Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.11
-
clang-20.1, UBSAN
Description
highlighted by the existing test case from MDEV-18722
create table t1 (t time, unique(t)) engine=innodb;
|
insert into t1 values (null),(null);
|
alter ignore table t1 modify t text not null default '';
|
Thread 13 "one_connection" hit Breakpoint 2, 0x000055555935c880 in __ubsan::ScopedReport::~ScopedReport() ()
|
(gdb) bt
|
#0 0x000055555935c880 in __ubsan::ScopedReport::~ScopedReport() ()
|
#1 0x00005555593614cb in handlePointerOverflowImpl(__ubsan::PointerOverflowData*, unsigned long, unsigned long, __ubsan::ReportOptions) ()
|
#2 0x0000555559361044 in __ubsan_handle_pointer_overflow ()
|
#3 0x000055555d8c7c4d in my_uca_scanner_next_utf8mb4 (scanner=0x7bffdcfa9e70, param=0x7bffdcfa9ec0) at /source/strings/ctype-uca-scanner_next.inl:84
|
#4 0x000055555d8cb785 in my_uca_strnncollsp_onelevel_utf8mb4 (cs=0x7e0ff61f9cb0, level=0x5555628892d0 <my_uca1400_info_tailored+8944>, s=0x7e8ff6370280 '\276' <repeats 200 times>...,
|
slen=0, t=0x0, tlen=0) at /source/strings/ctype-uca.inl:235
|
#5 0x000055555d88276a in my_uca_strnncollsp_utf8mb4 (cs=0x7e0ff61f9cb0, s=0x7e8ff6370280 '\276' <repeats 200 times>..., slen=0, t=0x0, tlen=0) at /source/strings/ctype-uca.inl:280
|
#6 0x000055555b0de008 in charset_info_st::strnncollsp (this=0x7e0ff61f9cb0, a=0x7e8ff6370280 '\276' <repeats 200 times>..., alen=0, b=0x0, blen=0) at /source/include/m_ctype.h:1102
|
#7 0x000055555b0a24f0 in Field_blob::cmp (this=0x7e4ff63c5b18, a=0x7e8ff6370280 '\276' <repeats 200 times>..., a_length=0, b=0x0, b_length=0) at /source/sql/field.cc:9019
|
#8 0x000055555b0a291e in Field_blob::cmp (this=0x7e4ff63c5b18, a_ptr=0x7e4ff63c5a20 "", b_ptr=0x7e4ff63c69b8 "") at /source/sql/field.cc:9029
|
#9 0x000055555a51dd6d in Field::cmp_offset (this=0x7e4ff63c5b18, row_offset=3992) at /source/sql/field.h:1355
|
#10 0x000055555b1d1eea in handler::check_duplicate_long_entry_key (this=0x7e4ff63c51b8, new_rec=0x7e4ff63c5a20 "", key_no=0) at /source/sql/handler.cc:7856
|
#11 0x000055555b1d5167 in handler::check_duplicate_long_entries (this=0x7e4ff63c51b8, new_rec=0x7e4ff63c5a20 "") at /source/sql/handler.cc:7915
|
#12 0x000055555b1db873 in handler::ha_write_row (this=0x7e4ff63c51b8, buf=0x7e4ff63c5a20 "") at /source/sql/handler.cc:8203
|
#13 0x000055555a21dd5a in copy_data_between_tables (thd=0x7eaff6368288, from=0x7d9ff628f308, to=0x7d9ff6298f08, ignore=true, order_num=0, order=0x0, copied=0x7bffdd4da160,
|
deleted=0x7bffdd4da180, alter_info=0x7bffdd33e320, alter_ctx=0x7bffdd4dae60, online=false, start_alter_id=0) at /source/sql/sql_table.cc:12769
|
#14 0x000055555a1e79ce in mysql_alter_table (thd=0x7eaff6368288, new_db=0x7eaff636cea0, new_name=0x7eaff636d308, create_info=0x7bffdd33e020, table_list=0x7ecff65c85f8,
|
recreate_info=0x7bffdd33ed00, alter_info=0x7bffdd33e320, order_num=0, order=0x0, ignore=true, if_exists=false) at /source/sql/sql_table.cc:11863
|
#15 0x000055555a5e0902 in Sql_cmd_alter_table::execute (this=0x7ecff65c8f20, thd=0x7eaff6368288) at /source/sql/sql_alter.cc:701
|
#16 0x0000555559be571c in mysql_execute_command (thd=0x7eaff6368288, is_called_from_prepared_stmt=false) at /source/sql/sql_parse.cc:5886
