[MDEV-36003] UBSAN: runtime error: applying zero offset to null pointer in my_strnncollsp_utf8mb4_bin on SELECT FROM mysql.user - Jira

Details

Type: Bug
Status: Confirmed (View Workflow)
Priority: Critical
Resolution: Unresolved
Affects Version/s: 10.5, 10.6, 10.11, 11.4, 11.7(EOL), 11.8
Fix Version/s: 10.5, 10.6, 10.11, 11.4
Component/s: Authentication and Privilege System, Character Sets
Labels:
- UBSAN
- nullptr-with-offset

Description

Some similiarties to ~~MDEV-35723~~ and possibly MDEV-35717.
However, this issue still reproduces in 10.5 from a few days ago (rev 7eded23be6597b4c485e8cad1538f2ae14541f91).
marko FYI in case you know what the fix is for this one also given the similarity.

CREATE USER user@localhost;

SELECT authentication_string <> '' FROM mysql.user;

Leads to:

CS 10.5.28 7eded23be6597b4c485e8cad1538f2ae14541f91 (Optimized, UBASAN, Clang)
/test/10.5_opt_san/strings/strcoll.inl:252:25: runtime error: applying zero offset to null pointer
#0 0x560a500deac0 in my_strnncollsp_utf8mb4_bin /test/10.5_opt_san/strings/strcoll.inl:252:25
#1 0x560a4e93ae66 in Arg_comparator::compare() /test/10.5_opt_san/sql/item_cmpfunc.h:117:33
#2 0x560a4e93ae66 in Item_func_ne::val_int() /test/10.5_opt_san/sql/item_cmpfunc.cc:1845:18
#3 0x560a4e3c3044 in Type_handler::Item_send_long(Item, Protocol, st_value*) const /test/10.5_opt_san/sql/sql_type.cc:7596:22
#4 0x560a4d752693 in Protocol::send_result_set_row(List<Item>*) /test/10.5_opt_san/sql/protocol.cc:1086:15
#5 0x560a4d9b2440 in select_send::send_data(List<Item>&) /test/10.5_opt_san/sql/sql_class.cc:3173:17
#6 0x560a4dce6e9d in end_send(JOIN, st_join_table, bool) /test/10.5_opt_san/sql/sql_select.cc:22522:11
#7 0x560a4dd83cb5 in evaluate_join_record(JOIN, st_join_table, int) /test/10.5_opt_san/sql/sql_select.cc:21540:11
#8 0x560a4dd8078f in sub_select(JOIN, st_join_table, bool) /test/10.5_opt_san/sql/sql_select.cc:21310:9
#9 0x560a4dcffa56 in do_select(JOIN, Procedure) /test/10.5_opt_san/sql/sql_select.cc:20827:14
#10 0x560a4dcfcc75 in JOIN::exec_inner() /test/10.5_opt_san/sql/sql_select.cc:4664:50
#11 0x560a4dcf9b8d in JOIN::exec() /test/10.5_opt_san/sql/sql_select.cc:4444:3
#12 0x560a4dc7ceb4 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/10.5_opt_san/sql/sql_select.cc:4921:9
#13 0x560a4dc7bcb0 in handle_select(THD, LEX, select_result*, unsigned long) /test/10.5_opt_san/sql/sql_select.cc:449:10
#14 0x560a4dbbb15d in execute_sqlcom_select(THD, TABLE_LIST) /test/10.5_opt_san/sql/sql_parse.cc:6452:12
#15 0x560a4db98645 in mysql_execute_command(THD*) /test/10.5_opt_san/sql/sql_parse.cc:4043:12
#16 0x560a4db79436 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /test/10.5_opt_san/sql/sql_parse.cc:8252:18
#17 0x560a4db6e08e in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /test/10.5_opt_san/sql/sql_parse.cc:1891:7
#18 0x560a4db7b430 in do_command(THD*) /test/10.5_opt_san/sql/sql_parse.cc:1375:17
#19 0x560a4e149607 in do_handle_one_connection(CONNECT*, bool) /test/10.5_opt_san/sql/sql_connect.cc:1386:11
#20 0x560a4e148e5a in handle_one_connection /test/10.5_opt_san/sql/sql_connect.cc:1298:5
#21 0x560a4d6d471c in asan_thread_start(void*) asan_interceptors.cpp.o
#22 0x1540a849ca93 in start_thread nptl/pthread_create.c:447:8
#23 0x1540a8529c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/10.5_opt_san/strings/strcoll.inl:252:25

