Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36604

runtime error: applying zero offset to null pointer in my_strnxfrm_big5_chinese_ci

    XMLWordPrintable

Details

    Description

      SET GLOBAL character_set_client='big5';
      SET NAMES DEFAULT;
      DO CHAR((WEIGHT_STRING (EXTRACTVALUE ((1),('a')) LEVEL 7)) USING cp852);
      

      Leads to:

      CS 10.5.29 c43d0a015f974c5a0142e6779332089a7a979853 (Debug, UBASAN, Clang) Build 15/02/2025

      /test/10.5_dbg_san/strings/strcoll.inl:359:24: runtime error: applying zero offset to null pointer
          #0 0x5f307f55fe19 in my_strnxfrm_big5_chinese_ci /test/10.5_dbg_san/strings/strcoll.inl:359:24
          #1 0x5f307ddc4067 in charset_info_st::strnxfrm(char*, unsigned long, unsigned int, char const*, unsigned long, unsigned int) const /test/10.5_dbg_san/include/m_ctype.h:871:12
          #2 0x5f307ddc4067 in Item_func_weight_string::val_str(String*) /test/10.5_dbg_san/sql/item_strfunc.cc:3732:19
          #3 0x5f307dd8005e in Item_str_func::val_int() /test/10.5_dbg_san/sql/item_strfunc.cc:154:16
          #4 0x5f307ddb51d5 in Item_func_char::val_str(String*) /test/10.5_dbg_san/sql/item_strfunc.cc:2986:32
          #5 0x5f307d583527 in Type_handler_string_result::Item_update_null_value(Item*) const /test/10.5_dbg_san/sql/sql_type.cc:4286:16
          #6 0x5f307ccc9875 in Item_func::is_null() /test/10.5_dbg_san/sql/item_func.h:222:5
          #7 0x5f307e2a1570 in mysql_do(THD*, List<Item>&) /test/10.5_dbg_san/sql/sql_do.cc:35:19
          #8 0x5f307cd27c62 in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:4072:10
          #9 0x5f307cd00467 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8252:18
          #10 0x5f307ccf43b9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891:7
          #11 0x5f307cd025be in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375:17
          #12 0x5f307d30c257 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1386:11
          #13 0x5f307d30bb1b in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1298:5
          #14 0x5f307c81503c in asan_thread_start(void*) asan_interceptors.cpp.o
          #15 0x7cabb1e9ca93 in start_thread nptl/pthread_create.c:447:8
          #16 0x7cabb1f29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
      SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/10.5_dbg_san/strings/strcoll.inl:359:24 
      

      Setup:

      Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18. Ubuntu instructions:
        # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18
           sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev
      Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:
          -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
      Set before execution:
          export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter
      

      SAN Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.5   dbg  150225  c43d0a015f974c5a0142e6779332089a7a979853  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      CS  10.5   opt  150225  c43d0a015f974c5a0142e6779332089a7a979853  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      CS  10.6   dbg  150225  f1d7e0c17e33f77278e6226dd94aeb30fc856bf0  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      CS  10.6   opt  150225  f1d7e0c17e33f77278e6226dd94aeb30fc856bf0  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      CS  10.11  dbg  150225  43c5d1303f5c7c726db276815c459436110f342f  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      CS  10.11  opt  150225  43c5d1303f5c7c726db276815c459436110f342f  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      CS  11.4   dbg  150225  ef966af801afc2a07222b5df65dddd52c77431dd  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      CS  11.4   opt  150225  ef966af801afc2a07222b5df65dddd52c77431dd  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      CS  11.8   dbg  150225  33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      CS  11.8   opt  150225  33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      CS  12.0   dbg  150225  c92add291e636c797e6d6ddca605905541b2a441  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      CS  12.0   opt  150225  c92add291e636c797e6d6ddca605905541b2a441  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      ES  10.5   dbg  140325  6553c62369ab3606efc74295c902181f793fd6d1  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      ES  10.5   opt  140325  6553c62369ab3606efc74295c902181f793fd6d1  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      ES  10.6   dbg  140325  a99e9e4101f5d56a379577e6d81c829b7658df99  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      ES  10.6   opt  140325  a99e9e4101f5d56a379577e6d81c829b7658df99  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      ES  11.4   dbg  140325  26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      ES  11.4   opt  140325  26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba  UBSAN|applying zero offset to null pointer|strings/strcoll.inl|my_strnxfrm_big5_chinese_ci|charset_info_st::strnxfrm|Item_func_weight_string::val_str|Item_str_func::val_int
      

      Attachments

        Activity

          People

            bar Alexander Barkov
            Roel Roel Van de Paar
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.