Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40422

use-of-uninitialized-value in my_convert

    XMLWordPrintable

Details

    • Can result in hang or crash
    • Q4/2026 Server Maintenance

    Description

      ALTER DATABASE test DEFAULT CHARACTER SET latin1;
      SET CHARACTER SET DEFAULT;
      SELECT CAST(MD5 (NOW()) AS CHAR),COUNT(*);
      

      Leads to:

      CS 13.0.2 84c246ca5387c0611f75097136ff4f4bea092aa3 (Debug, MSAN, Clang 20.1.8-20250804) Build 16/07/2026

      ==2537244==WARNING: MemorySanitizer: use-of-uninitialized-value
          #0 0x555558b622e6 in my_convert /test/13.0_dbg_msan/strings/ctype.c:1254:11
          #1 0x555556ec0a05 in copy_and_convert(char*, unsigned long, charset_info_st const*, char const*, unsigned long, charset_info_st const*, unsigned int*) /test/13.0_dbg_msan/sql/sql_string.h:53:10
          #2 0x555556ec0a05 in Protocol::net_store_data_cs(unsigned char const*, unsigned long, charset_info_st const*, charset_info_st const*) /test/13.0_dbg_msan/sql/protocol.cc:114:8
          #3 0x555556ec89da in Protocol::send_result_set_row(List<Item>*) /test/13.0_dbg_msan/sql/protocol.cc:1358:15
          #4 0x5555570bfd92 in select_send::send_data(List<Item>&) /test/13.0_dbg_msan/sql/sql_class.cc:3411:17
          #5 0x5555570bf718 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/13.0_dbg_msan/sql/sql_class.cc:3309:11
          #6 0x555557560a88 in end_send_group(JOIN*, st_join_table*, bool) /test/13.0_dbg_msan/sql/sql_select.cc:26266:29
          #7 0x5555574eaca3 in do_select(JOIN*, Procedure*) /test/13.0_dbg_msan/sql/sql_select.cc:24178:16
          #8 0x5555574e8888 in JOIN::exec_inner() /test/13.0_dbg_msan/sql/sql_select.cc:5125:50
          #9 0x5555574e67c3 in JOIN::exec() /test/13.0_dbg_msan/sql/sql_select.cc:4913:8
          #10 0x55555747097a in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/13.0_dbg_msan/sql/sql_select.cc:5439:21
          #11 0x55555746ff4c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/13.0_dbg_msan/sql/sql_select.cc:636:10
          #12 0x5555573a7071 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/13.0_dbg_msan/sql/sql_parse.cc:6217:12
          #13 0x555557397af6 in mysql_execute_command(THD*, bool) /test/13.0_dbg_msan/sql/sql_parse.cc:3991:12
          #14 0x55555738bc82 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.0_dbg_msan/sql/sql_parse.cc:7945:18
          #15 0x555557385467 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.0_dbg_msan/sql/sql_parse.cc:1903:7
          #16 0x55555738c73e in do_command(THD*, bool) /test/13.0_dbg_msan/sql/sql_parse.cc:1437:17
          #17 0x5555578ad43c in do_handle_one_connection(CONNECT*, bool) /test/13.0_dbg_msan/sql/sql_connect.cc:1510:11
          #18 0x5555578acdd2 in handle_one_connection /test/13.0_dbg_msan/sql/sql_connect.cc:1422:5
          #19 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
          #20 0x7fffe6929c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
        Uninitialized value was stored to memory at
          #0 0x55555675543f in __msan_memmove (/test/MSAN_MD160726-mariadb-13.0.2-linux-x86_64-dbg/bin/mariadbd+0x120143f) (BuildId: cbd247a7c6c29113b29ae49befea3721a8d8acf5)
          #1 0x55555768516c in Binary_string::copy(Binary_string const&) /test/13.0_dbg_msan/sql/sql_string.cc:257:5
       
        Uninitialized value was created by a heap deallocation
          #0 0x555556755aa4 in free (/test/MSAN_MD160726-mariadb-13.0.2-linux-x86_64-dbg/bin/mariadbd+0x1201aa4) (BuildId: cbd247a7c6c29113b29ae49befea3721a8d8acf5)
          #1 0x555557682db6 in Binary_string::free_buffer() /test/13.0_dbg_msan/sql/sql_string.h:266:7
          #2 0x555557682db6 in Binary_string::real_alloc(unsigned long) /test/13.0_dbg_msan/sql/sql_string.cc:40:5
       
      SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/13.0_dbg_msan/strings/ctype.c:1254:11 in my_convert
      

      Setup:

      Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
        # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18
           sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
      Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:
          -DWITH_MSAN=ON  # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)
      Set before execution:
          export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0
      

