Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36699

UBSAN: member access within null pointer of type 'KEY' (aka 'st_key') in spider_mbase_handler::append_key_order_with_alias (Spider) and in calculate_key_len (InnoDB)

    XMLWordPrintable

Details

    Description

      INSTALL PLUGIN Spider SONAME 'ha_spider.so';
      CREATE OR REPLACE TABLE mysql.servers (c INT) ENGINE=Spider;
      CREATE SERVER s FOREIGN DATA WRAPPER mysql OPTIONS(HOST'',DATABASE'',USER'',PASSWORD'',SOCKET '../socket.sock');
      

      Leads to:

      CS 11.8.1 33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d (Optimized, UBASAN) Build 15/02/2025

      /test/11.8_opt_san/storage/spider/spd_db_mysql.cc:10727:30: runtime error: member access within null pointer of type 'KEY' (aka 'st_key')
          #0 0x717a24b58750 in spider_mbase_handler::append_key_order_with_alias(spider_string*, char const*, unsigned int) /test/11.8_opt_san/storage/spider/spd_db_mysql.cc:10727:30
          #1 0x717a24a41916 in ha_spider::append_key_order_with_alias_sql_part(char const*, unsigned int, unsigned long) /test/11.8_opt_san/storage/spider/ha_spider.cc:9273:31
          #2 0x717a24a3bb52 in ha_spider::index_read_map_internal(unsigned char*, unsigned char const*, unsigned long, ha_rkey_function) /test/11.8_opt_san/storage/spider/ha_spider.cc:1455:24
          #3 0x5bbad2a20586 in handler::index_read_idx_map(unsigned char*, unsigned int, unsigned char const*, unsigned long, ha_rkey_function) /test/11.8_opt_san/sql/handler.cc:7367:12
          #4 0x5bbad29f8a8b in handler::ha_index_read_idx_map(unsigned char*, unsigned int, unsigned char const*, unsigned long, ha_rkey_function) /test/11.8_opt_san/sql/handler.cc:3869:3
          #5 0x5bbad225370c in insert_server_record(TABLE*, st_federated_server*) /test/11.8_opt_san/sql/sql_servers.cc:721:7
          #6 0x5bbad225370c in insert_server(THD*, st_federated_server*) /test/11.8_opt_san/sql/sql_servers.cc:531:7
          #7 0x5bbad225370c in create_server(THD*, st_lex_server_options*) /test/11.8_opt_san/sql/sql_servers.cc:1213:10
          #8 0x5bbad1c02f48 in mysql_execute_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:5816:10
          #9 0x5bbad1be0600 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_opt_san/sql/sql_parse.cc:7915:18
          #10 0x5bbad1bd78c6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_opt_san/sql/sql_parse.cc:1902:7
          #11 0x5bbad1be28c6 in do_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:1415:17
          #12 0x5bbad2268f5c in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_san/sql/sql_connect.cc:1415:11
          #13 0x5bbad22687b6 in handle_one_connection /test/11.8_opt_san/sql/sql_connect.cc:1327:5
          #14 0x5bbad162499c in asan_thread_start(void*) asan_interceptors.cpp.o
          #15 0x717a8be9ca93 in start_thread nptl/pthread_create.c:447:8
          #16 0x717a8bf29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
      SUMMARY: UndefinedBehaviorSanitizer: null-pointer-use /test/11.8_opt_san/storage/spider/spd_db_mysql.cc:10727:30 
      

      Setup:

      Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18. Ubuntu instructions:
        # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18
           sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev
      Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:
          -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
      Set before execution:
          export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter
      

      SAN Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.5   dbg  150225  c43d0a015f974c5a0142e6779332089a7a979853  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      CS  10.5   opt  150225  c43d0a015f974c5a0142e6779332089a7a979853  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      CS  10.6   dbg  150225  f1d7e0c17e33f77278e6226dd94aeb30fc856bf0  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      CS  10.6   opt  150225  f1d7e0c17e33f77278e6226dd94aeb30fc856bf0  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      CS  10.11  dbg  150225  43c5d1303f5c7c726db276815c459436110f342f  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      CS  10.11  opt  150225  43c5d1303f5c7c726db276815c459436110f342f  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      CS  11.4   dbg  150225  ef966af801afc2a07222b5df65dddd52c77431dd  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      CS  11.4   opt  150225  ef966af801afc2a07222b5df65dddd52c77431dd  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      CS  11.8   dbg  150225  33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      CS  11.8   opt  150225  33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      CS  12.0   dbg  150225  c92add291e636c797e6d6ddca605905541b2a441  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      CS  12.0   opt  150225  c92add291e636c797e6d6ddca605905541b2a441  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      ES  10.5   dbg  140325  6553c62369ab3606efc74295c902181f793fd6d1  UBSAN|load of value X, which is not a valid value for type 'bool'|sql/sql_table.cc|mysql_alter_table|Sql_cmd_alter_table::execute|mysql_execute_command|execute_server_code
      ES  10.5   opt  140325  6553c62369ab3606efc74295c902181f793fd6d1  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      ES  10.6   dbg  140325  a99e9e4101f5d56a379577e6d81c829b7658df99  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      ES  10.6   opt  140325  a99e9e4101f5d56a379577e6d81c829b7658df99  UBSAN|member access within null pointer of type 'struct st_my_thread_var'|storage/spider/spd_table.cc
      ES  11.4   dbg  140325  26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      ES  11.4   opt  140325  26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba  UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/spider/spd_db_mysql.cc|spider_mbase_handler::append_key_order_with_alias|ha_spider::append_key_order_with_alias_sql_part|ha_spider::index_read_map_internal|handler::index_read_idx_map
      

      Testcase is CLI and MTR compatible.

      Attachments

        Issue Links

          Activity

            People

              ycp Yuchen Pei
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.