CS 11.8.0 cacaaebf01939d387645fb850ceeec5392496171 (Debug, UBASAN, Clang)
/test/11.8_dbg_san/strings/strcoll.inl:324:25: runtime error: applying zero offset to null pointer
#0 0x557227dc2331 in my_strnncollsp_utf8mb4_bin /test/11.8_dbg_san/strings/strcoll.inl:324:25
#1 0x5572264995a4 in Arg_comparator::compare() /test/11.8_dbg_san/sql/item_cmpfunc.h:114:33
#2 0x5572264995a4 in Item_func_ne::val_bool() /test/11.8_dbg_san/sql/item_cmpfunc.cc:1915:18
#3 0x557224fb3cd5 in Item_bool_func::val_int() /test/11.8_dbg_san/sql/item_cmpfunc.h:245:12
#4 0x557225e91024 in Type_handler::Item_send_long(Item, Protocol, st_value*) const /test/11.8_dbg_san/sql/sql_type.cc:7697:22
#5 0x557224ff1878 in Protocol::send_result_set_row(List<Item>*) /test/11.8_dbg_san/sql/protocol.cc:1353:15
#6 0x5572252668c3 in select_send::send_data(List<Item>&) /test/11.8_dbg_san/sql/sql_class.cc:3282:17
#7 0x557225651bb6 in end_send(JOIN, st_join_table, bool) /test/11.8_dbg_san/sql/sql_select.cc:25440:9
#8 0x5572257099bf in evaluate_join_record(JOIN, st_join_table, int) /test/11.8_dbg_san/sql/sql_select.cc:24342:11
#9 0x5572255dc3bf in sub_select(JOIN, st_join_table, bool) /test/11.8_dbg_san/sql/sql_select.cc:24109:9
#10 0x55722566c79c in do_select(JOIN, Procedure) /test/11.8_dbg_san/sql/sql_select.cc:23620:14
#11 0x5572256690f1 in JOIN::exec_inner() /test/11.8_dbg_san/sql/sql_select.cc:5040:50
#12 0x557225666a12 in JOIN::exec() /test/11.8_dbg_san/sql/sql_select.cc:4823:8
#13 0x5572255e0634 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.8_dbg_san/sql/sql_select.cc:5356:21
#14 0x5572255def12 in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.8_dbg_san/sql/sql_select.cc:633:10
#15 0x5572254b4167 in execute_sqlcom_select(THD, TABLE_LIST) /test/11.8_dbg_san/sql/sql_parse.cc:6191:12
#16 0x55722549fd39 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:3980:12
#17 0x55722546f588 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7915:18
#18 0x55722546364b in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
#19 0x557225471fad in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
#20 0x557225b3576c in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
#21 0x557225b35027 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
#22 0x557224e74b5c in asan_thread_start(void*) asan_interceptors.cpp.o
#23 0x14a2fd69ca93 in start_thread nptl/pthread_create.c:447:8
#24 0x14a2fd729c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/11.8_dbg_san/strings/strcoll.inl:324:25