      MSAN Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.6   dbg  170726  85ab366da3fc5d13b61d9e491e63e2b62c017cf4  MSAN|use-of-uninitialized-value|include/mysql/psi/mysql_socket.h|inline_mysql_socket_send|vio_write|net_real_write|net_flush
      CS  10.6   opt  170726  85ab366da3fc5d13b61d9e491e63e2b62c017cf4  MSAN|use-of-uninitialized-value|include/mysql/psi/mysql_socket.h|inline_mysql_socket_send|vio_write|net_real_write|net_flush
      CS  10.11  dbg  170726  50faece416f0642b57a515d546f20cefd9062379  MSAN|use-of-uninitialized-value|include/mysql/psi/mysql_socket.h|inline_mysql_socket_send|vio_write|net_real_write|net_flush
      CS  10.11  opt  170726  50faece416f0642b57a515d546f20cefd9062379  MSAN|use-of-uninitialized-value|include/mysql/psi/mysql_socket.h|inline_mysql_socket_send|vio_write|net_real_write|net_flush
      CS  11.8   dbg  170726  bf58d4cb5fccd4078ec91c065a2de86be3b46281  MSAN|use-of-uninitialized-value|strings/ctype.c|my_convert|copy_and_convert|Protocol::net_store_data_cs|Protocol::send_result_set_row
      CS  11.8   opt  170726  bf58d4cb5fccd4078ec91c065a2de86be3b46281  MSAN|use-of-uninitialized-value|strings/ctype.c|my_convert|copy_and_convert|Protocol::net_store_data_cs|Protocol::send_result_set_row
      CS  12.3   dbg  160726  f9d797f1ccb8bbdbad0b50005644f29cd6125a6c  MSAN|use-of-uninitialized-value|strings/ctype.c|my_convert|copy_and_convert|Protocol::net_store_data_cs|Protocol::send_result_set_row
      CS  12.3   opt  160726  f9d797f1ccb8bbdbad0b50005644f29cd6125a6c  MSAN|use-of-uninitialized-value|strings/ctype.c|my_convert|copy_and_convert|Protocol::net_store_data_cs|Protocol::send_result_set_row
      CS  13.0   dbg  160726  84c246ca5387c0611f75097136ff4f4bea092aa3  MSAN|use-of-uninitialized-value|strings/ctype.c|my_convert|copy_and_convert|Protocol::net_store_data_cs|Protocol::send_result_set_row
      CS  13.0   opt  160726  84c246ca5387c0611f75097136ff4f4bea092aa3  MSAN|use-of-uninitialized-value|strings/ctype.c|my_convert|copy_and_convert|Protocol::net_store_data_cs|Protocol::send_result_set_row
      CS  13.1   dbg  160726  7322a6656a5357b4574b7413493c76ba2fc41f84  MSAN|use-of-uninitialized-value|strings/ctype.c|my_convert|copy_and_convert|Protocol::net_store_data_cs|Protocol::send_result_set_row
      CS  13.1   opt  160726  7322a6656a5357b4574b7413493c76ba2fc41f84  MSAN|use-of-uninitialized-value|strings/ctype.c|my_convert|copy_and_convert|Protocol::net_store_data_cs|Protocol::send_result_set_row
      ES  10.6   dbg  170726  fcecb2620f25965723d640decede7c018bcb1dcc  MSAN|use-of-uninitialized-value|include/mysql/psi/mysql_socket.h|inline_mysql_socket_send|vio_write|net_real_write|net_flush
      ES  10.6   opt  170726  fcecb2620f25965723d640decede7c018bcb1dcc  MSAN|use-of-uninitialized-value|include/mysql/psi/mysql_socket.h|inline_mysql_socket_send|vio_write|net_real_write|net_flush
      ES  11.4   dbg  170726  3b34189bfe675c18c4ced3ef531d016ea74c76f4  MSAN|use-of-uninitialized-value|/MSAN_libs/build/openssl-3.0.13/crypto/modes/gcm128.c|gcm_ghash_4bit|CRYPTO_gcm128_encrypt|generic_aes_gcm_cipher_update|gcm_cipher_internal
      ES  11.4   opt  170726  3b34189bfe675c18c4ced3ef531d016ea74c76f4  MSAN|use-of-uninitialized-value|/MSAN_libs/build/openssl-3.0.13/crypto/modes/gcm128.c|gcm_ghash_4bit|CRYPTO_gcm128_encrypt|generic_aes_gcm_cipher_update|gcm_cipher_internal
      ES  11.8   dbg  170726  4694e931d10fecf733c34f83ea2146d31b708eb3  MSAN|use-of-uninitialized-value|strings/ctype.c|my_convert|copy_and_convert|Protocol::net_store_data_cs|Protocol::send_result_set_row
      ES  11.8   opt  170726  4694e931d10fecf733c34f83ea2146d31b708eb3  MSAN|use-of-uninitialized-value|strings/ctype.c|my_convert|copy_and_convert|Protocol::net_store_data_cs|Protocol::send_result_set_row
      ES  12.3   dbg  160726  9d8abb61e913bec023cd8caeccad4b42717151cb  MSAN|use-of-uninitialized-value|strings/ctype.c|my_convert|copy_and_convert|Protocol::net_store_data_cs|Protocol::send_result_set_row
      ES  12.3   opt  160726  9d8abb61e913bec023cd8caeccad4b42717151cb  MSAN|use-of-uninitialized-value|strings/ctype.c|my_convert|copy_and_convert|Protocol::net_store_data_cs|Protocol::send_result_set_row
      

      Attachments

        Activity

          People

            raghunandan.bhat Raghunandan Bhat
            saahil Saahil Alam
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - 0d
                0d
                Remaining:
                Time Spent - 1.5h Remaining Estimate - 1.5d
                1.5d
                Logged:
                Time Spent - 1.5h Remaining Estimate - 1.5d
                1.5h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.