[MDEV-40552] UBSAN : load of value X, which is not a valid value for type 'wkbByteOrder' in sql/spatial.cc | Gis_point::init_from_wkb|Gis_multi_point::init_from_wkb - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.11, 11.4, 12.3, 13.0, 13.1
Fix Version/s: 10.11.20, 11.4.14, 11.8.10, 12.3.4, 13.1.2
Component/s: GIS
Labels:
- UBSAN
- invalid-enum-load

Bug Category:
Can result in unexpected behaviour
Release Note Summary:
A WKB multi-point with an invalid byte order field when passed to the function ST_GeomFromWKB has been corrected to return a NULL result where it previously had a valid value.

Description

Seems ~~MDEV-26813~~ is missed to fix multi point byte order.

SELECT ST_GEOMFROMWKB (0x0104000000010000008201000000000000000000000000000000000000000000000000) as multipoint_bad_inner_bo;

Leads to

CS 10.11.19 41cdc5630eb53e0e184cb685202c1ad7a69bb6a6 (Optimized, UBASAN, Clang 18.1.3-11) Build 29/07/2026
/test/mtest/test_10.11/server_opt_san/sql/spatial.cc:950:26: runtime error: load of value 4294967170, which is not a valid value for type 'wkbByteOrder'
#0 0x5c4e35157c33 in Gis_point::init_from_wkb(char const, unsigned int, Geometry::wkbByteOrder, String) /test/mtest/test_10.11/server_opt_san/sql/spatial.cc:950:26
#1 0x5c4e3516ad94 in Gis_multi_point::init_from_wkb(char const, unsigned int, Geometry::wkbByteOrder, String) /test/mtest/test_10.11/server_opt_san/sql/spatial.cc:2183:12
#2 0x5c4e35152168 in Geometry::create_from_wkb(Geometry_buffer, char const, unsigned int, String*) /test/mtest/test_10.11/server_opt_san/sql/spatial.cc:488:16
#3 0x5c4e34eb508a in Item_func_geometry_from_wkb::val_str(String*) /test/mtest/test_10.11/server_opt_san/sql/item_geofunc.cc:122:11
#4 0x5c4e3602cd6e in Type_handler::Item_send_str(Item, Protocol, st_value*) const /test/mtest/test_10.11/server_opt_san/sql/sql_type.cc:7713:19
#5 0x5c4e3501261e in Protocol::send_result_set_row(List<Item>*) /test/mtest/test_10.11/server_opt_san/sql/protocol.cc:1333:15
#6 0x5c4e352c8a08 in select_send::send_data(List<Item>&) /test/mtest/test_10.11/server_opt_san/sql/sql_class.cc:3213:17
#7 0x5c4e3584514c in JOIN::exec_inner() /test/mtest/test_10.11/server_opt_san/sql/sql_select.cc:4890:22
#8 0x5c4e35841c5d in JOIN::exec() /test/mtest/test_10.11/server_opt_san/sql/sql_select.cc:4807:3
#9 0x5c4e357c541b in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit*,
st_select_lex*) /test/mtest/test_10.11/server_opt_san/sql/sql_select.cc:5285:9
#10 0x5c4e357c4046 in handle_select(THD, LEX, select_result*, unsigned long long) /test/mtest/test_10.11/server_opt_san/sql/sql_select.cc:601:10
#11 0x5c4e356aa3c8 in execute_sqlcom_select(THD, TABLE_LIST) /test/mtest/test_10.11/server_opt_san/sql/sql_parse.cc:6461:12
#12 0x5c4e356881c3 in mysql_execute_command(THD*, bool) /test/mtest/test_10.11/server_opt_san/sql/sql_parse.cc:4040:12
#13 0x5c4e356691a2 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/mtest/test_10.11/server_opt_san/sql/sql_parse.cc:8219:18
#14 0x5c4e3565f75e in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/mtest/test_10.11/server_opt_san/sql/sql_parse.cc:1924:7
#15 0x5c4e3566a9dc in do_command(THD*, bool) /test/mtest/test_10.11/server_opt_san/sql/sql_parse.cc:1434:17
#16 0x5c4e35d5503c in do_handle_one_connection(CONNECT*, bool) /test/mtest/test_10.11/server_opt_san/sql/sql_connect.cc:1486:11
#17 0x5c4e35d54776 in handle_one_connection /test/mtest/test_10.11/server_opt_san/sql/sql_connect.cc:1398:5
#18 0x5c4e3654f3cc in pfs_spawn_thread /test/mtest/test_10.11/server_opt_san/storage/perfschema/pfs.cc:2201:3
#19 0x5c4e3464ec2c in asan_thread_start(void*) crtstuff.c
#20 0x7d6494a9cb83 in start_thread nptl/pthread_create.c:447:8
#21 0x7d6494b29d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.11 dbg 270726 cea98ec09dd9a226047b09bc1f8516003b416e1c UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
CS 10.11 opt 270726 cea98ec09dd9a226047b09bc1f8516003b416e1c UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
CS 11.4 dbg 100726 1fff140f0c25f6a5b2f6fd0b5ef6b6c50d60e913 UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
CS 11.4 opt 100726 1fff140f0c25f6a5b2f6fd0b5ef6b6c50d60e913 UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
CS 11.8 dbg 100726 666b2aca09cb84d59b4ece2185a9200d745cb287 UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
CS 11.8 opt 100726 666b2aca09cb84d59b4ece2185a9200d745cb287 UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
CS 12.3 dbg 100726 27df5668c2e3eef406a5357672d3d8e89d25ff48 UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
CS 12.3 opt 100726 27df5668c2e3eef406a5357672d3d8e89d25ff48 UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
CS 13.0 dbg 100726 84c246ca5387c0611f75097136ff4f4bea092aa3 UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
CS 13.0 opt 100726 84c246ca5387c0611f75097136ff4f4bea092aa3 UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
CS 13.1 dbg 230726 7b89d04911b8a618da9ed76536313a351977d41d UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
CS 13.1 opt 230726 7b89d04911b8a618da9ed76536313a351977d41d UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
ES 10.6 dbg 170226 22e626b9c17e9969925c54f14d30e39e25320b22 UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
ES 10.6 opt 170226 22e626b9c17e9969925c54f14d30e39e25320b22 UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
ES 11.4 dbg 170226 34f616d5fd2c649d0c79acb4e2423c90b8f10436 UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
ES 11.4 opt 170226 34f616d5fd2c649d0c79acb4e2423c90b8f10436 UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
ES 11.8 dbg 170226 405ee76b60c4ab82155f339136ed20d3b7363717 UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str
ES 11.8 opt 170226 405ee76b60c4ab82155f339136ed20d3b7363717 UBSAN\|load of value X, which is not a valid value for type 'wkbByteOrder'\|sql/spatial.cc\|Gis_point::init_from_wkb\|Gis_multi_point::init_from_wkb\|Geometry::create_from_wkb\|Item_func_geometry_from_wkb::val_str

Attachments

Issue Links

relates to

MDEV-26813 UBSAN: load of value 2 for bool 'wkbByteOrder' via 'Geometry::wkbByteOrder' for multi_line_string

Closed

UBSAN : load of value X, which is not a valid value for type 'wkbByteOrder' in sql/spatial.cc | Gis_point::init_from_wkb|Gis_multi_point::init_from_wkb

Details

Description

Attachments

Issue Links

Activity

People

Dates

Time Tracking

Git Integration