Details
-
Bug
-
Status: Open (View Workflow)
-
Critical
-
Resolution: Unresolved
-
10.6, 10.11, 11.4, 11.8, 12.3, 13.0, 13.1
-
Can result in hang or crash
-
Q4/2026 Server Maintenance
Description
SELECT ST_ASTEXT(ST_GEOMFROMGEOJSON("{ \"type\": \"Point\",\"coordinates\": [] }",4)); |
Leads to:
|
CS 12.3.3 f9d797f1ccb8bbdbad0b50005644f29cd6125a6c (Optimized, MSAN, Clang 20.1.8-20250804) Build 16/07/2026 |
==2828490==WARNING: MemorySanitizer: use-of-uninitialized-value
|
#0 0x555556c05a74 in Gis_point::get_data_as_wkt(String*, char const**) const /test/12.3_opt_msan/sql/spatial.cc:1179:8
|
#1 0x555556bffa4b in Geometry::as_wkt(String*, char const**) /test/12.3_opt_msan/sql/spatial.cc:437:7
|
#2 0x555556a0dcd9 in Item_func_as_wkt::val_str_ascii(String*) /test/12.3_opt_msan/sql/item_geofunc.cc:231:26
|
#3 0x5555567b2bde in Item_func::val_str_from_val_str_ascii(String*, String*) /test/12.3_opt_msan/sql/item_strfunc.cc:110:18
|
#4 0x5555567b2bde in Item_str_ascii_func::val_str(String*) /test/12.3_opt_msan/sql/item_strfunc.h:90:12
|
#5 0x5555576c6650 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/12.3_opt_msan/sql/sql_type.cc:7613:19
|
#6 0x555556b5ddd5 in Protocol::send_result_set_row(List<Item>*) /test/12.3_opt_msan/sql/protocol.cc:1358:15
|
#7 0x555556d11d65 in select_send::send_data(List<Item>&) /test/12.3_opt_msan/sql/sql_class.cc:3411:17
|
#8 0x555556d116cd in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/12.3_opt_msan/sql/sql_class.cc:3309:11
|
#9 0x5555570ddaea in JOIN::exec_inner() /test/12.3_opt_msan/sql/sql_select.cc:4996:22
|
#10 0x555557070148 in JOIN::exec() /test/12.3_opt_msan/sql/sql_select.cc:4913:8
|
#11 0x555557070148 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/12.3_opt_msan/sql/sql_select.cc:5439:21
|
#12 0x55555706f67b in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/12.3_opt_msan/sql/sql_select.cc:636:10
|
#13 0x555556fbbfbe in execute_sqlcom_select(THD*, TABLE_LIST*) /test/12.3_opt_msan/sql/sql_parse.cc:6219:12
|
#14 0x555556faf16b in mysql_execute_command(THD*, bool) /test/12.3_opt_msan/sql/sql_parse.cc:3992:12
|
#15 0x555556fa4a3f in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/12.3_opt_msan/sql/sql_parse.cc:7947:18
|
#16 0x555556f9e495 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/12.3_opt_msan/sql/sql_parse.cc:1903:7
|
#17 0x555556fa5504 in do_command(THD*, bool) /test/12.3_opt_msan/sql/sql_parse.cc:1437:17
|
#18 0x55555745befc in do_handle_one_connection(CONNECT*, bool) /test/12.3_opt_msan/sql/sql_connect.cc:1510:11
|
#19 0x55555745b87e in handle_one_connection /test/12.3_opt_msan/sql/sql_connect.cc:1422:5
|
#20 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
|
#21 0x7fffe6929c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Uninitialized value was stored to memory at
|
#0 0x555556c05665 in Binary_string::q_append(double) /test/12.3_opt_msan/sql/sql_string.h:373:5
|
#1 0x555556c05665 in Gis_point::init_from_json(st_json_engine_t*, bool, String*) /test/12.3_opt_msan/sql/spatial.cc:1166:8
|
#2 0x555556c01526 in Geometry::create_from_json(Geometry_buffer*, st_json_engine_t*, bool, String*) /test/12.3_opt_msan/sql/spatial.cc:767:15
|
#3 0x555556a0d55e in Item_func_geometry_from_json::val_str(String*) /test/12.3_opt_msan/sql/item_geofunc.cc:176:21
|
#4 0x555556a0dba6 in Item_func_as_wkt::val_str_ascii(String*) /test/12.3_opt_msan/sql/item_geofunc.cc:219:26
|
#5 0x5555567b2bde in Item_func::val_str_from_val_str_ascii(String*, String*) /test/12.3_opt_msan/sql/item_strfunc.cc:110:18
|
#6 0x5555567b2bde in Item_str_ascii_func::val_str(String*) /test/12.3_opt_msan/sql/item_strfunc.h:90:12
|
#7 0x5555576c6650 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/12.3_opt_msan/sql/sql_type.cc:7613:19
|
#8 0x555556b5ddd5 in Protocol::send_result_set_row(List<Item>*) /test/12.3_opt_msan/sql/protocol.cc:1358:15
|
#9 0x555556d11d65 in select_send::send_data(List<Item>&) /test/12.3_opt_msan/sql/sql_class.cc:3411:17
|
#10 0x555556d116cd in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/12.3_opt_msan/sql/sql_class.cc:3309:11
|
#11 0x5555570ddaea in JOIN::exec_inner() /test/12.3_opt_msan/sql/sql_select.cc:4996:22