CS 11.8.0 cacaaebf01939d387645fb850ceeec5392496171 (Optimized, UBASAN, Clang)
/test/11.8_dbg_san/strings/strcoll.inl:324:25: runtime error: applying zero offset to null pointer
#0 0x563e47c6b331 in my_strnncollsp_utf8mb4_bin /test/11.8_dbg_san/strings/strcoll.inl:324:25
#1 0x563e463425a4 in Arg_comparator::compare() /test/11.8_dbg_san/sql/item_cmpfunc.h:114:33
#2 0x563e463425a4 in Item_func_ne::val_bool() /test/11.8_dbg_san/sql/item_cmpfunc.cc:1915:18
#3 0x563e44e5ccd5 in Item_bool_func::val_int() /test/11.8_dbg_san/sql/item_cmpfunc.h:245:12
#4 0x563e45d3a024 in Type_handler::Item_send_long(Item, Protocol, st_value*) const /test/11.8_dbg_san/sql/sql_type.cc:7697:22
#5 0x563e44e9a878 in Protocol::send_result_set_row(List<Item>*) /test/11.8_dbg_san/sql/protocol.cc:1353:15
#6 0x563e4510f8c3 in select_send::send_data(List<Item>&) /test/11.8_dbg_san/sql/sql_class.cc:3282:17
#7 0x563e454fabb6 in end_send(JOIN, st_join_table, bool) /test/11.8_dbg_san/sql/sql_select.cc:25440:9
#8 0x563e455b29bf in evaluate_join_record(JOIN, st_join_table, int) /test/11.8_dbg_san/sql/sql_select.cc:24342:11
#9 0x563e454853bf in sub_select(JOIN, st_join_table, bool) /test/11.8_dbg_san/sql/sql_select.cc:24109:9
#10 0x563e4551579c in do_select(JOIN, Procedure) /test/11.8_dbg_san/sql/sql_select.cc:23620:14
#11 0x563e455120f1 in JOIN::exec_inner() /test/11.8_dbg_san/sql/sql_select.cc:5040:50
#12 0x563e4550fa12 in JOIN::exec() /test/11.8_dbg_san/sql/sql_select.cc:4823:8
#13 0x563e45489634 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.8_dbg_san/sql/sql_select.cc:5356:21
#14 0x563e45487f12 in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.8_dbg_san/sql/sql_select.cc:633:10
#15 0x563e4535d167 in execute_sqlcom_select(THD, TABLE_LIST) /test/11.8_dbg_san/sql/sql_parse.cc:6191:12
#16 0x563e45348d39 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:3980:12
#17 0x563e45318588 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7915:18
#18 0x563e4530c64b in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
#19 0x563e4531afad in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
#20 0x563e459de76c in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
#21 0x563e459de027 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
#22 0x563e44d1db5c in asan_thread_start(void*) asan_interceptors.cpp.o
#23 0x145e3189ca93 in start_thread nptl/pthread_create.c:447:8
#24 0x145e31929c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/11.8_dbg_san/strings/strcoll.inl:324:25

Setup:

Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18. Ubuntu instructions:

     # Note: llvm-17-linker-tools installs /usr/lib/llvm-17/lib/LLVMgold.so, which is needed for compilation, and LLVMgold.so is no longer included in LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev llvm-17-linker-tools

     sudo ln -s /usr/lib/llvm-17/lib/LLVMgold.so /usr/lib/llvm-18/lib/LLVMgold.so

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter

    export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1

Bug confirmed present in:
MariaDB: 10.5.28 (dbg), 10.5.28 (opt), 10.6.21 (dbg), 10.6.21 (opt), 10.11.11 (dbg), 10.11.11 (opt), 11.4.5 (dbg), 11.4.5 (opt), 11.7.2 (dbg), 11.7.2 (opt), 11.8.0 (dbg), 11.8.0 (opt)

Attachments

Issue Links

relates to

MDEV-35723 UBSAN: applying non-zero offset to null pointer in my_charpos_mb/my_uca_scanner_next_utf8mb4, applying zero offset to null pointer in my_strnncollsp_simple, my_uca_strnncollsp_onelevel_utf8mb4/my_uca_scanner_init_any/my_uca_scanner_next_utf8mb4 on INSERT

Closed

MDEV-36045 UBSAN: runtime error: applying zero offset to null pointer in my_strnncollsp_utf8mb3_general_ci and my_strnncollsp_gb2312_chinese_ci on SELECT ... EXTRACTVALUE

Confirmed

MDEV-36046 UBSAN: runtime error: applying zero offset to null pointer in my_strnxfrm_unicode_full_bin on SELECT when using sql_select_limit

Open

Activity

Ascending order - Click to sort in descending order

Roel Van de Paar added a comment - 2025-02-01 05:00 - edited

Testcase is CLI and MTR compatible. Remember to setup the UBSAN supressions filter in the shell session where MTR is being run (export UBSAN_OPTIONS=...), to avoid already covered supressions.

Roel Van de Paar added a comment - 2025-02-01 05:00 - edited Testcase is CLI and MTR compatible. Remember to setup the UBSAN supressions filter in the shell session where MTR is being run ( export UBSAN_OPTIONS=... ), to avoid already covered supressions.

