Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36479

Passing null pointer to low level character set functions result in undefined behaviour

    XMLWordPrintable

Details

    • Sprint 7 (07.04.2025), Sprint 8 (21.04.2025), Sprint 9 (05.05.2025)

    Description

      Using https://github.com/MariaDB/server/pull/3946 and applying a bunch of nonnull attributes on include/m_ctype.h allows us to find callers that pass down null values in the expectation of some character set dependent results.

      The behaviour of null pointers should be determined higher in the stack.

      testing with -DWITH_ASAN=ON -DWITH_UBSAN=ON -DWITH_ASAN_SCOPE=ON -DPLUGIN_PERFSCHEMA=NO -DPLUGIN_MROONGA=NO -DCMAKE_BUILD_TYPE=Debug -DWITH_DBUG_TRACE=OFF and the non-debug, using clang-19+.

      Attachments

        Issue Links

          includes

          Bug - A problem which impairs or prevents the functions of the product. MDEV-36467 UBSAN: _ma_unique_hash on NULL BLOB results in strings/ctype-uca-scanner_next.inl:84:23: runtime error: applying non-zero offset 1 to null pointer (main.type_blob)

          • Major - Major loss of function.
          • Open

          Bug - A problem which impairs or prevents the functions of the product. MDEV-36468 UBSAN: null blob in Field_blob::cmp resuting in my_uca_scanner_next_utf8mb4 overflow

          • Major - Major loss of function.
          • Open

          Bug - A problem which impairs or prevents the functions of the product. MDEV-36469 UBSAN nonzero-offset testing empty is_infoschema_db

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-36480 USAN: checking identifier names for 0 length names

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-36529 Item_func_eq::val_bool is doing a string comparison

          • Major - Major loss of function.
          • Closed
          is part of

          Task - A task that needs to be done. MDEV-25454 Make MariaDB server UBSAN safe

          • Major - Major loss of function.
          • Confirmed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-40176 UBSAN: strings/ctype-mb.c:261:32: runtime error: applying non-zero offset 2 to null pointer main.long_unique_bugs

          • Critical - Crashes, loss of data, severe memory leak.
          • Open

          Activity

            People

              danblack Daniel Black
              danblack Daniel Black
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 0.75d
                  0.75d

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.