Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-38001

NULL dereference in Trigger_creation_ctx::create()

    XMLWordPrintable

Details

    • Bug
    • Status: In Testing (View Workflow)
    • Major
    • Resolution: Unresolved
    • 10.6, 10.11, 11.4, 12.2, 11.8
    • 10.6, 10.11, 11.4, 11.8
    • None
    • None

    Description

      The following script:

      CREATE TABLE t1 (a INT);
      INSERT INTO t1 VALUES (1);
       
      let $MYSQLD_DATADIR=`SELECT @@datadir`;
       
      --write_file $MYSQLD_DATADIR/test/t1.TRG
      TYPE=TRIGGERS
      triggers=''
      client_cs_names=''
      EOF
       
      SHOW TRIGGERS LIKE 't1';
      

      leads to:

      [Warning] Trigger for table 'test'.'t1': invalid character_set_client value ().
      /src/mariadb/sql/sql_trigger.cc:135:45: runtime error: member access within null pointer of type 'const struct LEX_CSTRING'
      

      with the following stacktrace:

      #0  __pthread_kill_implementation (threadid=<optimized out>, signo=11, no_tid=0) at ./nptl/pthread_kill.c:44
      #1  __pthread_kill_internal (threadid=<optimized out>, signo=11) at ./nptl/pthread_kill.c:89
      #2  __GI___pthread_kill (threadid=<optimized out>, signo=11) at ./nptl/pthread_kill.c:100
      #3  0x0000611111d4fb5f in my_write_core (sig=11) at /src/mariadb/mysys/stacktrace.c:424
      #4  0x000061110eab97ba in handle_fatal_signal (sig=11) at /src/mariadb/sql/signal_handler.cc:298
      #5  <signal handler called>
      #6  0x000061110d6b7679 in Trigger_creation_ctx::create (thd=0x7e72030a0218, db_name=0x7e82030dfd28 "test", table_name=0x7e82030e04a0 "t1", client_cs_name=0x7dc2031c9100, connection_cl_name=0x0, db_cl_name=0x0) at /src/mariadb/sql/sql_trigger.cc:135
      #7  0x000061110d6cee77 in Table_triggers_list::check_n_load (thd=0x7e72030a0218, db=0x7e82030dfcf0, table_name=0x7e82030e0490, table=0x7bb1f2eca3a0, names_only=true) at /src/mariadb/sql/sql_trigger.cc:1815
      #8  0x000061110d40275e in fill_schema_table_from_frm (thd=0x7e72030a0218, mem_root=0x7bb1f2dbc1c0, table=0x7e8203300438, schema_table=0x61111860b4d0 <schema_tables+3312>, db_name=0x7e82030dfcf0, table_name=0x7e82030e0490, open_tables_state_backup=0x7bb1f2dbc220, can_deadlock=false) at /src/mariadb/sql/sql_show.cc:5267
      #9  0x000061110d40a79b in get_all_tables (thd=0x7e72030a0218, tables=0x7e82030dba78, cond=0x0) at /src/mariadb/sql/sql_show.cc:5703
      #10 0x000061110d4b54ce in get_schema_tables_result (join=0x7e82030dcee0, executed_place=PROCESSED_BY_JOIN_EXEC) at /src/mariadb/sql/sql_show.cc:9876
      #11 0x000061110d103496 in JOIN::exec_inner (this=0x7e82030dcee0) at /src/mariadb/sql/sql_select.cc:5050
      #12 0x000061110d0fd1a9 in JOIN::exec (this=0x7e82030dcee0) at /src/mariadb/sql/sql_select.cc:4877
      #13 0x000061110d10963b in mysql_select (thd=0x7e72030a0218, tables=0x7e82030dba78, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2701396736, result=0x7e82030dceb0, unit=0x7e72030a4830, select_lex=0x7e72030a5098) at /src/mariadb/sql/sql_select.cc:5405
      #14 0x000061110d07fc89 in handle_select (thd=0x7e72030a0218, lex=0x7e72030a4750, result=0x7e82030dceb0, setup_tables_done_option=0) at /src/mariadb/sql/sql_select.cc:635
      #15 0x000061110ce5ae9c in execute_sqlcom_select (thd=0x7e72030a0218, all_tables=0x7e82030dba78) at /src/mariadb/sql/sql_parse.cc:6171
      #16 0x000061110ce293c7 in mysql_execute_command (thd=0x7e72030a0218, is_called_from_prepared_stmt=false) at /src/mariadb/sql/sql_parse.cc:3951
      #17 0x000061110ce7a420 in mysql_parse (thd=0x7e72030a0218, rawbuf=0x7e82030da438 "SHOW TRIGGERS LIKE 't1'", length=23, parser_state=0x7bb1f2ebc170) at /src/mariadb/sql/sql_parse.cc:7887
      #18 0x000061110cdf6bfa in dispatch_command (command=COM_QUERY, thd=0x7e72030a0218, packet=0x7e4203292219 "SHOW TRIGGERS LIKE 't1'", packet_length=23, blocking=true) at /src/mariadb/sql/sql_parse.cc:1878
      #19 0x000061110cdeac58 in do_command (thd=0x7e72030a0218, blocking=true) at /src/mariadb/sql/sql_parse.cc:1417
      #20 0x000061110dae4639 in do_handle_one_connection (connect=0x7c3202fe45b8, put_in_cache=true) at /src/mariadb/sql/sql_connect.cc:1503
      #21 0x000061110dae36c8 in handle_one_connection (arg=0x7c3202fe4538) at /src/mariadb/sql/sql_connect.cc:1415
      #22 0x00006111102ae06e in pfs_spawn_thread (arg=0x7d2202fe7098) at /src/mariadb/storage/perfschema/pfs.cc:2198
      #23 0x00007fb20585f803 in asan_thread_start (arg=0x7bb1f3dac000) at ../../../../src/libsanitizer/asan/asan_interceptors.cpp:239
      #24 0x00007fb203ea3d64 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:448
      #25 0x00007fb203f373bc in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Reproduced on main(049ee29e7e).

      Attachments

        Activity

          People

            serg Sergei Golubchik
            qobood Vasilii Lakhin
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.