Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40549

use-of-uninitialized-value in spider_send_query(ha_spider*, TABLE*, int, int, int*)

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      CLI compatible test case:-

      INSTALL SONAME 'ha_spider';
      CREATE TABLE t1 (c1 INT KEY) ENGINE=Spider;
      HANDLER t1 OPEN;
      HANDLER t1 READ `PRIMARY` = (1);
      HANDLER t1 READ `PRIMARY` = (1);
      

      Leads to:

      CS 11.8.9 bf58d4cb5fccd4078ec91c065a2de86be3b46281 (Debug, MSAN, Clang 20.1.8-20250804) Build 17/07/2026

      ==2250420==WARNING: MemorySanitizer: use-of-uninitialized-value
          #0 0x7ba1e7bc25f5 in spider_send_query(ha_spider*, TABLE*, int, int, int*) /test/11.8_dbg_msan/storage/spider/ha_spider.cc:1338:34
          #1 0x7ba1e7bbf893 in ha_spider::index_read_map_internal(unsigned char*, unsigned char const*, unsigned long, ha_rkey_function) /test/11.8_dbg_msan/storage/spider/ha_spider.cc:1509:11
          #2 0x5cae72cd5be9 in handler::ha_index_read_map(unsigned char*, unsigned char const*, unsigned long, ha_rkey_function) /test/11.8_dbg_msan/sql/handler.cc:3901:3
          #3 0x5cae73616cf0 in mysql_ha_read(THD*, TABLE_LIST*, enum_ha_read_modes, char const*, List<Item>*, ha_rkey_function, Item*, unsigned long long, unsigned long long) /test/11.8_dbg_msan/sql/sql_handler.cc:961:29
          #4 0x5cae73701d19 in mysql_execute_command(THD*, bool) /test/11.8_dbg_msan/sql/sql_parse.cc:5549:10
          #5 0x5cae736f264f in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_msan/sql/sql_parse.cc:7953:18
          #6 0x5cae736ebe47 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_msan/sql/sql_parse.cc:1923:7
          #7 0x5cae736f310e in do_command(THD*, bool) /test/11.8_dbg_msan/sql/sql_parse.cc:1431:17
          #8 0x5cae73bea6ec in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_msan/sql/sql_connect.cc:1511:11
          #9 0x5cae73bea082 in handle_one_connection /test/11.8_dbg_msan/sql/sql_connect.cc:1423:5
          #10 0x7ba2cc09cb83 in start_thread nptl/pthread_create.c:447:8
          #11 0x7ba2cc129d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
        Uninitialized value was created by a heap deallocation
          #0 0x5cae72bda074 in free (/test/MSAN_MD170726-mariadb-11.8.9-linux-x86_64-dbg/bin/mariadbd+0x105e074) (BuildId: 51ba9e049587fd527f1b4d9de7e8b86e5d6a36ac)
          #1 0x7ba1e7b9774c in spider_free_mem(st_spider_transaction*, void*, unsigned long) /test/11.8_dbg_msan/storage/spider/spd_malloc.cc:182:3
       
      SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/11.8_dbg_msan/storage/spider/ha_spider.cc:1338:34 in spider_send_query(ha_spider*, TABLE*, int, int, int*)
      

      CS 11.8.9 bf58d4cb5fccd4078ec91c065a2de86be3b46281 (Optimized, MSAN, Clang 20.1.8-20250804) Build 17/07/2026

