[MDEV-40385] use-of-uninitialized-value in Binary_string::c_ptr() - Jira

XML

Word

Printable

Details

Type: Bug
Status: Open (View Workflow)
Priority: Critical
Resolution: Unresolved
Affects Version/s: 11.4, 11.8, 12.3, 13.0, 13.1
Fix Version/s: 11.4, 11.8, 12.3, 13.0
Component/s: Server
Labels:

Bug Category:
Can result in hang or crash

Description

SELECT KDF('','',1000,256);

Leads to:

CS 13.0.2 172609526b93ac278203607274b70e6b6d8e67fd (Debug, MSAN, Clang 20.1.8-20250804) Build 07/07/2026
==1756545==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x555556a888bc in Binary_string::c_ptr() /test/13.0_dbg_msan/sql/sql_string.h:685:9
#1 0x555556a888bc in Item_func_kdf::val_str(String*) /test/13.0_dbg_msan/sql/item_strfunc.cc:487:25
#2 0x555557b4d32a in Type_handler::Item_send_str(Item, Protocol, st_value*) const /test/13.0_dbg_msan/sql/sql_type.cc:7678:19
#3 0x555556ec89da in Protocol::send_result_set_row(List<Item>*) /test/13.0_dbg_msan/sql/protocol.cc:1358:15
#4 0x5555570bfd92 in select_send::send_data(List<Item>&) /test/13.0_dbg_msan/sql/sql_class.cc:3411:17
#5 0x5555570bf718 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/13.0_dbg_msan/sql/sql_class.cc:3309:11
#6 0x5555574e8ae5 in JOIN::exec_inner() /test/13.0_dbg_msan/sql/sql_select.cc:4996:22
#7 0x5555574e67c3 in JOIN::exec() /test/13.0_dbg_msan/sql/sql_select.cc:4913:8
#8 0x55555747097a in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/13.0_dbg_msan/sql/sql_select.cc:5439:21
#9 0x55555746ff4c in handle_select(THD, LEX, select_result*, unsigned long long) /test/13.0_dbg_msan/sql/sql_select.cc:636:10
#10 0x5555573a7071 in execute_sqlcom_select(THD, TABLE_LIST) /test/13.0_dbg_msan/sql/sql_parse.cc:6217:12
#11 0x555557397af6 in mysql_execute_command(THD*, bool) /test/13.0_dbg_msan/sql/sql_parse.cc:3991:12
#12 0x55555738bc82 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/13.0_dbg_msan/sql/sql_parse.cc:7945:18
#13 0x555557385467 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/13.0_dbg_msan/sql/sql_parse.cc:1903:7
#14 0x55555738c73e in do_command(THD*, bool) /test/13.0_dbg_msan/sql/sql_parse.cc:1437:17
#15 0x5555578ad43c in do_handle_one_connection(CONNECT*, bool) /test/13.0_dbg_msan/sql/sql_connect.cc:1510:11
#16 0x5555578acdd2 in handle_one_connection /test/13.0_dbg_msan/sql/sql_connect.cc:1422:5
#17 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
#18 0x7fffe6929c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Uninitialized value was created by an allocation of 'value_buffer' in the stack frame
#0 0x555556ec8745 in Protocol::send_result_set_row(List<Item>*) /test/13.0_dbg_msan/sql/protocol.cc:1352:3

SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/13.0_dbg_msan/sql/sql_string.h:685:9 in Binary_string::c_ptr()

Setup:

Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:

    -DWITH_MSAN=ON  # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)

Set before execution:

    export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0

MSAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 070726 736edbe77ce5db44ea38347280f77d6a304fa3ae No bug found
CS 10.6 opt 070726 736edbe77ce5db44ea38347280f77d6a304fa3ae No bug found
CS 10.11 dbg 070726 2be9ba2537aa3ff5836b21489cfca6b0f0ccf80a No bug found
CS 10.11 opt 070726 2be9ba2537aa3ff5836b21489cfca6b0f0ccf80a No bug found
CS 11.4 dbg 090726 176589bf19ea6e2261bb3ef57886c13b9c0b6759 MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row
CS 11.4 opt 090726 176589bf19ea6e2261bb3ef57886c13b9c0b6759 MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row
CS 11.8 dbg 070726 666b2aca09cb84d59b4ece2185a9200d745cb287 MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row
CS 11.8 opt 070726 666b2aca09cb84d59b4ece2185a9200d745cb287 MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row
CS 12.3 dbg 070726 8da34620ac3935814cc7f9ba30bb51a6e2070237 MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row
CS 12.3 opt 070726 8da34620ac3935814cc7f9ba30bb51a6e2070237 MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row
CS 13.0 dbg 070726 172609526b93ac278203607274b70e6b6d8e67fd MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row
CS 13.0 opt 070726 172609526b93ac278203607274b70e6b6d8e67fd MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row
CS 13.1 dbg 070726 fd8cec54af7a9d79749df25ea70dac695b371641 MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row
CS 13.1 opt 070726 fd8cec54af7a9d79749df25ea70dac695b371641 MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row
ES 10.6 dbg 070726 07b87fa33b7263c3b46b1a820474f88803d25a04 No bug found
ES 10.6 opt 070726 07b87fa33b7263c3b46b1a820474f88803d25a04 No bug found
ES 11.4 dbg 070726 89bb238190d313ead3b68e508099974e3728515e MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row
ES 11.4 opt 070726 89bb238190d313ead3b68e508099974e3728515e MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row
ES 11.8 dbg 070726 97386db1d887891fb17e5210536bfe8756bae3cf MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row
ES 11.8 opt 070726 97386db1d887891fb17e5210536bfe8756bae3cf MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row
ES 12.3 dbg 070726 b96de078339ebc1995fd6185bf5433c72fedbdaf MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row
ES 12.3 opt 070726 b96de078339ebc1995fd6185bf5433c72fedbdaf MSAN\|use-of-uninitialized-value\|sql/sql_string.h\|Binary_string::c_ptr\|Item_func_kdf::val_str\|Type_handler::Item_send_str\|Protocol::send_result_set_row

Attachments

Activity

People

Assignee:: Oleksandr Byelkin

Reporter:: Saahil Alam

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Dates

Created:: 2 days ago 07:00

Updated:: 2 days ago 07:00

Time Tracking

Estimated:

Not Specified

Remaining:

Logged:

0.25d

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.