Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36971

Stack smashing in Charset_collation_map_st::insert_or_replace upon SET character_set_collations

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      SET character_set_collations='utf00000000000000000000000000000000000000000=uca1400_latvian_ai_ci';
      

      Leads to:

      CS 11.4.8 8c6cbb336081a5e1ad781df4a9778b61e3b4d73f (Debug) Build 06/06/2025

      2025-06-09 22:40:31 0 [Note] /test/MD060625-mariadb-11.4.8-linux-x86_64-dbg/bin/mariadbd: ready for connections.
      Version: '11.4.8-MariaDB-debug'  socket: '/test/MD060625-mariadb-11.4.8-linux-x86_64-dbg/socket.sock'  port: 10617  MariaDB Server
      *** stack smashing detected ***: terminated
      

      CS 11.4.8 8c6cbb336081a5e1ad781df4a9778b61e3b4d73f (Debug) Build 06/06/2025

      Core was generated by `/test/MD060625-mariadb-11.4.8-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
      Program terminated with signal SIGABRT, Aborted.
      Download failed: Invalid argument.  Continuing without source file ./nptl/./nptl/pthread_kill.c.
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
       
      [Current thread is 1 (LWP 1675728)]
      (gdb) bt
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
      #1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
      #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
      #3  0x00007f5e1c64526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
      #4  0x00007f5e1c6288ff in __GI_abort () at ./stdlib/abort.c:79
      #5  0x00007f5e1c6297b6 in __libc_message_impl (fmt=fmt@entry=0x7f5e1c7ce765 "*** %s ***: terminated\n")at ../sysdeps/posix/libc_fatal.c:132
      #6  0x00007f5e1c736c19 in __GI___fortify_fail (msg=msg@entry=0x7f5e1c7ce77d "stack smashing detected")at ./debug/fortify_fail.c:24
      #7  0x00007f5e1c737ea4 in __stack_chk_fail () at ./debug/stack_chk_fail.c:24
      #8  0x0000555dbb6e2043 in Charset_collation_map_st::insert_or_replace (this=0x7f5d18019f68, cs_name=@0x7f5e0ffb0dd0: {str = 0x7f5d18019d70 "utf", '0' <repeats 41 times>, "=uca1400_latvian_ai_ci", length = 44}, cl_name=@0x7f5e0ffb0dc0: {str = 0x7f5d18019d9d "uca1400_latvian_ai_ci", length = 21}, error_on_conflicting_duplicate=true, utf8_flag=1024)at /test/11.4_dbg/sql/charset_collations.cc:77
      #9  0x0000555dbb6e2108 in Charset_collation_map_st::from_text (this=0x7f5d18019f68, str=@0x7f5e0ffb0e58: {str = 0x7f5d18019d70 "utf", '0' <repeats 41 times>, "=uca1400_latvian_ai_ci", length = 66}, utf8_flag=1024)at /test/11.4_dbg/sql/charset_collations.cc:106
      #10 0x0000555dbb62e8fc in Sys_var_charset_collation_map::charset_collation_map_from_item (map=0x7f5d18019f68, item=0x7f5d18019db8, utf8_flag=1024)at /test/11.4_dbg/sql/sys_vars.inl:2990
      #11 0x0000555dbb62e5f2 in Sys_var_charset_collation_map::do_check (this=0x555dbc4dd668 <Sys_character_set_collations>, thd=0x7f5d18000d58, var=0x7f5d18019f18) at /test/11.4_dbg/sql/sys_vars.inl:3009
      #12 0x0000555dbb1eae18 in sys_var::check (this=0x555dbc4dd668 <Sys_character_set_collations>, thd=0x7f5d18000d58, var=0x7f5d18019f18) at /test/11.4_dbg/sql/set_var.cc:249
      #13 0x0000555dbb1ecca8 in set_var::check (this=0x7f5d18019f18, thd=0x7f5d18000d58) at /test/11.4_dbg/sql/set_var.cc:803
      #14 0x0000555dbb1ec900 in sql_set_variables (thd=0x7f5d18000d58, var_list=0x7f5d18005fa0, free=true) at /test/11.4_dbg/sql/set_var.cc:730
      #15 0x0000555dbb3e0281 in mysql_execute_command (thd=0x7f5d18000d58, is_called_from_prepared_stmt=false) at /test/11.4_dbg/sql/sql_parse.cc:4880
      #16 0x0000555dbb3d3f84 in mysql_parse (thd=0x7f5d18000d58, rawbuf=0x7f5d18019c40 "SET character_set_collations='utf", '0' <repeats 41 times>, "=uca1400_latvian_ai_ci'", length=97, parser_state=0x7f5e0ffb2a30)at /test/11.4_dbg/sql/sql_parse.cc:7898
      #17 0x0000555dbb3d1434 in dispatch_command (command=COM_QUERY, thd=0x7f5d18000d58, packet=0x7f5d1800afd9 "SET character_set_collations='utf", '0' <repeats 41 times>, "=uca1400_latvian_ai_ci'", packet_length=97, blocking=true)at /test/11.4_dbg/sql/sql_parse.cc:1904
