Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36468

UBSAN: null blob in Field_blob::cmp resuting in my_uca_scanner_next_utf8mb4 overflow

Details

    Description

      highlighted by the existing test case from MDEV-18722

      create table t1 (t time, unique(t)) engine=innodb;
      insert into t1 values (null),(null);
      alter ignore table t1 modify t text not null default '';
      

      Thread 13 "one_connection" hit Breakpoint 2, 0x000055555935c880 in __ubsan::ScopedReport::~ScopedReport() ()
      (gdb) bt
      #0  0x000055555935c880 in __ubsan::ScopedReport::~ScopedReport() ()
      #1  0x00005555593614cb in handlePointerOverflowImpl(__ubsan::PointerOverflowData*, unsigned long, unsigned long, __ubsan::ReportOptions) ()
      #2  0x0000555559361044 in __ubsan_handle_pointer_overflow ()
      #3  0x000055555d8c7c4d in my_uca_scanner_next_utf8mb4 (scanner=0x7bffdcfa9e70, param=0x7bffdcfa9ec0) at /source/strings/ctype-uca-scanner_next.inl:84
      #4  0x000055555d8cb785 in my_uca_strnncollsp_onelevel_utf8mb4 (cs=0x7e0ff61f9cb0, level=0x5555628892d0 <my_uca1400_info_tailored+8944>, s=0x7e8ff6370280 '\276' <repeats 200 times>..., 
          slen=0, t=0x0, tlen=0) at /source/strings/ctype-uca.inl:235
      #5  0x000055555d88276a in my_uca_strnncollsp_utf8mb4 (cs=0x7e0ff61f9cb0, s=0x7e8ff6370280 '\276' <repeats 200 times>..., slen=0, t=0x0, tlen=0) at /source/strings/ctype-uca.inl:280
      #6  0x000055555b0de008 in charset_info_st::strnncollsp (this=0x7e0ff61f9cb0, a=0x7e8ff6370280 '\276' <repeats 200 times>..., alen=0, b=0x0, blen=0) at /source/include/m_ctype.h:1102
      #7  0x000055555b0a24f0 in Field_blob::cmp (this=0x7e4ff63c5b18, a=0x7e8ff6370280 '\276' <repeats 200 times>..., a_length=0, b=0x0, b_length=0) at /source/sql/field.cc:9019
      #8  0x000055555b0a291e in Field_blob::cmp (this=0x7e4ff63c5b18, a_ptr=0x7e4ff63c5a20 "", b_ptr=0x7e4ff63c69b8 "") at /source/sql/field.cc:9029
      #9  0x000055555a51dd6d in Field::cmp_offset (this=0x7e4ff63c5b18, row_offset=3992) at /source/sql/field.h:1355
      #10 0x000055555b1d1eea in handler::check_duplicate_long_entry_key (this=0x7e4ff63c51b8, new_rec=0x7e4ff63c5a20 "", key_no=0) at /source/sql/handler.cc:7856
      #11 0x000055555b1d5167 in handler::check_duplicate_long_entries (this=0x7e4ff63c51b8, new_rec=0x7e4ff63c5a20 "") at /source/sql/handler.cc:7915
      #12 0x000055555b1db873 in handler::ha_write_row (this=0x7e4ff63c51b8, buf=0x7e4ff63c5a20 "") at /source/sql/handler.cc:8203
      #13 0x000055555a21dd5a in copy_data_between_tables (thd=0x7eaff6368288, from=0x7d9ff628f308, to=0x7d9ff6298f08, ignore=true, order_num=0, order=0x0, copied=0x7bffdd4da160, 
          deleted=0x7bffdd4da180, alter_info=0x7bffdd33e320, alter_ctx=0x7bffdd4dae60, online=false, start_alter_id=0) at /source/sql/sql_table.cc:12769
      #14 0x000055555a1e79ce in mysql_alter_table (thd=0x7eaff6368288, new_db=0x7eaff636cea0, new_name=0x7eaff636d308, create_info=0x7bffdd33e020, table_list=0x7ecff65c85f8, 
          recreate_info=0x7bffdd33ed00, alter_info=0x7bffdd33e320, order_num=0, order=0x0, ignore=true, if_exists=false) at /source/sql/sql_table.cc:11863
      #15 0x000055555a5e0902 in Sql_cmd_alter_table::execute (this=0x7ecff65c8f20, thd=0x7eaff6368288) at /source/sql/sql_alter.cc:701