Marko Mäkelä added a comment - 2025-02-01 22:14

~~MDEV-35723~~ took some effort with ./mtr --rr and setting watch or awatch to follow the data flow in reverse-continue, to see where some initialization was missing and where a null pointer slipped through. I don’t see any InnoDB functions in the call stacks here, but I can imagine that a similar approach would work for finding the root cause. Note: on x86-64 or IA-32, hardware watch will not be triggered on writes that do not change the value (on those Intel processors that I have access to), but awatch will be triggered for all reads and writes.

Marko Mäkelä added a comment - 2025-02-01 22:14 MDEV-35723 took some effort with ./mtr --rr and setting watch or awatch to follow the data flow in reverse-continue , to see where some initialization was missing and where a null pointer slipped through. I don’t see any InnoDB functions in the call stacks here, but I can imagine that a similar approach would work for finding the root cause. Note: on x86-64 or IA-32, hardware watch will not be triggered on writes that do not change the value (on those Intel processors that I have access to), but awatch will be triggered for all reads and writes.

Roel Van de Paar added a comment - 2025-02-08 03:14 - edited

Additional testcase:

SET SESSION sql_buffer_result=ON;

SELECT authentication_string <>''FROM mysql.user;

Leads to two new outcomes (note versions):

CS 10.5.28 df602ff7fa5ed9424a1d7ebaba67b665e2f6d1f6 (Optimized, UBASAN, Clang)
/test/10.5_opt_san/strings/strcoll.inl:250:25: runtime error: applying zero offset to null pointer
#0 0x55d5887c4cf0 in my_strnncollsp_utf8mb4_bin /test/10.5_opt_san/strings/strcoll.inl:250:25
#1 0x55d587022216 in Arg_comparator::compare() /test/10.5_opt_san/sql/item_cmpfunc.h:117:33
#2 0x55d587022216 in Item_func_ne::val_int() /test/10.5_opt_san/sql/item_cmpfunc.cc:1845:18
#3 0x55d586f7c491 in Item::save_int_in_field(Field*, bool) /test/10.5_opt_san/sql/item.cc:6970:16
#4 0x55d586f7c846 in Item::save_in_field(Field*, bool) /test/10.5_opt_san/sql/item.cc:6980:30
#5 0x55d586479f91 in copy_funcs(Item*, THD const) /test/10.5_opt_san/sql/sql_select.cc:26740:11
#6 0x55d58646537e in end_write(JOIN, st_join_table, bool) /test/10.5_opt_san/sql/sql_select.cc:22782:9
#7 0x55d5864a33f1 in AGGR_OP::put_record(bool) /test/10.5_opt_san/sql/sql_select.cc:30160:30
#8 0x55d5863d468e in AGGR_OP::put_record() /test/10.5_opt_san/sql/sql_select.h:1087:48
#9 0x55d5863d468e in sub_select_postjoin_aggr(JOIN, st_join_table, bool) /test/10.5_opt_san/sql/sql_select.cc:21011:13
#10 0x55d58646db15 in evaluate_join_record(JOIN, st_join_table, int) /test/10.5_opt_san/sql/sql_select.cc:21540:11
#11 0x55d58646a5ef in sub_select(JOIN, st_join_table, bool) /test/10.5_opt_san/sql/sql_select.cc:21310:9
#12 0x55d5863e98b6 in do_select(JOIN, Procedure) /test/10.5_opt_san/sql/sql_select.cc:20827:14
#13 0x55d5863e6ad5 in JOIN::exec_inner() /test/10.5_opt_san/sql/sql_select.cc:4664:50
#14 0x55d5863e39ed in JOIN::exec() /test/10.5_opt_san/sql/sql_select.cc:4444:3
#15 0x55d586366d14 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/10.5_opt_san/sql/sql_select.cc:4921:9
#16 0x55d586365b10 in handle_select(THD, LEX, select_result*, unsigned long) /test/10.5_opt_san/sql/sql_select.cc:449:10
#17 0x55d5862a4fbd in execute_sqlcom_select(THD, TABLE_LIST) /test/10.5_opt_san/sql/sql_parse.cc:6451:12
#18 0x55d5862812fe in mysql_execute_command(THD*) /test/10.5_opt_san/sql/sql_parse.cc:4043:12
#19 0x55d5862630c6 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /test/10.5_opt_san/sql/sql_parse.cc:8251:18
#20 0x55d586257d1e in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /test/10.5_opt_san/sql/sql_parse.cc:1891:7
#21 0x55d5862650c0 in do_command(THD*) /test/10.5_opt_san/sql/sql_parse.cc:1375:17
#22 0x55d586831e37 in do_handle_one_connection(CONNECT*, bool) /test/10.5_opt_san/sql/sql_connect.cc:1386:11
#23 0x55d58683168a in handle_one_connection /test/10.5_opt_san/sql/sql_connect.cc:1298:5
#24 0x55d585dbd72c in asan_thread_start(void*) asan_interceptors.cpp.o
#25 0x14858e89ca93 in start_thread nptl/pthread_create.c:447:8
#26 0x14858e929c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/10.5_opt_san/strings/strcoll.inl:250:25

