Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36328

MSAN: use-of-uninitialized-value in ha_innobase::records_in_range

Details

    Description

      main.index_merge_innodb                  w9 [ fail ]
              Test ended at 2025-03-19 06:48:33
       
      CURRENT_TEST: main.index_merge_innodb
      mysqltest: In included file "./include/index_merge2.inc": 
      included from /source/mysql-test/main/index_merge_innodb.test at line 40:
      At line 129: query 'select * from t1  where id1 = 1  and id2= '20040101'' failed: 2013: Lost connection to MySQL server during query
      

      Version: '10.5.29-MariaDB-debug-log'  socket: '/build/mysql-test/var/tmp/9/mysqld.1.sock'  port: 19210  Source distribution
      ==178574==WARNING: MemorySanitizer: use-of-uninitialized-value
          #0 0x55d328a0e399 in ha_innobase::records_in_range(unsigned int, st_key_range const*, st_key_range const*, st_page_range*) /source/storage/innobase/handler/ha_innodb.cc:14004:62
          #1 0x55d327530eac in ror_scan_selectivity(ROR_INTERSECT_INFO const*, st_ror_scan_info const*) /source/sql/opt_range.cc:6947:17
          #2 0x55d32752d97f in ror_intersect_add(ROR_INTERSECT_INFO*, st_ror_scan_info*, Json_writer_object*, bool) /source/sql/opt_range.cc:7025:22
          #3 0x55d3274338c5 in get_best_ror_intersect(PARAM const*, SEL_TREE*, double, bool*) /source/sql/opt_range.cc:7247:10
          #4 0x55d327423f50 in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool) /source/sql/opt_range.cc:2975:24
          #5 0x55d325004346 in get_quick_record_count(THD*, SQL_SELECT*, TABLE*, Bitmap<64u> const*, unsigned long long) /source/sql/sql_select.cc:4965:9
          #6 0x55d324dc643d in make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*) /source/sql/sql_select.cc:5692:20
          #7 0x55d324d9a4f1 in JOIN::optimize_inner() /source/sql/sql_select.cc:2419:7
          #8 0x55d324d787d8 in JOIN::optimize() /source/sql/sql_select.cc:1765:10
          #9 0x55d324d36f0f in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /source/sql/sql_select.cc:4907:19
          #10 0x55d324d33d1a in handle_select(THD*, LEX*, select_result*, unsigned long) /source/sql/sql_select.cc:449:10
          #11 0x55d324b529f0 in execute_sqlcom_select(THD*, TABLE_LIST*) /source/sql/sql_parse.cc:6452:12
          #12 0x55d324b0d712 in mysql_execute_command(THD*) /source/sql/sql_parse.cc:4043:12
          #13 0x55d324ad5026 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /source/sql/sql_parse.cc:8252:18
          #14 0x55d324ac0bbb in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /source/sql/sql_parse.cc:1891:7
          #15 0x55d324ad988b in do_command(THD*) /source/sql/sql_parse.cc:1375:17
          #16 0x55d325868ac1 in do_handle_one_connection(CONNECT*, bool) /source/sql/sql_connect.cc:1386:11
          #17 0x55d3258673cd in handle_one_connection /source/sql/sql_connect.cc:1298:5
          #18 0x55d3282a9fc8 in pfs_spawn_thread /source/storage/perfschema/pfs.cc:2201:3
          #19 0x7f9b8b1ae1c3  (/lib/x86_64-linux-gnu/libc.so.6+0x891c3) (BuildId: c047672cae7964324658491e7dee26748ae5d2f8)
          #20 0x7f9b8b22e85b  (/lib/x86_64-linux-gnu/libc.so.6+0x10985b) (BuildId: c047672cae7964324658491e7dee26748ae5d2f8)
       
        Uninitialized value was stored to memory at
          #0 0x55d328a0e392 in ha_innobase::records_in_range(unsigned int, st_key_range const*, st_key_range const*, st_page_range*) /source/storage/innobase/handler/ha_innodb.cc:14004:69
          #1 0x55d327530eac in ror_scan_selectivity(ROR_INTERSECT_INFO const*, st_ror_scan_info const*) /source/sql/opt_range.cc:6947:17
          #2 0x55d32752d97f in ror_intersect_add(ROR_INTERSECT_INFO*, st_ror_scan_info*, Json_writer_object*, bool) /source/sql/opt_range.cc:7025:22
          #3 0x55d3274338c5 in get_best_ror_intersect(PARAM const*, SEL_TREE*, double, bool*) /source/sql/opt_range.cc:7247:10
          #4 0x55d327423f50 in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool) /source/sql/opt_range.cc:2975:24
          #5 0x55d325004346 in get_quick_record_count(THD*, SQL_SELECT*, TABLE*, Bitmap<64u> const*, unsigned long long) /source/sql/sql_select.cc:4965:9
          #6 0x55d324dc643d in make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*) /source/sql/sql_select.cc:5692:20
          #7 0x55d324d9a4f1 in JOIN::optimize_inner() /source/sql/sql_select.cc:2419:7
          #8 0x55d324d787d8 in JOIN::optimize() /source/sql/sql_select.cc:1765:10
          #9 0x55d324d36f0f in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /source/sql/sql_select.cc:4907:19
          #10 0x55d324d33d1a in handle_select(THD*, LEX*, select_result*, unsigned long) /source/sql/sql_select.cc:449:10
          #11 0x55d324b529f0 in execute_sqlcom_select(THD*, TABLE_LIST*) /source/sql/sql_parse.cc:6452:12
          #12 0x55d324b0d712 in mysql_execute_command(THD*) /source/sql/sql_parse.cc:4043:12
          #13 0x55d324ad5026 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /source/sql/sql_parse.cc:8252:18
          #14 0x55d324ac0bbb in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /source/sql/sql_parse.cc:1891:7
          #15 0x55d324ad988b in do_command(THD*) /source/sql/sql_parse.cc:1375:17
          #16 0x55d325868ac1 in do_handle_one_connection(CONNECT*, bool) /source/sql/sql_connect.cc:1386:11
          #17 0x55d3258673cd in handle_one_connection /source/sql/sql_connect.cc:1298:5
          #18 0x55d3282a9fc8 in pfs_spawn_thread /source/storage/perfschema/pfs.cc:2201:3
          #19 0x7f9b8b1ae1c3  (/lib/x86_64-linux-gnu/libc.so.6+0x891c3) (BuildId: c047672cae7964324658491e7dee26748ae5d2f8)
       
       
        Uninitialized value was created by an allocation of 'pages' in the stack frame
          #0 0x55d327530213 in ror_scan_selectivity(ROR_INTERSECT_INFO const*, st_ror_scan_info const*) /source/sql/opt_range.cc:6929:7
      

      Attachments

        Issue Links

          Activity

            danblack Daniel Black added a comment -

            ha_innobase::records_in_range copies the uninitialised page->first_page / page->last_page to the tuple1/tuple2. Within the function the btr_estimate_n_rows_in_range the page number values aren't actually used.

            danblack Daniel Black added a comment - ha_innobase::records_in_range copies the uninitialised page->first_page / page->last_page to the tuple1 / tuple2 . Within the function the btr_estimate_n_rows_in_range the page number values aren't actually used.
            marko Marko Mäkelä added a comment -

            Thank you. I think that some clarification is needed.

            marko Marko Mäkelä added a comment - Thank you. I think that some clarification is needed.

            People

              danblack Daniel Black
              danblack Daniel Black
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.