Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40099

use-of-uninitialized-value in int TABLE::delete_row<true>(bool)

    XMLWordPrintable

Details

    • Can result in hang or crash
    • Q3/2026 Server Maintenance

    Description

      SET sql_mode='';
      CREATE TABLE t1 (c1 INT KEY) ENGINE=MyISAM WITH SYSTEM VERSIONING;
      INSERT INTO t1 () VALUES ();
      REPLACE DELAYED INTO t1 () VALUES ();
      

      Leads to:

      CS 10.11.19 b1e62d5e530243456338e44be064952a53062fd5 (Debug, MSAN, Clang 20.1.8-20250804) Build 17/06/2026

      ==2309356==WARNING: MemorySanitizer: use-of-uninitialized-value
          #0 0x555556f2e0d9 in int TABLE::delete_row<true>(bool) /test/10.11_dbg_san/sql/sql_delete.cc:315:20
          #1 0x555556f59b84 in Write_record::replace_row(unsigned long long*, unsigned long long*) /test/10.11_dbg_san/sql/sql_insert.cc:2140:21
          #2 0x555556f55a91 in Write_record::write_record() /test/10.11_dbg_san/sql/sql_insert.cc:2368:10
          #3 0x555556f64a67 in Delayed_insert::handle_inserts() /test/10.11_dbg_san/sql/sql_insert.cc:3930:9
          #4 0x555556f6152b in handle_delayed_insert /test/10.11_dbg_san/sql/sql_insert.cc:3657:17
          #5 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
          #6 0x7fffe6929c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
        Memory was marked as uninitialized
          #0 0x5555565480f1 in __msan_allocated_memory (/test/MSAN_MD170626-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd+0xff40f1) (BuildId: df368211d1c6a9c617d3cc647af18454d241e514)
          #1 0x555558544d31 in my_malloc /test/10.11_dbg_san/mysys/my_malloc.c:116:7
       
      SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/10.11_dbg_san/sql/sql_delete.cc:315:20 in int TABLE::delete_row<true>(bool)
      Exiting
      260618  3:29:35 [ERROR] /test/MSAN_MD170626-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd got signal 6 ;
      Sorry, we probably made a mistake, and this is a bug.
       
      Your assistance in bug reporting will enable us to fix this for the next release.
      To report this bug, see https://mariadb.com/docs/general-resources/community/community/bug-tracking/reporting-bugs about how to report
      a bug on https://jira.mariadb.org/.
       
      Please include the information from the server start above, to the end of the
      information below.
       
      Server version: 10.11.19-MariaDB-debug source revision: b1e62d5e530243456338e44be064952a53062fd5
       
      The information page at https://mariadb.com/docs/server/reference/product-development/mariadb-fault-finding/how-to-produce-a-full-stack-trace-for-mariadbdcontains instructions to obtain a better version of the backtrace below.
      Following these instructions will help MariaDB developers provide a fix quicker.
       
      Attempting backtrace. Include this in the bug report.
      (note: Retrieving this information may fail)
       
      Thread pointer: 0x72c000040038
      stack_bottom = 0x7fff1b8fc000 thread_stack 0x200000
      /test/MSAN_MD170626-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd(___interceptor_backtrace+0xd6)[0x555556564006]
      mysys/stacktrace.c:215(my_print_stacktrace)[0x55555854fb85]
      sql/signal_handler.cc:0(handle_fatal_signal)[0x555556b14a10]
      crtstuff.c:0(SignalHandler(int))[0x555556597dbd]
      libc_sigaction.c:0(__restore_rt)[0x7fffe6845330]
      nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x7fffe689eb2c]
      posix/raise.c:27(__GI_raise)[0x7fffe684527e]
      stdlib/abort.c:81(__GI_abort)[0x7fffe68288ff]
      2026-06-18  3:29:38 0 [Note] /test/MSAN_MD170626-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd (initiated by: unknown): Normal shutdown
      crtstuff.c:0(__sanitizer::Atexit(void (*)()))[0x5555565218f0]
      crtstuff.c:0(__sanitizer::Die())[0x55555651f662]
      /test/MSAN_MD170626-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd(+0xfe2fe7)[0x555556536fe7]
      sql/sql_delete.cc:314(int TABLE::delete_row<true>(bool))[0x555556f2e0da]
      sql/sql_insert.cc:2142(Write_record::replace_row(unsigned long long*, unsigned long long*))[0x555556f59b85]
      sql/sql_insert.cc:2369(Write_record::write_record())[0x555556f55a92]
      sql/sql_insert.cc:3930(Delayed_insert::handle_inserts())[0x555556f64a68]
      sql/sql_insert.cc:0(handle_delayed_insert)[0x555556f6152c]
      nptl/pthread_create.c:447(start_thread)[0x7fffe689caa4]
      x86_64/clone3.S:80(clone3)[0x7fffe6929c6c]
      
      

      Attachments

        Activity

          People

            raghunandan.bhat Raghunandan Bhat
            saahil Saahil Alam
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - 3d Original Estimate - 3d
                3d
                Remaining:
                Time Spent - 1.5h Remaining Estimate - 3d
                3d
                Logged:
                Time Spent - 1.5h Remaining Estimate - 3d
                1.5h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.