|
#12 0x555557070148 in JOIN::exec() /test/12.3_opt_msan/sql/sql_select.cc:4913:8
|
#13 0x555557070148 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/12.3_opt_msan/sql/sql_select.cc:5439:21
|
#14 0x55555706f67b in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/12.3_opt_msan/sql/sql_select.cc:636:10
|
#15 0x555556fbbfbe in execute_sqlcom_select(THD*, TABLE_LIST*) /test/12.3_opt_msan/sql/sql_parse.cc:6219:12
|
#16 0x555556faf16b in mysql_execute_command(THD*, bool) /test/12.3_opt_msan/sql/sql_parse.cc:3992:12
|
#17 0x555556fa4a3f in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/12.3_opt_msan/sql/sql_parse.cc:7947:18
|
#18 0x555556f9e495 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/12.3_opt_msan/sql/sql_parse.cc:1903:7
|
#19 0x555556fa5504 in do_command(THD*, bool) /test/12.3_opt_msan/sql/sql_parse.cc:1437:17
|
#20 0x55555745befc in do_handle_one_connection(CONNECT*, bool) /test/12.3_opt_msan/sql/sql_connect.cc:1510:11
|
#21 0x55555745b87e in handle_one_connection /test/12.3_opt_msan/sql/sql_connect.cc:1422:5
|
#22 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
|
|
|
Uninitialized value was created
|
<empty stack>
|
|
|
SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/12.3_opt_msan/sql/spatial.cc:1179:8 in Gis_point::get_data_as_wkt(String*, char const**) const
|
Setup:
Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
|
# Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref dpkg --list | grep -iE 'clang|llvm' and use apt purge and dpkg --purge to remove the packages), before installing Clang/LLVM 18
|
sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
|
Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:
|
-DWITH_MSAN=ON # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)
|
Set before execution:
|
export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0
|
|
MSAN Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 170726 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
CS 10.6 opt 170726 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
CS 10.11 dbg 170726 50faece416f0642b57a515d546f20cefd9062379 MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
CS 10.11 opt 170726 50faece416f0642b57a515d546f20cefd9062379 MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
CS 11.8 dbg 170726 bf58d4cb5fccd4078ec91c065a2de86be3b46281 MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
CS 11.8 opt 170726 bf58d4cb5fccd4078ec91c065a2de86be3b46281 MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
CS 12.3 dbg 160726 f9d797f1ccb8bbdbad0b50005644f29cd6125a6c MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
CS 12.3 opt 160726 f9d797f1ccb8bbdbad0b50005644f29cd6125a6c MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
CS 13.0 dbg 160726 84c246ca5387c0611f75097136ff4f4bea092aa3 MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
CS 13.0 opt 160726 84c246ca5387c0611f75097136ff4f4bea092aa3 MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
CS 13.1 dbg 160726 7322a6656a5357b4574b7413493c76ba2fc41f84 MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
CS 13.1 opt 160726 7322a6656a5357b4574b7413493c76ba2fc41f84 MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
ES 10.6 dbg 170726 fcecb2620f25965723d640decede7c018bcb1dcc MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
ES 10.6 opt 170726 fcecb2620f25965723d640decede7c018bcb1dcc MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
ES 11.4 dbg 170726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
ES 11.4 opt 170726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
ES 11.8 dbg 170726 4694e931d10fecf733c34f83ea2146d31b708eb3 MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
ES 11.8 opt 170726 4694e931d10fecf733c34f83ea2146d31b708eb3 MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
ES 12.3 dbg 160726 9d8abb61e913bec023cd8caeccad4b42717151cb MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
ES 12.3 opt 160726 9d8abb61e913bec023cd8caeccad4b42717151cb MSAN|use-of-uninitialized-value|sql/spatial.cc|Gis_point::get_data_as_wkt|Geometry::as_wkt|Item_func_as_wkt::val_str_ascii|Item_func::val_str_from_val_str_ascii
|
