype-mb.c:259:32
          #1 0x557756a29933 in charset_info_st::charpos(char const*, char const*, unsigned long) const /test/11.8_dbg_san/include/m_ctype.h:855:12
          #2 0x55775a3f6484 in innobase_get_at_most_n_mbchars(unsigned long, unsigned long, unsigned long, char const*) /test/11.8_dbg_san/storage/innobase/handler/ha_innodb.cc:17003:25
          #3 0x55775b5b14b8 in dtype_get_at_most_n_mbchars(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, char const*) /test/11.8_dbg_san/storage/innobase/data/data0type.cc:61:10
          #4 0x55775ad1fa00 in row_ins_index_entry_set_vals(ins_node_t const*, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3513:10
          #5 0x55775ad1b23a in row_ins_index_entry_step(ins_node_t*, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3563:8
          #6 0x55775acf7163 in row_ins(ins_node_t*, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3688:28
          #7 0x55775acf4fcf in row_ins_step(que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3817:8
          #8 0x55775add0dc3 in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t) /test/11.8_dbg_san/storage/innobase/row/row0mysql.cc:1290:2
          #9 0x55775a302d84 in ha_innobase::write_row(unsigned char const*) /test/11.8_dbg_san/storage/innobase/handler/ha_innodb.cc:7757:10
          #10 0x557758520afa in handler::ha_write_row(unsigned char const*) /test/11.8_dbg_san/sql/handler.cc:8182:3
          #11 0x557755ba560a in write_record(THD*, TABLE*, st_copy_info*, select_result*) /test/11.8_dbg_san/sql/sql_insert.cc:2321:12
          #12 0x557755b6d830 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/11.8_dbg_san/sql/sql_insert.cc:1181:14
          #13 0x557755ee1907 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:4471:10
          #14 0x557755e77ef9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18
          #15 0x557755e58db8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
          #16 0x557755e81e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
          #17 0x557756fe4556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
          #18 0x557756fe2d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
          #19 0x55775502b5fc in asan_thread_start(void*) asan_interceptors.cpp.o
          #20 0x14919bc9ca93 in start_thread nptl/pthread_create.c:447:8
          #21 0x14919bd29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
      SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-nonzero-offset /test/11.8_dbg_san/strings/ctype-mb.c:259:32 
      

      CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Debug, UBASAN, Clang)

