[MDEV-40537] UBSAN: float-cast-overflow in get_schema_stat_record during SELECT on IS.STATISTICS table - Jira

XML

Word

Printable

Details

Type: Bug
Status: Open (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.11
Fix Version/s: 10.11
Component/s: Information Schema
Labels:
- UBSAN
- float-cast-overflow

Bug Category:
Can result in unexpected behaviour

Description

CREATE TABLE t1 (c1 INT KEY,c2 TINYTEXT, KEY c1c2 (c1,c2));

INSERT IGNORE INTO t1 (c1,c2) VALUES (+ 1,1),(+ 1,2);

ANALYZE TABLE t1 PERSISTENT FOR ALL;

SELECT * FROM INFORMATION_SCHEMA.STATISTICS;

Leads to:

CS 10.11.19 cea98ec09dd9a226047b09bc1f8516003b416e1c (Debug, UBASAN, Clang 18.1.3-11) Build 27/07/2026
/test/10.11_dbg_san/sql/sql_show.cc:7090:42: runtime error: inf is outside the range of representable values of type 'unsigned long long'
#0 0x622586b686f1 in get_schema_stat_record(THD, TABLE_LIST, TABLE, bool, st_mysql_const_lex_string const, st_mysql_const_lex_string const*) /test/10.11_dbg_san/sql/sql_show.cc:7090:42
#1 0x622586b2b54d in fill_schema_table_by_open(THD, st_mem_root, bool, TABLE, st_schema_table, st_mysql_const_lex_string, st_mysql_const_lex_string, Open_tables_backup*, bool) /test/10.11_dbg_san/sql/sql_show.cc:4839:13
#2 0x622586b29046 in get_all_tables(THD, TABLE_LIST, Item*) /test/10.11_dbg_san/sql/sql_show.cc:5474:17
#3 0x622586b524fd in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/10.11_dbg_san/sql/sql_show.cc:9310:11
#4 0x6225869c2a96 in JOIN::exec_inner() /test/10.11_dbg_san/sql/sql_select.cc:4980:7
#5 0x6225869c0a92 in JOIN::exec() /test/10.11_dbg_san/sql/sql_select.cc:4807:3
#6 0x62258693c5af in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/10.11_dbg_san/sql/sql_select.cc:5285:9
#7 0x62258693b0c1 in handle_select(THD, LEX, select_result*, unsigned long long) /test/10.11_dbg_san/sql/sql_select.cc:601:10
#8 0x6225868068f7 in execute_sqlcom_select(THD, TABLE_LIST) /test/10.11_dbg_san/sql/sql_parse.cc:6461:12
#9 0x6225867edbcf in mysql_execute_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:4040:12
#10 0x6225867bef44 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/10.11_dbg_san/sql/sql_parse.cc:8219:18
#11 0x6225867b845d in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1924:7
#12 0x6225867c06d8 in do_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1434:17
#13 0x622586f0f1ac in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_san/sql/sql_connect.cc:1486:11
#14 0x622586f0ea81 in handle_one_connection /test/10.11_dbg_san/sql/sql_connect.cc:1398:5
#15 0x62258567428c in asan_thread_start(void*) crtstuff.c
#16 0x75700969cb83 in start_thread nptl/pthread_create.c:447:8
#17 0x757009729d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: float-cast-overflow /test/10.11_dbg_san/sql/sql_show.cc:7090:42

Setup:

grep: /test/UBASAN_EMD170226-mariadb-10.6.25-21-linux-x86_64-dbg/BUILD_CMD_CMAKE: No such file or directory

Compiled with a recent version of GCC (I used GCC 13.3.0) and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter

SAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.11 dbg 270726 cea98ec09dd9a226047b09bc1f8516003b416e1c UBSAN\|inf is outside the range of representable values of type 'unsigned long long'\|sql/sql_show.cc\|get_schema_stat_record\|fill_schema_table_by_open\|get_all_tables\|get_schema_tables_result
CS 10.11 opt 270726 cea98ec09dd9a226047b09bc1f8516003b416e1c UBSAN\|inf is outside the range of representable values of type 'unsigned long long'\|sql/sql_show.cc\|get_schema_stat_record\|fill_schema_table_by_open\|get_all_tables\|get_schema_tables_result
CS 11.4 dbg 100726 1fff140f0c25f6a5b2f6fd0b5ef6b6c50d60e913 No bug found
CS 11.4 opt 100726 1fff140f0c25f6a5b2f6fd0b5ef6b6c50d60e913 No bug found
CS 11.8 dbg 100726 666b2aca09cb84d59b4ece2185a9200d745cb287 No bug found
CS 11.8 opt 100726 666b2aca09cb84d59b4ece2185a9200d745cb287 No bug found
CS 12.3 dbg 100726 27df5668c2e3eef406a5357672d3d8e89d25ff48 No bug found
CS 12.3 opt 100726 27df5668c2e3eef406a5357672d3d8e89d25ff48 No bug found
CS 13.0 dbg 100726 84c246ca5387c0611f75097136ff4f4bea092aa3 No bug found
CS 13.0 opt 100726 84c246ca5387c0611f75097136ff4f4bea092aa3 No bug found
CS 13.1 dbg 100726 fd8cec54af7a9d79749df25ea70dac695b371641 No bug found
CS 13.1 dbg 230726 7b89d04911b8a618da9ed76536313a351977d41d No bug found
CS 13.1 opt 100726 fd8cec54af7a9d79749df25ea70dac695b371641 No bug found
CS 13.1 opt 230726 7b89d04911b8a618da9ed76536313a351977d41d No bug found
ES 10.6 dbg 170226 22e626b9c17e9969925c54f14d30e39e25320b22 UBSAN\|inf is outside the range of representable values of type 'unsigned long long'\|sql/sql_show.cc\|get_schema_stat_record\|fill_schema_table_by_open\|get_all_tables\|get_schema_tables_result
ES 10.6 opt 170226 22e626b9c17e9969925c54f14d30e39e25320b22 UBSAN\|inf is outside the range of representable values of type 'unsigned long long'\|sql/sql_show.cc\|get_schema_stat_record\|fill_schema_table_by_open\|get_all_tables\|get_schema_tables_result
ES 11.4 dbg 170226 34f616d5fd2c649d0c79acb4e2423c90b8f10436 UBSAN\|inf is outside the range of representable values of type 'unsigned long long'\|sql/sql_show.cc\|get_schema_stat_record\|fill_schema_table_by_open\|get_all_tables\|get_schema_tables_result
ES 11.4 opt 170226 34f616d5fd2c649d0c79acb4e2423c90b8f10436 UBSAN\|inf is outside the range of representable values of type 'unsigned long long'\|sql/sql_show.cc\|get_schema_stat_record\|fill_schema_table_by_open\|get_all_tables\|get_schema_tables_result
ES 11.8 dbg 170226 405ee76b60c4ab82155f339136ed20d3b7363717 UBSAN\|inf is outside the range of representable values of type 'unsigned long long'\|sql/sql_show.cc\|get_schema_stat_record\|fill_schema_table_by_open\|get_all_tables\|get_schema_tables_result
ES 11.8 opt 170226 405ee76b60c4ab82155f339136ed20d3b7363717 UBSAN\|inf is outside the range of representable values of type 'unsigned long long'\|sql/sql_show.cc\|get_schema_stat_record\|fill_schema_table_by_open\|get_all_tables\|get_schema_tables_result

Attachments

Activity

People

Assignee:: Sergei Golubchik

Reporter:: Ramesh Sivaraman

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 4 days ago 10:49

Updated:: 2 days ago 02:45

Time Tracking

Estimated:

Not Specified

Remaining:

Logged:

0.5h

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.