SIGSEGV in sp_instr_set_ps_placeholder::get_expr_query | sp_lex_instr::get_query, UBSAN member access within null pointer of type 'const sp_assignment_lex'

DELIMITER $$;

CREATE OR REPLACE PROCEDURE proc_461()

BEGIN

  DECLARE c sys_refcursor;

  OPEN c FOR 1 USING fun1_963(); 

  CLOSE c;

END;

$$

DELIMITER ;$$

--ERROR ER_SP_WRONG_NO_OF_ARGS

CALL proc_461 (1,1,1);

--ERROR ER_SP_DOES_NOT_EXIST

CALL proc_296 (11);

SET max_statement_time=0.0001;

SET SESSION wsrep_retry_autocommit=0;

--ERROR ER_STATEMENT_TIMEOUT,ER_SP_DOES_NOT_EXIST,ER_NEED_REPREPARE

CALL proc_461;

--ERROR ER_STATEMENT_TIMEOUT,ER_SP_DOES_NOT_EXIST,ER_NEED_REPREPARE

CALL proc_461;

--ERROR ER_STATEMENT_TIMEOUT,ER_SP_DOES_NOT_EXIST,ER_NEED_REPREPARE

SELECT SLEEP(2);

--ERROR ER_STATEMENT_TIMEOUT,ER_SP_DOES_NOT_EXIST,ER_NEED_REPREPARE

CALL proc_461;

--ERROR ER_STATEMENT_TIMEOUT,ER_SP_DOES_NOT_EXIST,ER_NEED_REPREPARE

CALL proc_461;

--ERROR ER_STATEMENT_TIMEOUT,ER_SP_DOES_NOT_EXIST,ER_NEED_REPREPARE

CALL proc_461;

--ERROR ER_STATEMENT_TIMEOUT,ER_SP_DOES_NOT_EXIST,ER_NEED_REPREPARE

CALL proc_461;

Core was generated by `/test/mtest/MDEV-33830/MD161225-mariadb-12.3.0-linux-x86_64-opt/bin/mariadbd --'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  sp_instr_set_ps_placeholder::get_expr_query (this=0x7fd42802b628)at /test/mtest/MDEV-33830/12.3_opt/sql/sp_instr.h:824

[Current thread is 1 (LWP 1223200)]

(gdb) bt

#0  sp_instr_set_ps_placeholder::get_expr_query (this=0x7fd42802b628)at /test/mtest/MDEV-33830/12.3_opt/sql/sp_instr.h:824

#1  0x00005ac8a89542d6 in sp_lex_instr::get_query (this=0x7fd42802b628, sql_query=0x7fd510257c08)at /test/mtest/MDEV-33830/12.3_opt/sql/sp_instr.cc:717

#2  0x00005ac8a8953a15 in sp_lex_instr::parse_expr (this=this@entry=0x7fd42802b628, thd=thd@entry=0x7fd428000c68, sp=0x7fd428029b90, sp_instr_lex=0x0)at /test/mtest/MDEV-33830/12.3_opt/sql/sp_instr.cc:906

#3  0x00005ac8a8953862 in sp_lex_keeper::validate_lex_and_exec_core (this=0x7fd42802b660, thd=0x7fd428000c68, nextp=0x7fd510257eb4, open_tables=<optimized out>, instr=0x7fd42802b628)at /test/mtest/MDEV-33830/12.3_opt/sql/sp_instr.cc:572

#4  0x00005ac8a86fcf2a in sp_head::execute (this=this@entry=0x7fd428029b90, thd=thd@entry=0x7fd428000c68, merge_da_on_success=true)at /test/mtest/MDEV-33830/12.3_opt/sql/sp_head.cc:1294

#5  0x00005ac8a86fe9c3 in sp_head::execute_procedure (this=0x7fd428029b90, thd=0x7fd428000c68, args=0x7fd428006060)at /test/mtest/MDEV-33830/12.3_opt/sql/sp_head.cc:2331

#6  0x00005ac8a87a86fb in do_execute_sp (thd=thd@entry=0x7fd428000c68, sp=0x7fd42802b628, sp@entry=0x7fd428029b90)at /test/mtest/MDEV-33830/12.3_opt/sql/sql_parse.cc:3056

#7  0x00005ac8a87a83dd in Sql_cmd_call::execute (this=0x7fd4280177a8, thd=0x7fd428000c68)at /test/mtest/MDEV-33830/12.3_opt/sql/sql_parse.cc:3279

#8  0x00005ac8a87a9e29 in mysql_execute_command (thd=thd@entry=0x7fd428000c68, is_called_from_prepared_stmt=false)at /test/mtest/MDEV-33830/12.3_opt/sql/sql_parse.cc:5861