      /test/11.8_dbg_san/strings/ctype-uca.inl:223:4: runtime error: applying zero offset to null pointer
          #0 0x55775c23e542 in my_uca_strnncollsp_onelevel_utf8mb4 /test/11.8_dbg_san/strings/ctype-uca.inl:223:4
          #1 0x55775c1ebc7f in my_uca_strnncollsp_utf8mb4 /test/11.8_dbg_san/strings/ctype-uca.inl:280:10
          #2 0x55775ab7f132 in cmp_data(unsigned long, unsigned long, bool, unsigned char const*, unsigned long, unsigned char const*, unsigned long) /test/11.8_dbg_san/storage/innobase/rem/rem0cmp.cc:294:12
          #3 0x55775ab83124 in cmp_dtuple_rec_with_match_low(dtuple_t const*, unsigned char const*, dict_index_t const*, unsigned short const*, unsigned long, unsigned long*) /test/11.8_dbg_san/storage/innobase/rem/rem0cmp.cc:405:9
          #4 0x55775acc26a8 in cmp_dtuple_rec(dtuple_t const*, unsigned char const*, dict_index_t const*, unsigned short const*) /test/11.8_dbg_san/storage/innobase/include/rem0cmp.h:191:10
          #5 0x55775b3964a7 in page_cur_tuple_insert(page_cur_t*, dtuple_t const*, unsigned short**, mem_block_info_t**, unsigned long, mtr_t*) /test/11.8_dbg_san/storage/innobase/include/page0cur.inl:183:2
          #6 0x55775b38c3a3 in btr_cur_optimistic_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t*, unsigned char**, big_rec_t**, unsigned long, que_thr_t*, mtr_t*) /test/11.8_dbg_san/storage/innobase/btr/btr0cur.cc:2488:10
          #7 0x55775ace79a0 in row_ins_sec_index_entry_low(unsigned long, btr_latch_mode, dict_index_t*, mem_block_info_t*, mem_block_info_t*, dtuple_t*, unsigned long, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3152:10
          #8 0x55775acf1d87 in row_ins_sec_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, bool) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3350:8
          #9 0x55775ad214e5 in row_ins_index_entry(dict_index_t*, dtuple_t*, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3407:10
          #10 0x55775ad1b8eb in row_ins_index_entry_step(ins_node_t*, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3571:8
          #11 0x55775acf7163 in row_ins(ins_node_t*, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3688:28
          #12 0x55775acf4fcf in row_ins_step(que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3817:8
          #13 0x55775add0dc3 in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t) /test/11.8_dbg_san/storage/innobase/row/row0mysql.cc:1290:2
          #14 0x55775a302d84 in ha_innobase::write_row(unsigned char const*) /test/11.8_dbg_san/storage/innobase/handler/ha_innodb.cc:7757:10
          #15 0x557758520afa in handler::ha_write_row(unsigned char const*) /test/11.8_dbg_san/sql/handler.cc:8182:3
          #16 0x557755ba560a in write_record(THD*, TABLE*, st_copy_info*, select_result*) /test/11.8_dbg_san/sql/sql_insert.cc:2321:12
          #17 0x557755b6d830 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/11.8_dbg_san/sql/sql_insert.cc:1181:14
          #18 0x557755ee1907 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:4471:10
          #19 0x557755e77ef9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18
          #20 0x557755e58db8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
          #21 0x557755e81e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
          #22 0x557756fe4556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
          #23 0x557756fe2d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
          #24 0x55775502b5fc in asan_thread_start(void*) asan_interceptors.cpp.o
          #25 0x14919bc9ca93 in start_thread nptl/pthread_create.c:447:8
          #26 0x14919bd29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
      SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/11.8_dbg_san/strings/ctype-uca.inl:223:4 
      

      CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Debug, UBASAN, Clang)

