Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
11.8, 12.3, 13.0, 13.1
-
Q4/2026 Server Maintenance
Description
Reproducible on a MemorySanitizer (MSAN) instrumented build. A SELECT ... GROUP BY over a temporary InnoDB table holding a VECTOR column reads uninitialized memory in Field_vector::store. The uninitialized bytes originate in InnoDB when the row is read back into MariaDB row format (row_sel_field_store_in_mysql_format_func marks the unused tail of the VECTOR field via __msan_allocated_memory), and Field::save_in_field_str -> Field_vector::store then reads the full declared field length, including that poisoned tail, while writing the aggregation result row in end_update.
CREATE TEMPORARY TABLE t ENGINE=InnoDB AS SELECT VEC_FROMTEXT('0') c FROM (SELECT 1) x WHERE 0; |
INSERT IGNORE INTO t VALUES (1); |
UPDATE t SET c=1; |
SELECT c,COUNT(*) FROM t GROUP BY c; |
Leads to:
|
CS 12.3.3 f9d797f1ccb8bbdbad0b50005644f29cd6125a6c (Debug, MSAN, Clang 20.1.8-20250804) Build 16/07/2026 |
==1632547==WARNING: MemorySanitizer: use-of-uninitialized-value
|
#0 0x555557b6220c in Field_vector::store(char const*, unsigned long, charset_info_st const*) sql/sql_type_vector.cc:335:9
|
#1 0x555556952e14 in Field::save_in_field_str(Field*) sql/field.h:768:16
|
#2 0x55555754722d in end_update(JOIN*, st_join_table*, bool) sql/sql_select.cc:26316:11
|
#3 0x55555754f305 in evaluate_join_record(JOIN*, st_join_table*, int) sql/sql_select.cc:24828:11
|
#4 0x55555745dc4c in sub_select(JOIN*, st_join_table*, bool) sql/sql_select.cc:24595:9
|
#5 0x5555574d9a0a in do_select(JOIN*, Procedure*) sql/sql_select.cc:24106:14
|
#6 0x5555574d78a8 in JOIN::exec_inner() sql/sql_select.cc:5125:50
|
#7 0x5555574d57e3 in JOIN::exec() sql/sql_select.cc:4913:8
|
#8 0x55555745fa3a in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) sql/sql_select.cc:5439:21
|
#9 0x55555745f00c in handle_select(THD*, LEX*, select_result*, unsigned long long) sql/sql_select.cc:636:10
|
#10 0x555557396807 in execute_sqlcom_select(THD*, TABLE_LIST*) sql/sql_parse.cc:6219:12
|
#11 0x5555573873d6 in mysql_execute_command(THD*, bool) sql/sql_parse.cc:3992:12
|
#12 0x55555737b5a2 in mysql_parse(THD*, char*, unsigned int, Parser_state*) sql/sql_parse.cc:7947:18
|
#13 0x555557374d87 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) sql/sql_parse.cc:1903:7
|
#14 0x55555737c05e in do_command(THD*, bool) sql/sql_parse.cc:1437:17
|
#15 0x555557896b8c in do_handle_one_connection(CONNECT*, bool) sql/sql_connect.cc:1510:11
|
#16 0x555557896522 in handle_one_connection sql/sql_connect.cc:1422:5
|
#17 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
|
#18 0x7fffe6929c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Memory was marked as uninitialized
|
#0 0x5555567566a1 in __msan_allocated_memory
|
#1 0x55555872de69 in row_sel_field_store_in_mysql_format_func(unsigned char*, mysql_row_templ_t const*, dict_index_t const*, unsigned long, unsigned char const*, unsigned long) storage/innobase/row/row0sel.cc:2812:2
|
|
|
SUMMARY: MemorySanitizer: use-of-uninitialized-value sql/sql_type_vector.cc:335:9 in Field_vector::store(char const*, unsigned long, charset_info_st const*)
|
|
SAN Bug Detection Matrix |
MariaDB Community Server (CS):
|
11.8.9 bf58d4cb5fccd4078ec91c065a2de86be3b46281 (Debug, MSAN) use-of-uninitialized-value in Field_vector::store
|
12.3.3 f9d797f1ccb8bbdbad0b50005644f29cd6125a6c (Debug, MSAN) use-of-uninitialized-value in Field_vector::store
|
13.0.2 84c246ca5387c0611f75097136ff4f4bea092aa3 (Debug, MSAN) use-of-uninitialized-value in Field_vector::store
|
13.1.0 7322a6656a5357b4574b7413493c76ba2fc41f84 (Debug, MSAN) use-of-uninitialized-value in Field_vector::store
|
MariaDB Enterprise Server (ES):
|
11.8.9-6 4694e931d10fecf733c34f83ea2146d31b708eb3 (Debug, MSAN) use-of-uninitialized-value in Field_vector::store
|
12.3.2-1 9d8abb61e913bec023cd8caeccad4b42717151cb (Debug, MSAN) use-of-uninitialized-value in Field_vector::store
|
Not affected: 10.6, 10.11, 11.4 (the VECTOR datatype does not exist; introduced in 11.7)
|
Testcase is CLI only. It reproduces reliably under the standalone server, but does not reproduce under mariadb-test-run.pl (8 of 8 attempts clean); the uninitialized read is sensitive to the server bootstrap and InnoDB environment. Under the default (strict) sql_mode the UPDATE fails with ER_ILLEGAL_PARAMETER_DATA_TYPES2_FOR_OPERATION (4078), which is expected and is part of the repro; the crash occurs on the subsequent SELECT.
Attachments
Issue Links
- relates to
-
-
- Closed
-
-
-
- Closed
-