|
#17 0x0000555559b8f585 in mysql_parse (thd=0x7eaff6368288, rawbuf=0x7ecff65c84a8 "alter ignore table t1 modify t text not null default ''", length=55, parser_state=0x7bffdd4627b0)
|
at /source/sql/sql_parse.cc:7915
|
#18 0x0000555559b7e076 in dispatch_command (command=COM_QUERY, thd=0x7eaff6368288, packet=0x7e8ff6320289 "alter ignore table t1 modify t text not null default ''", packet_length=55,
|
blocking=true) at /source/sql/sql_parse.cc:1902
|
#19 0x0000555559b94854 in do_command (thd=0x7eaff6368288, blocking=true) at /source/sql/sql_parse.cc:1415
|
#20 0x000055555a5a5cb4 in do_handle_one_connection (connect=0x7d0ff6213ec8, put_in_cache=true) at /source/sql/sql_connect.cc:1415
|
#21 0x000055555a5a4ff7 in handle_one_connection (arg=0x7d0ff6213ec8) at /source/sql/sql_connect.cc:1327
|
#22 0x000055555931c5d7 in asan_thread_start(void*) ()
|
#23 0x00007ffff742d1c4 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
|
#24 0x00007ffff74ad85c in ?? () from /lib/x86_64-linux-gnu/libc.so.6
|
(gdb) frame 3
|
#3 0x000055555d8c7c4d in my_uca_scanner_next_utf8mb4 (scanner=0x7bffdcfa9e70, param=0x7bffdcfa9ec0) at /source/strings/ctype-uca-scanner_next.inl:84
|
84 if (scanner->sbeg + 1 < scanner->send)
|
(gdb) p *scanner
|
$1 = {wbeg = 0x55555e89b9c0 <nochar>, sbeg = 0x0, send = 0x0, implicit = {0, 0}, page = 0, code = 0}
|
(gdb) up
|
#4 0x000055555d8cb785 in my_uca_strnncollsp_onelevel_utf8mb4 (cs=0x7e0ff61f9cb0, level=0x5555628892d0 <my_uca1400_info_tailored+8944>, s=0x7e8ff6370280 '\276' <repeats 200 times>...,
|
slen=0, t=0x0, tlen=0) at /source/strings/ctype-uca.inl:235
|
235 t_res= MY_FUNCTION_NAME(scanner_next)(&tscanner, ¶m);
|
(gdb) up
|
#5 0x000055555d88276a in my_uca_strnncollsp_utf8mb4 (cs=0x7e0ff61f9cb0, s=0x7e8ff6370280 '\276' <repeats 200 times>..., slen=0, t=0x0, tlen=0) at /source/strings/ctype-uca.inl:280
|
280 return MY_FUNCTION_NAME(strnncollsp_onelevel)(cs, &cs->uca->level[0],
|
(gdb) up
|
#6 0x000055555b0de008 in charset_info_st::strnncollsp (this=0x7e0ff61f9cb0, a=0x7e8ff6370280 '\276' <repeats 200 times>..., alen=0, b=0x0, blen=0) at /source/include/m_ctype.h:1102
|
1102 return (coll->strnncollsp)(this, a, alen, b, blen);
|
(gdb) up
|
#7 0x000055555b0a24f0 in Field_blob::cmp (this=0x7e4ff63c5b18, a=0x7e8ff6370280 '\276' <repeats 200 times>..., a_length=0, b=0x0, b_length=0) at /source/sql/field.cc:9019
|
9019 return field_charset()->strnncollsp(a, a_length, b, b_length);
|
(gdb) up
|
#8 0x000055555b0a291e in Field_blob::cmp (this=0x7e4ff63c5b18, a_ptr=0x7e4ff63c5a20 "", b_ptr=0x7e4ff63c69b8 "") at /source/sql/field.cc:9029
|
9029 return cmp(blob1, (uint32)a_len, blob2, (uint32)b_len);
|
(gdb) info locals
|
blob1 = 0x7e8ff6370280 '\276' <repeats 200 times>...
|
blob2 = 0x0
|
a_len = 0
|
b_len = 0
|
So could be fixed in Field_blob::cmp (and Field_blob::cmp_prefix)
Attachments
Issue Links
- is caused by
-
MDEV-371 Unique indexes for blobs
-
- Closed
-
- is part of
-
MDEV-25454 Make MariaDB server UBSAN safe
-
- Confirmed
-
-
MDEV-36479 Passing null pointer to low level character set functions result in undefined behaviour
-
- Open
-
- relates to
-
MDBF-741 Remove the gcc UBSAN builder to use the clang based UBSAN
-
- In Testing
-