      /test/11.8_dbg_san/strings/ctype-uca.c:32090:22: runtime error: applying zero offset to null pointer
          #0 0x55775c217c8e in my_uca_scanner_init_any /test/11.8_dbg_san/strings/ctype-uca.c:32090:22
          #1 0x55775c23e629 in my_uca_strnncollsp_onelevel_utf8mb4 /test/11.8_dbg_san/strings/ctype-uca.inl:229:3
          #2 0x55775c1ebc7f in my_uca_strnncollsp_utf8mb4 /test/11.8_dbg_san/strings/ctype-uca.inl:280:10
          #3 0x55775ab7f132 in cmp_data(unsigned long, unsigned long, bool, unsigned char const*, unsigned long, unsigned char const*, unsigned long) /test/11.8_dbg_san/storage/innobase/rem/rem0cmp.cc:294:12
          #4 0x55775ab83124 in cmp_dtuple_rec_with_match_low(dtuple_t const*, unsigned char const*, dict_index_t const*, unsigned short const*, unsigned long, unsigned long*) /test/11.8_dbg_san/storage/innobase/rem/rem0cmp.cc:405:9
          #5 0x55775acc26a8 in cmp_dtuple_rec(dtuple_t const*, unsigned char const*, dict_index_t const*, unsigned short const*) /test/11.8_dbg_san/storage/innobase/include/rem0cmp.h:191:10
          #6 0x55775b3964a7 in page_cur_tuple_insert(page_cur_t*, dtuple_t const*, unsigned short**, mem_block_info_t**, unsigned long, mtr_t*) /test/11.8_dbg_san/storage/innobase/include/page0cur.inl:183:2
          #7 0x55775b38c3a3 in btr_cur_optimistic_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t*, unsigned char**, big_rec_t**, unsigned long, que_thr_t*, mtr_t*) /test/11.8_dbg_san/storage/innobase/btr/btr0cur.cc:2488:10
          #8 0x55775ace79a0 in row_ins_sec_index_entry_low(unsigned long, btr_latch_mode, dict_index_t*, mem_block_info_t*, mem_block_info_t*, dtuple_t*, unsigned long, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3152:10
          #9 0x55775acf1d87 in row_ins_sec_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, bool) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3350:8
          #10 0x55775ad214e5 in row_ins_index_entry(dict_index_t*, dtuple_t*, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3407:10
          #11 0x55775ad1b8eb in row_ins_index_entry_step(ins_node_t*, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3571:8
          #12 0x55775acf7163 in row_ins(ins_node_t*, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3688:28
          #13 0x55775acf4fcf in row_ins_step(que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3817:8
          #14 0x55775add0dc3 in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t) /test/11.8_dbg_san/storage/innobase/row/row0mysql.cc:1290:2
          #15 0x55775a302d84 in ha_innobase::write_row(unsigned char const*) /test/11.8_dbg_san/storage/innobase/handler/ha_innodb.cc:7757:10
          #16 0x557758520afa in handler::ha_write_row(unsigned char const*) /test/11.8_dbg_san/sql/handler.cc:8182:3
          #17 0x557755ba560a in write_record(THD*, TABLE*, st_copy_info*, select_result*) /test/11.8_dbg_san/sql/sql_insert.cc:2321:12
          #18 0x557755b6d830 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/11.8_dbg_san/sql/sql_insert.cc:1181:14
          #19 0x557755ee1907 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:4471:10
          #20 0x557755e77ef9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18
          #21 0x557755e58db8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
          #22 0x557755e81e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
          #23 0x557756fe4556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
          #24 0x557756fe2d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
          #25 0x55775502b5fc in asan_thread_start(void*) asan_interceptors.cpp.o
          #26 0x14919bc9ca93 in start_thread nptl/pthread_create.c:447:8
          #27 0x14919bd29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
      SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/11.8_dbg_san/strings/ctype-uca.c:32090:22 
      

      CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Debug, UBASAN, Clang)