CS 11.8.0 cacaaebf01939d387645fb850ceeec5392496171 (Debug, UBASAN, Clang)
/test/11.8_dbg_san/strings/strcoll.inl:324:25: runtime error: applying zero offset to null pointer
#0 0x561f15349331 in my_strnncollsp_utf8mb4_bin /test/11.8_dbg_san/strings/strcoll.inl:324:25
#1 0x561f13a205a4 in Arg_comparator::compare() /test/11.8_dbg_san/sql/item_cmpfunc.h:114:33
#2 0x561f13a205a4 in Item_func_ne::val_bool() /test/11.8_dbg_san/sql/item_cmpfunc.cc:1915:18
#3 0x561f1396e8cf in Item::save_bool_in_field(Field*, bool) /test/11.8_dbg_san/sql/item.cc:7093:12
#4 0x561f1396ec16 in Item::save_in_field(Field*, bool) /test/11.8_dbg_san/sql/item.cc:7103:30
#5 0x561f12c9d9f1 in copy_funcs(Item*, THD const) /test/11.8_dbg_san/sql/sql_select.cc:29774:11
#6 0x561f12c8abd2 in end_write(JOIN, st_join_table, bool) /test/11.8_dbg_san/sql/sql_select.cc:25709:9
#7 0x561f12cc21a1 in AGGR_OP::put_record(bool) /test/11.8_dbg_san/sql/sql_select.cc:33211:30
#8 0x561f12bdcbb5 in AGGR_OP::put_record() /test/11.8_dbg_san/sql/sql_select.h:1184:48
#9 0x561f12bdcbb5 in sub_select_postjoin_aggr(JOIN, st_join_table, bool) /test/11.8_dbg_san/sql/sql_select.cc:23793:13
#10 0x561f12c909bf in evaluate_join_record(JOIN, st_join_table, int) /test/11.8_dbg_san/sql/sql_select.cc:24342:11
#11 0x561f12b633bf in sub_select(JOIN, st_join_table, bool) /test/11.8_dbg_san/sql/sql_select.cc:24109:9
#12 0x561f12bf379c in do_select(JOIN, Procedure) /test/11.8_dbg_san/sql/sql_select.cc:23620:14
#13 0x561f12bf00f1 in JOIN::exec_inner() /test/11.8_dbg_san/sql/sql_select.cc:5040:50
#14 0x561f12beda12 in JOIN::exec() /test/11.8_dbg_san/sql/sql_select.cc:4823:8
#15 0x561f12b67634 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.8_dbg_san/sql/sql_select.cc:5356:21
#16 0x561f12b65f12 in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.8_dbg_san/sql/sql_select.cc:633:10
#17 0x561f12a3b167 in execute_sqlcom_select(THD, TABLE_LIST) /test/11.8_dbg_san/sql/sql_parse.cc:6191:12
#18 0x561f12a26d39 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:3980:12
#19 0x561f129f6588 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7915:18
#20 0x561f129ea64b in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
#21 0x561f129f8fad in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
#22 0x561f130bc76c in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
#23 0x561f130bc027 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
#24 0x561f123fbb5c in asan_thread_start(void*) asan_interceptors.cpp.o
#25 0x1505cca9ca93 in start_thread nptl/pthread_create.c:447:8
#26 0x1505ccb29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/11.8_dbg_san/strings/strcoll.inl:324:25