      #18 0x0000555dbb3d4b33 in do_command (thd=0x7f5d18000d58, blocking=true)at /test/11.4_dbg/sql/sql_parse.cc:1417
      #19 0x0000555dbb5e5a89 in do_handle_one_connection (connect=0x555dbf3ec4e8, put_in_cache=true) at /test/11.4_dbg/sql/sql_connect.cc:1408
      #20 0x0000555dbb5e5822 in handle_one_connection (arg=0x555dbf2d80a8)at /test/11.4_dbg/sql/sql_connect.cc:1320
      #21 0x00007f5e1c69ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #22 0x00007f5e1c729c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.6   dbg  060625  643319a7fb1e273797c2a1e46d76cfac0fa1da8f  No bug found                  
      CS  10.6   opt  060625  643319a7fb1e273797c2a1e46d76cfac0fa1da8f  No bug found                  
      CS  10.11  dbg  060625  11d1ac7285221ab4df7d9ef7cc8ee949b01c9b32  No bug found                  
      CS  10.11  opt  060625  11d1ac7285221ab4df7d9ef7cc8ee949b01c9b32  No bug found                  
      CS  11.4   dbg  060625  8c6cbb336081a5e1ad781df4a9778b61e3b4d73f  SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|Charset_collation_map_st::insert_or_replace
      CS  11.4   opt  060625  8c6cbb336081a5e1ad781df4a9778b61e3b4d73f  No bug found                  
      CS  11.8   dbg  060625  67e6fdee05ead4974fe632e91c38941ade369b0c  SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|Charset_collation_map_st::insert_or_replace
      CS  11.8   opt  060625  67e6fdee05ead4974fe632e91c38941ade369b0c  No bug found                  
      CS  12.0   dbg  060625  f1102da37a3dcdc8b92e0205f0a8bd878704b168  SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|Charset_collation_map_st::insert_or_replace
      CS  12.0   opt  060625  f1102da37a3dcdc8b92e0205f0a8bd878704b168  No bug found                  
      CS  12.1   dbg  060625  4b79d7b8ee557d53a859aedec839b8673585b514  SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|Charset_collation_map_st::insert_or_replace
      CS  12.1   opt  060625  4b79d7b8ee557d53a859aedec839b8673585b514  No bug found                  
      ES  10.5   dbg  060625  ec7bc4f84e490b25f52db7422a1e0e8bbea72fb1  No bug found                  
      ES  10.5   opt  060625  ec7bc4f84e490b25f52db7422a1e0e8bbea72fb1  No bug found                  
      ES  10.6   dbg  060625  8541ea1e4c2fa15789dd162f6ba4b32681f74e61  No bug found                  
      ES  10.6   opt  060625  8541ea1e4c2fa15789dd162f6ba4b32681f74e61  No bug found                  
      ES  11.4   dbg  060625  1c8b2d3059f5ccb67c042868baca3ee269c6eca7  SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|Charset_collation_map_st::insert_or_replace
      ES  11.4   opt  060625  1c8b2d3059f5ccb67c042868baca3ee269c6eca7  No bug found                  
      MS  5.5    dbg  070123  bac287c315b1792e7ae33f91add6a60292f9bae8  No bug found                  
      MS  5.5    opt  070123  bac287c315b1792e7ae33f91add6a60292f9bae8  No bug found                  
      MS  5.6    dbg  070123  dab95781a1244104d6b87020ac2fc4d190ba2946  No bug found                  
      MS  5.6    opt  070123  dab95781a1244104d6b87020ac2fc4d190ba2946  No bug found                  
      MS  5.7    dbg  070525  f7680e98b6bbe3500399fbad465d08a6b75d7a5c  No bug found                  
      MS  5.7    opt  070525  f7680e98b6bbe3500399fbad465d08a6b75d7a5c  No bug found                  
      MS  8.0    dbg  060224  49ef33f7edadef3ae04665e73d1babd40179a4f1  No bug found                  
      MS  8.0    opt  060224  49ef33f7edadef3ae04665e73d1babd40179a4f1  No bug found                  
      MS  9.1    dbg  211024  61a3a1d8ef15512396b4c2af46e922a19bf2b174  No bug found                  
      MS  9.1    opt  211024  61a3a1d8ef15512396b4c2af46e922a19bf2b174  No bug found                  
      

      Attachments

        Activity

          People

            bar Alexander Barkov
            Roel Roel Van de Paar
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.