      ==2250476==WARNING: MemorySanitizer: use-of-uninitialized-value
          #0 0x7fff029b75cf in spider_send_query(ha_spider*, TABLE*, int, int, int*) /test/11.8_opt_msan/storage/spider/ha_spider.cc:1338:34
          #1 0x7fff029b490d in ha_spider::index_read_map_internal(unsigned char*, unsigned char const*, unsigned long, ha_rkey_function) /test/11.8_opt_msan/storage/spider/ha_spider.cc:1509:11
          #2 0x555556499742 in handler::ha_index_read_map(unsigned char*, unsigned char const*, unsigned long, ha_rkey_function) /test/11.8_opt_msan/sql/handler.cc:3901:3
          #3 0x555556cfafe9 in mysql_ha_read(THD*, TABLE_LIST*, enum_ha_read_modes, char const*, List<Item>*, ha_rkey_function, Item*, unsigned long long, unsigned long long) /test/11.8_opt_msan/sql/sql_handler.cc:961:29
          #4 0x555556ddacff in mysql_execute_command(THD*, bool) /test/11.8_opt_msan/sql/sql_parse.cc:5549:10
          #5 0x555556dcd085 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_opt_msan/sql/sql_parse.cc:7953:18
          #6 0x555556dc6e73 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_opt_msan/sql/sql_parse.cc:1923:7
          #7 0x555556dcdc68 in do_command(THD*, bool) /test/11.8_opt_msan/sql/sql_parse.cc:1431:17
          #8 0x55555726875c in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_msan/sql/sql_connect.cc:1511:11
          #9 0x5555572680de in handle_one_connection /test/11.8_opt_msan/sql/sql_connect.cc:1423:5
          #10 0x7fffe689cb83 in start_thread nptl/pthread_create.c:447:8
          #11 0x7fffe6929d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
        Uninitialized value was created by a heap deallocation
          #0 0x5555563b6554 in free (/test/MSAN_MD170726-mariadb-11.8.9-linux-x86_64-opt/bin/mariadbd+0xe62554) (BuildId: b9f803b126ea6ff6abb31abd5762358389a87e1e)
          #1 0x7fff0297a67b in spider_free_mem(st_spider_transaction*, void*, unsigned long) /test/11.8_opt_msan/storage/spider/spd_malloc.cc:182:3
          #2 0x7fff028e3901 in spider_free_conn(st_spider_conn*) /test/11.8_opt_msan/storage/spider/spd_conn.cc:825:3
          #3 0x7fff0288a784 in spider_free_trx_conn(st_spider_transaction*, bool) /test/11.8_opt_msan/storage/spider/spd_trx.cc:119:9
          #4 0x7fff0289e1aa in spider_rollback(THD*, bool) /test/11.8_opt_msan/storage/spider/spd_trx.cc:2807:5
          #5 0x55555648feff in ha_rollback_trans(THD*, bool) /test/11.8_opt_msan/sql/handler.cc:2402:37
          #6 0x55555729fecd in trans_rollback_stmt(THD*) /test/11.8_opt_msan/sql/transaction.cc:565:5
          #7 0x555556cfa3d5 in mysql_ha_read(THD*, TABLE_LIST*, enum_ha_read_modes, char const*, List<Item>*, ha_rkey_function, Item*, unsigned long long, unsigned long long) /test/11.8_opt_msan/sql/sql_handler.cc:1019:3
          #8 0x555556ddacff in mysql_execute_command(THD*, bool) /test/11.8_opt_msan/sql/sql_parse.cc:5549:10
          #9 0x555556dcd085 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_opt_msan/sql/sql_parse.cc:7953:18
          #10 0x555556dc6e73 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_opt_msan/sql/sql_parse.cc:1923:7
          #11 0x555556dcdc68 in do_command(THD*, bool) /test/11.8_opt_msan/sql/sql_parse.cc:1431:17
          #12 0x55555726875c in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_msan/sql/sql_connect.cc:1511:11
          #13 0x5555572680de in handle_one_connection /test/11.8_opt_msan/sql/sql_connect.cc:1423:5
          #14 0x7fffe689cb83 in start_thread nptl/pthread_create.c:447:8
       
      SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/11.8_opt_msan/storage/spider/ha_spider.cc:1338:34 in spider_send_query(ha_spider*, TABLE*, int, int, int*)
      

      Setup:

      Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
        # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18
           sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
      Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O1 -march=native -mtune=native'" and:
          -DWITH_MSAN=ON  # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)
      Set before execution:
          export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0
      