      /test/11.8_dbg_san/strings/ctype-uca-scanner_next.inl:84:23: runtime error: applying non-zero offset 1 to null pointer
          #0 0x55775c23a39c in my_uca_scanner_next_utf8mb4 /test/11.8_dbg_san/strings/ctype-uca-scanner_next.inl:84:23
          #1 0x55775c23e653 in my_uca_strnncollsp_onelevel_utf8mb4 /test/11.8_dbg_san/strings/ctype-uca.inl:234:12
          #2 0x55775c1ebc7f in my_uca_strnncollsp_utf8mb4 /test/11.8_dbg_san/strings/ctype-uca.inl:280:10
          #3 0x55775ab7f132 in cmp_data(unsigned long, unsigned long, bool, unsigned char const*, unsigned long, unsigned char const*, unsigned long) /test/11.8_dbg_san/storage/innobase/rem/rem0cmp.cc:294:12
          #4 0x55775ab83124 in cmp_dtuple_rec_with_match_low(dtuple_t const*, unsigned char const*, dict_index_t const*, unsigned short const*, unsigned long, unsigned long*) /test/11.8_dbg_san/storage/innobase/rem/rem0cmp.cc:405:9
          #5 0x55775acc26a8 in cmp_dtuple_rec(dtuple_t const*, unsigned char const*, dict_index_t const*, unsigned short const*) /test/11.8_dbg_san/storage/innobase/include/rem0cmp.h:191:10
          #6 0x55775b3964a7 in page_cur_tuple_insert(page_cur_t*, dtuple_t const*, unsigned short**, mem_block_info_t**, unsigned long, mtr_t*) /test/11.8_dbg_san/storage/innobase/include/page0cur.inl:183:2
          #7 0x55775b38c3a3 in btr_cur_optimistic_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t*, unsigned char**, big_rec_t**, unsigned long, que_thr_t*, mtr_t*) /test/11.8_dbg_san/storage/innobase/btr/btr0cur.cc:2488:10
          #8 0x55775ace79a0 in row_ins_sec_index_entry_low(unsigned long, btr_latch_mode, dict_index_t*, mem_block_info_t*, mem_block_info_t*, dtuple_t*, unsigned long, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3152:10
          #9 0x55775acf1d87 in row_ins_sec_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, bool) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3350:8
          #10 0x55775ad214e5 in row_ins_index_entry(dict_index_t*, dtuple_t*, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3407:10
          #11 0x55775ad1b8eb in row_ins_index_entry_step(ins_node_t*, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3571:8
          #12 0x55775acf7163 in row_ins(ins_node_t*, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3688:28
          #13 0x55775acf4fcf in row_ins_step(que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3817:8
          #14 0x55775add0dc3 in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t) /test/11.8_dbg_san/storage/innobase/row/row0mysql.cc:1290:2
          #15 0x55775a302d84 in ha_innobase::write_row(unsigned char const*) /test/11.8_dbg_san/storage/innobase/handler/ha_innodb.cc:7757:10
          #16 0x557758520afa in handler::ha_write_row(unsigned char const*) /test/11.8_dbg_san/sql/handler.cc:8182:3
          #17 0x557755ba560a in write_record(THD*, TABLE*, st_copy_info*, select_result*) /test/11.8_dbg_san/sql/sql_insert.cc:2321:12
          #18 0x557755b6d830 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/11.8_dbg_san/sql/sql_insert.cc:1181:14
          #19 0x557755ee1907 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:4471:10
          #20 0x557755e77ef9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18
          #21 0x557755e58db8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
          #22 0x557755e81e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
          #23 0x557756fe4556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
          #24 0x557756fe2d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
          #25 0x55775502b5fc in asan_thread_start(void*) asan_interceptors.cpp.o
          #26 0x14919bc9ca93 in start_thread nptl/pthread_create.c:447:8
          #27 0x14919bd29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
      SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-nonzero-offset /test/11.8_dbg_san/strings/ctype-uca-scanner_next.inl:84:23 
      

      CS 10.11.11 c391fb1ff122adbfb9a7f98d3239aa08311918d6 (Debug, UBASAN, Clang)