#9  0x00005ac8a87a52e1 in mysql_parse (thd=thd@entry=0x7fd428000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7fd5102594e0)at /test/mtest/MDEV-33830/12.3_opt/sql/sql_parse.cc:7895

#10 0x00005ac8a87a37fc in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7fd428000c68, packet=packet@entry=0x7fd428008a39 "CALL proc_461", packet_length=packet_length@entry=13, blocking=true)at /test/mtest/MDEV-33830/12.3_opt/sql/sql_parse.cc:1878

#11 0x00005ac8a87a56f1 in do_command (thd=thd@entry=0x7fd428000c68, blocking=true) at /test/mtest/MDEV-33830/12.3_opt/sql/sql_parse.cc:1417

#12 0x00005ac8a88d10dd in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5ac8e189ef38, put_in_cache=true)at /test/mtest/MDEV-33830/12.3_opt/sql/sql_connect.cc:1503

#13 0x00005ac8a88d0e9f in handle_one_connection (arg=arg@entry=0x5ac8e189ef38)at /test/mtest/MDEV-33830/12.3_opt/sql/sql_connect.cc:1415

#14 0x00005ac8a8c8abf9 in pfs_spawn_thread (arg=0x5ac8e1841898)at /test/mtest/MDEV-33830/12.3_opt/storage/perfschema/pfs.cc:2198

#15 0x00007fd51269caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#16 0x00007fd512729c6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

/test/mtest/MDEV-33830/12.3_opt_san/sql/sp_instr.h:824:20: runtime error: member call on null pointer of type 'sp_assignment_lex'

2025-12-17 20:25:13 0 [Warning] Aborted connection 8 to db: 'test' user: 'root' host: 'localhost' (KILLED)

    #0 0x58ec1406d09f in sp_instr_set_ps_placeholder::get_expr_query() const /test/mtest/MDEV-33830/12.3_opt_san/sql/sp_instr.h:824:20

    #1 0x58ec1404a6aa in sp_lex_instr::get_query(String*) const /test/mtest/MDEV-33830/12.3_opt_san/sql/sp_instr.cc:717:27

    #2 0x58ec1404668d in sp_lex_instr::parse_expr(THD*, sp_head*, LEX*) /test/mtest/MDEV-33830/12.3_opt_san/sql/sp_instr.cc:906:3

    #3 0x58ec14045855 in sp_lex_keeper::validate_lex_and_exec_core(THD*, unsigned int*, bool, sp_lex_instr*) /test/mtest/MDEV-33830/12.3_opt_san/sql/sp_instr.cc:572:24

    #4 0x58ec12fc57c8 in sp_head::execute(THD*, bool) /test/mtest/MDEV-33830/12.3_opt_san/sql/sp_head.cc:1294:20

    #5 0x58ec12fcfd1f in sp_head::execute_procedure(THD*, List<Item>*) /test/mtest/MDEV-33830/12.3_opt_san/sql/sp_head.cc:2331:5

    #6 0x58ec135db67e in do_execute_sp(THD*, sp_head*) /test/mtest/MDEV-33830/12.3_opt_san/sql/sql_parse.cc:3056:16

    #7 0x58ec135da817 in Sql_cmd_call::execute(THD*) /test/mtest/MDEV-33830/12.3_opt_san/sql/sql_parse.cc:3279:9

    #8 0x58ec135e3e99 in mysql_execute_command(THD*, bool) /test/mtest/MDEV-33830/12.3_opt_san/sql/sql_parse.cc:5861:26

    #9 0x58ec135c60e0 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/mtest/MDEV-33830/12.3_opt_san/sql/sql_parse.cc:7895:18

    #10 0x58ec135bd434 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/mtest/MDEV-33830/12.3_opt_san/sql/sql_parse.cc:1878:7

    #11 0x58ec135c83a6 in do_command(THD*, bool) /test/mtest/MDEV-33830/12.3_opt_san/sql/sql_parse.cc:1417:17

    #12 0x58ec13d2d41c in do_handle_one_connection(CONNECT*, bool) /test/mtest/MDEV-33830/12.3_opt_san/sql/sql_connect.cc:1503:11

    #13 0x58ec13d2cc76 in handle_one_connection /test/mtest/MDEV-33830/12.3_opt_san/sql/sql_connect.cc:1415:5

    #14 0x58ec12415ecc in asan_thread_start(void*) crtstuff.c

    #15 0x75c92089caa3 in start_thread nptl/pthread_create.c:447:8

    #16 0x75c920929c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78