      MSAN Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.6   dbg  170726  85ab366da3fc5d13b61d9e491e63e2b62c017cf4  MSAN|use-of-uninitialized-value|storage/spider/spd_db_conn.cc|spider_db_open_handler|ha_spider::index_handler_init|ha_spider::index_read_map_internal|handler::ha_index_read_map
      CS  10.6   opt  170726  85ab366da3fc5d13b61d9e491e63e2b62c017cf4  MSAN|use-of-uninitialized-value|storage/spider/spd_db_conn.cc|spider_db_open_handler|ha_spider::index_handler_init|ha_spider::index_read_map_internal|handler::ha_index_read_map
      CS  10.11  dbg  170726  50faece416f0642b57a515d546f20cefd9062379  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|spider_send_query|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      CS  10.11  opt  170726  50faece416f0642b57a515d546f20cefd9062379  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|spider_send_query|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      CS  11.4   dbg  200726  17fe060a549d2bfa56f6efb82456b20146ac569f  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|spider_send_query|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      CS  11.4   opt  200726  17fe060a549d2bfa56f6efb82456b20146ac569f  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|spider_send_query|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      CS  11.8   dbg  170726  bf58d4cb5fccd4078ec91c065a2de86be3b46281  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|spider_send_query|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      CS  11.8   opt  170726  bf58d4cb5fccd4078ec91c065a2de86be3b46281  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|spider_send_query|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      CS  12.3   dbg  160726  f9d797f1ccb8bbdbad0b50005644f29cd6125a6c  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|spider_send_query|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      CS  12.3   opt  160726  f9d797f1ccb8bbdbad0b50005644f29cd6125a6c  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|spider_send_query|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      CS  13.0   dbg  160726  84c246ca5387c0611f75097136ff4f4bea092aa3  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|spider_send_query|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      CS  13.0   opt  160726  84c246ca5387c0611f75097136ff4f4bea092aa3  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|spider_send_query|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      CS  13.1   dbg  160726  7322a6656a5357b4574b7413493c76ba2fc41f84  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|spider_send_query|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      CS  13.1   opt  160726  7322a6656a5357b4574b7413493c76ba2fc41f84  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|spider_send_query|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      ES  10.6   dbg  170726  fcecb2620f25965723d640decede7c018bcb1dcc  MSAN|use-of-uninitialized-value|storage/spider/spd_db_conn.cc|spider_db_open_handler|ha_spider::index_handler_init|ha_spider::index_read_map_internal|handler::ha_index_read_map
      ES  10.6   opt  170726  fcecb2620f25965723d640decede7c018bcb1dcc  MSAN|use-of-uninitialized-value|storage/spider/spd_db_conn.cc|spider_db_open_handler|ha_spider::index_handler_init|ha_spider::index_read_map_internal|handler::ha_index_read_map
      ES  11.4   dbg  170726  3b34189bfe675c18c4ced3ef531d016ea74c76f4  MSAN|use-of-uninitialized-value|sql/mysqld.cc|temp_file_size_cb_func|_ma_update_tmp_file_size|_ma_set_share_data_file_length|write_block_record
      ES  11.4   opt  170726  3b34189bfe675c18c4ced3ef531d016ea74c76f4  MSAN|use-of-uninitialized-value|sql/mysqld.cc|temp_file_size_cb_func|_ma_update_tmp_file_size|_ma_set_share_data_file_length|write_block_record
      ES  11.8   dbg  170726  4694e931d10fecf733c34f83ea2146d31b708eb3  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|ha_spider::append_select_sql_part|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      ES  11.8   opt  170726  4694e931d10fecf733c34f83ea2146d31b708eb3  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|ha_spider::append_select_sql_part|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      ES  12.3   dbg  160726  9d8abb61e913bec023cd8caeccad4b42717151cb  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|ha_spider::append_select_sql_part|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      ES  12.3   opt  160726  9d8abb61e913bec023cd8caeccad4b42717151cb  MSAN|use-of-uninitialized-value|storage/spider/ha_spider.cc|ha_spider::append_select_sql_part|ha_spider::index_read_map_internal|handler::ha_index_read_map|mysql_ha_read
      

      Attachments

        Issue Links

          Activity

            People

              ycp Yuchen Pei
              saahil Saahil Alam
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - 0d
                  0d
                  Remaining:
                  Time Spent - 1.7h Remaining Estimate - 1.5d
                  1.5d
                  Logged:
                  Time Spent - 1.7h Remaining Estimate - 1.5d
                  1.7h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.