      /test/10.11_dbg_san/strings/ctype-simple.c:180:10: runtime error: applying zero offset to null pointer
          #0 0x560aa9f581ac in my_strnncollsp_simple /test/10.11_dbg_san/strings/ctype-simple.c:180:10
          #1 0x560aa892b3c2 in cmp_data(unsigned long, unsigned long, bool, unsigned char const*, unsigned long, unsigned char const*, unsigned long) /test/10.11_dbg_san/storage/innobase/rem/rem0cmp.cc:294:12
          #2 0x560aa892f45e in cmp_dtuple_rec_with_match_low(dtuple_t const*, unsigned char const*, dict_index_t const*, unsigned short const*, unsigned long, unsigned long*) /test/10.11_dbg_san/storage/innobase/rem/rem0cmp.cc:405:9
          #3 0x560aa84ef0b8 in cmp_dtuple_rec(dtuple_t const*, unsigned char const*, dict_index_t const*, unsigned short const*) /test/10.11_dbg_san/storage/innobase/include/rem0cmp.h:191:10
          #4 0x560aa914d937 in page_cur_tuple_insert(page_cur_t*, dtuple_t const*, unsigned short**, mem_block_info_t**, unsigned long, mtr_t*) /test/10.11_dbg_san/storage/innobase/include/page0cur.inl:188:2
          #5 0x560aa9142f63 in btr_cur_optimistic_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t*, unsigned char**, big_rec_t**, unsigned long, que_thr_t*, mtr_t*) /test/10.11_dbg_san/storage/innobase/btr/btr0cur.cc:2613:10
          #6 0x560aa8a92b37 in row_ins_sec_index_entry_low(unsigned long, btr_latch_mode, dict_index_t*, mem_block_info_t*, mem_block_info_t*, dtuple_t*, unsigned long, que_thr_t*) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3171:10
          #7 0x560aa8a9ce17 in row_ins_sec_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, bool) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3369:8
          #8 0x560aa8acc6e5 in row_ins_index_entry(dict_index_t*, dtuple_t*, que_thr_t*) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3431:10
          #9 0x560aa8ac67bb in row_ins_index_entry_step(ins_node_t*, que_thr_t*) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3595:8
          #10 0x560aa8aa2091 in row_ins(ins_node_t*, que_thr_t*) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3720:28
          #11 0x560aa8aa033f in row_ins_step(que_thr_t*) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3849:8
          #12 0x560aa8b7d906 in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t) /test/10.11_dbg_san/storage/innobase/row/row0mysql.cc:1291:2
          #13 0x560aa803dd64 in ha_innobase::write_row(unsigned char const*) /test/10.11_dbg_san/storage/innobase/handler/ha_innodb.cc:7835:10
          #14 0x560aa62c3459 in handler::ha_write_row(unsigned char const*) /test/10.11_dbg_san/sql/handler.cc:7735:3
          #15 0x560aa3b52088 in write_record(THD*, TABLE*, st_copy_info*, select_result*) /test/10.11_dbg_san/sql/sql_insert.cc:2300:12
          #16 0x560aa3b1ad6e in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/10.11_dbg_san/sql/sql_insert.cc:1173:14
          #17 0x560aa3e7da0b in mysql_execute_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:4624:10
          #18 0x560aa3e112d9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_dbg_san/sql/sql_parse.cc:8179:18
          #19 0x560aa3df24dc in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1907:7
          #20 0x560aa3e1b236 in do_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1420:17
          #21 0x560aa4f26cc6 in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_san/sql/sql_connect.cc:1386:11
          #22 0x560aa4f2548d in handle_one_connection /test/10.11_dbg_san/sql/sql_connect.cc:1298:5
          #23 0x560aa2fd05cc in asan_thread_start(void*) asan_interceptors.cpp.o
          #24 0x1515bbe9ca93 in start_thread nptl/pthread_create.c:447:8
          #25 0x1515bbf29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
      SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/10.11_dbg_san/strings/ctype-simple.c:180:10 
      

      Setup:

      Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18. Ubuntu instructions:
           # Note: llvm-17-linker-tools installs /usr/lib/llvm-17/lib/LLVMgold.so, which is needed for compilation, and LLVMgold.so is no longer included in LLVM 18
           sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev llvm-17-linker-tools
           sudo ln -s /usr/lib/llvm-17/lib/LLVMgold.so /usr/lib/llvm-18/lib/LLVMgold.so
      Compiled with: '-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++' and:
          -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
      Set before execution:
          export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter'. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter
      

      Bug confirmed present in:
      MariaDB: 10.5.28 (dbg), 10.6.21 (dbg), 10.11.11 (dbg), 11.4.5 (dbg), 11.7.1 (dbg), 11.7.1 (opt), 11.8.0 (dbg), 11.8.0 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.5.28 (opt), 10.6.21 (opt), 10.11.11 (opt), 11.4.5 (opt)

      Please note:

      • 11.7+ opt builds also have the issue.
      • Outcomes differ for different versions (ref 10.11 stack example above). I can provide a detailed list if it will help.

      Attachments

        Activity

          People

            bar Alexander Barkov
            Roel Roel Van de Paar
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.