Bug confirmed present in:
MariaDB: 10.5.28 (dbg), 10.5.28 (opt), 10.6.21 (dbg), 10.6.21 (opt), 10.11.11 (dbg), 10.11.11 (opt), 11.4.5 (dbg), 11.4.5 (opt), 11.7.2 (dbg), 11.7.2 (opt), 11.8.0 (dbg), 11.8.0 (opt)

Roel Van de Paar added a comment - 2025-02-08 03:14 - edited Additional testcase: SET SESSION sql_buffer_result= ON ; SELECT authentication_string <> '' FROM mysql. user ; Leads to two new outcomes (note versions): CS 10.5.28 df602ff7fa5ed9424a1d7ebaba67b665e2f6d1f6 (Optimized, UBASAN, Clang) /test/10.5_opt_san/strings/strcoll.inl:250:25: runtime error: applying zero offset to null pointer #0 0x55d5887c4cf0 in my_strnncollsp_utf8mb4_bin /test/10.5_opt_san/strings/strcoll.inl:250:25 #1 0x55d587022216 in Arg_comparator::compare() /test/10.5_opt_san/sql/item_cmpfunc.h:117:33 #2 0x55d587022216 in Item_func_ne::val_int() /test/10.5_opt_san/sql/item_cmpfunc.cc:1845:18 #3 0x55d586f7c491 in Item::save_int_in_field(Field*, bool) /test/10.5_opt_san/sql/item.cc:6970:16 #4 0x55d586f7c846 in Item::save_in_field(Field*, bool) /test/10.5_opt_san/sql/item.cc:6980:30 #5 0x55d586479f91 in copy_funcs(Item**, THD const*) /test/10.5_opt_san/sql/sql_select.cc:26740:11 #6 0x55d58646537e in end_write(JOIN*, st_join_table*, bool) /test/10.5_opt_san/sql/sql_select.cc:22782:9 #7 0x55d5864a33f1 in AGGR_OP::put_record(bool) /test/10.5_opt_san/sql/sql_select.cc:30160:30 #8 0x55d5863d468e in AGGR_OP::put_record() /test/10.5_opt_san/sql/sql_select.h:1087:48 #9 0x55d5863d468e in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /test/10.5_opt_san/sql/sql_select.cc:21011:13 #10 0x55d58646db15 in evaluate_join_record(JOIN*, st_join_table*, int) /test/10.5_opt_san/sql/sql_select.cc:21540:11 #11 0x55d58646a5ef in sub_select(JOIN*, st_join_table*, bool) /test/10.5_opt_san/sql/sql_select.cc:21310:9 #12 0x55d5863e98b6 in do_select(JOIN*, Procedure*) /test/10.5_opt_san/sql/sql_select.cc:20827:14 #13 0x55d5863e6ad5 in JOIN::exec_inner() /test/10.5_opt_san/sql/sql_select.cc:4664:50 #14 0x55d5863e39ed in JOIN::exec() /test/10.5_opt_san/sql/sql_select.cc:4444:3 #15 0x55d586366d14 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.5_opt_san/sql/sql_select.cc:4921:9 #16 0x55d586365b10 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.5_opt_san/sql/sql_select.cc:449:10 #17 0x55d5862a4fbd in execute_sqlcom_select(THD*, TABLE_LIST*) /test/10.5_opt_san/sql/sql_parse.cc:6451:12 #18 0x55d5862812fe in mysql_execute_command(THD*) /test/10.5_opt_san/sql/sql_parse.cc:4043:12 #19 0x55d5862630c6 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_opt_san/sql/sql_parse.cc:8251:18 #20 0x55d586257d1e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_opt_san/sql/sql_parse.cc:1891:7 #21 0x55d5862650c0 in do_command(THD*) /test/10.5_opt_san/sql/sql_parse.cc:1375:17 #22 0x55d586831e37 in do_handle_one_connection(CONNECT*, bool) /test/10.5_opt_san/sql/sql_connect.cc:1386:11 #23 0x55d58683168a in handle_one_connection /test/10.5_opt_san/sql/sql_connect.cc:1298:5 #24 0x55d585dbd72c in asan_thread_start(void*) asan_interceptors.cpp.o #25 0x14858e89ca93 in start_thread nptl/pthread_create.c:447:8 #26 