      #16 0x0000555559be571c in mysql_execute_command (thd=0x7eaff6368288, is_called_from_prepared_stmt=false) at /source/sql/sql_parse.cc:5886
      #17 0x0000555559b8f585 in mysql_parse (thd=0x7eaff6368288, rawbuf=0x7ecff65c84a8 "alter ignore table t1 modify t text not null default ''", length=55, parser_state=0x7bffdd4627b0)
          at /source/sql/sql_parse.cc:7915
      #18 0x0000555559b7e076 in dispatch_command (command=COM_QUERY, thd=0x7eaff6368288, packet=0x7e8ff6320289 "alter ignore table t1 modify t text not null default ''", packet_length=55, 
          blocking=true) at /source/sql/sql_parse.cc:1902
      #19 0x0000555559b94854 in do_command (thd=0x7eaff6368288, blocking=true) at /source/sql/sql_parse.cc:1415
      #20 0x000055555a5a5cb4 in do_handle_one_connection (connect=0x7d0ff6213ec8, put_in_cache=true) at /source/sql/sql_connect.cc:1415
      #21 0x000055555a5a4ff7 in handle_one_connection (arg=0x7d0ff6213ec8) at /source/sql/sql_connect.cc:1327
      #22 0x000055555931c5d7 in asan_thread_start(void*) ()
      #23 0x00007ffff742d1c4 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
      #24 0x00007ffff74ad85c in ?? () from /lib/x86_64-linux-gnu/libc.so.6
      (gdb) frame 3
      #3  0x000055555d8c7c4d in my_uca_scanner_next_utf8mb4 (scanner=0x7bffdcfa9e70, param=0x7bffdcfa9ec0) at /source/strings/ctype-uca-scanner_next.inl:84
      84	    if (scanner->sbeg + 1 < scanner->send)
      (gdb) p *scanner
      $1 = {wbeg = 0x55555e89b9c0 <nochar>, sbeg = 0x0, send = 0x0, implicit = {0, 0}, page = 0, code = 0}
      (gdb) up
      #4  0x000055555d8cb785 in my_uca_strnncollsp_onelevel_utf8mb4 (cs=0x7e0ff61f9cb0, level=0x5555628892d0 <my_uca1400_info_tailored+8944>, s=0x7e8ff6370280 '\276' <repeats 200 times>..., 
          slen=0, t=0x0, tlen=0) at /source/strings/ctype-uca.inl:235
      235	    t_res= MY_FUNCTION_NAME(scanner_next)(&tscanner, &param);
      (gdb) up
      #5  0x000055555d88276a in my_uca_strnncollsp_utf8mb4 (cs=0x7e0ff61f9cb0, s=0x7e8ff6370280 '\276' <repeats 200 times>..., slen=0, t=0x0, tlen=0) at /source/strings/ctype-uca.inl:280
      280	  return MY_FUNCTION_NAME(strnncollsp_onelevel)(cs, &cs->uca->level[0],
      (gdb) up
      #6  0x000055555b0de008 in charset_info_st::strnncollsp (this=0x7e0ff61f9cb0, a=0x7e8ff6370280 '\276' <repeats 200 times>..., alen=0, b=0x0, blen=0) at /source/include/m_ctype.h:1102
      1102	    return (coll->strnncollsp)(this, a, alen, b, blen);
      (gdb) up
      #7  0x000055555b0a24f0 in Field_blob::cmp (this=0x7e4ff63c5b18, a=0x7e8ff6370280 '\276' <repeats 200 times>..., a_length=0, b=0x0, b_length=0) at /source/sql/field.cc:9019
      9019	  return field_charset()->strnncollsp(a, a_length, b, b_length);
      (gdb) up
      #8  0x000055555b0a291e in Field_blob::cmp (this=0x7e4ff63c5b18, a_ptr=0x7e4ff63c5a20 "", b_ptr=0x7e4ff63c69b8 "") at /source/sql/field.cc:9029
      9029	  return cmp(blob1, (uint32)a_len, blob2, (uint32)b_len);
      (gdb) info locals
      blob1 = 0x7e8ff6370280 '\276' <repeats 200 times>...
      blob2 = 0x0
      a_len = 0
      b_len = 0
      

      So could be fixed in Field_blob::cmp (and Field_blob::cmp_prefix)

      Attachments

        Issue Links

          Activity

            There are no comments yet on this issue.

            People

              bar Alexander Barkov
              danblack Daniel Black
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.