0x14858e929c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/10.5_opt_san/strings/strcoll.inl:250:25 CS 11.8.0 cacaaebf01939d387645fb850ceeec5392496171 (Debug, UBASAN, Clang) /test/11.8_dbg_san/strings/strcoll.inl:324:25: runtime error: applying zero offset to null pointer #0 0x561f15349331 in my_strnncollsp_utf8mb4_bin /test/11.8_dbg_san/strings/strcoll.inl:324:25 #1 0x561f13a205a4 in Arg_comparator::compare() /test/11.8_dbg_san/sql/item_cmpfunc.h:114:33 #2 0x561f13a205a4 in Item_func_ne::val_bool() /test/11.8_dbg_san/sql/item_cmpfunc.cc:1915:18 #3 0x561f1396e8cf in Item::save_bool_in_field(Field*, bool) /test/11.8_dbg_san/sql/item.cc:7093:12 #4 0x561f1396ec16 in Item::save_in_field(Field*, bool) /test/11.8_dbg_san/sql/item.cc:7103:30 #5 0x561f12c9d9f1 in copy_funcs(Item**, THD const*) /test/11.8_dbg_san/sql/sql_select.cc:29774:11 #6 0x561f12c8abd2 in end_write(JOIN*, st_join_table*, bool) /test/11.8_dbg_san/sql/sql_select.cc:25709:9 #7 0x561f12cc21a1 in AGGR_OP::put_record(bool) /test/11.8_dbg_san/sql/sql_select.cc:33211:30 #8 0x561f12bdcbb5 in AGGR_OP::put_record() /test/11.8_dbg_san/sql/sql_select.h:1184:48 #9 0x561f12bdcbb5 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /test/11.8_dbg_san/sql/sql_select.cc:23793:13 #10 0x561f12c909bf in evaluate_join_record(JOIN*, st_join_table*, int) /test/11.8_dbg_san/sql/sql_select.cc:24342:11 #11 0x561f12b633bf in sub_select(JOIN*, st_join_table*, bool) /test/11.8_dbg_san/sql/sql_select.cc:24109:9 #12 0x561f12bf379c in do_select(JOIN*, Procedure*) /test/11.8_dbg_san/sql/sql_select.cc:23620:14 #13 0x561f12bf00f1 in JOIN::exec_inner() /test/11.8_dbg_san/sql/sql_select.cc:5040:50 #14 0x561f12beda12 in JOIN::exec() /test/11.8_dbg_san/sql/sql_select.cc:4823:8 #15 0x561f12b67634 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_dbg_san/sql/sql_select.cc:5356:21 #16 0x561f12b65f12 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_dbg_san/sql/sql_select.cc:633:10 #17 0x561f12a3b167 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/11.8_dbg_san/sql/sql_parse.cc:6191:12 #18 0x561f12a26d39 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:3980:12 #19 0x561f129f6588 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7915:18 #20 0x561f129ea64b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7 #21 0x561f129f8fad in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17 #22 0x561f130bc76c in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11 #23 0x561f130bc027 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5 #24 0x561f123fbb5c in asan_thread_start(void*) asan_interceptors.cpp.o #25 0x1505cca9ca93 in start_thread nptl/pthread_create.c:447:8 #26 0x1505ccb29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/11.8_dbg_san/strings/strcoll.inl:324:25 Bug confirmed present in: MariaDB: 10.5.28 (dbg), 10.5.28 (opt), 10.6.21 (dbg), 10.6.21 (opt), 10.11.11 (dbg), 10.11.11 (opt), 11.4.5 (dbg), 11.4.5 (opt), 11.7.2 (dbg), 11.7.2 (opt), 11.8.0 (dbg), 11.8.0 (opt)

MariaDB Server

UBSAN: runtime error: applying zero offset to null pointer in my_strnncollsp_utf8mb4_bin on SELECT FROM mysql.user

Details

Description

Attachments

Issue Links

Activity

People

Dates

Git Integration