Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40586

use-of-uninitialized-value in crc_word

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      INSTALL SONAME 'ha_archive';
      CREATE TABLE t1 (c1 BLOB) WITH SYSTEM VERSIONING ENGINE=ARCHIVE;
      INSERT INTO t1 VALUES (REPEAT('a',26));
      OPTIMIZE TABLE t1;
      OPTIMIZE TABLE t1;
      

      Leads to:

      CS 10.11.19 1dab253482dd562457c89deb68082fb647572959 (Debug, MSAN, Clang 20.1.8-20250804) Build 01/08/2026

      ==2414016==WARNING: MemorySanitizer: use-of-uninitialized-value
          #0 0x7fffe4b714ab in crc_word /test/msan_slow_src/10.11_dbg_msan/zlib/crc32.c:611:30
          #1 0x7fffe4b714ab in crc32_z /test/msan_slow_src/10.11_dbg_msan/zlib/crc32.c:772:19
          #2 0x7fffe4b63209 in azwrite /test/msan_slow_src/10.11_dbg_msan/storage/archive/azio.c:611:12
          #3 0x7fffe4b6c75f in ha_archive::real_write_row(unsigned char const*, azio_stream*) /test/msan_slow_src/10.11_dbg_msan/storage/archive/ha_archive.cc:907:12
          #4 0x7fffe4b6c75f in ha_archive::optimize(THD*, st_ha_check_opt*) /test/msan_slow_src/10.11_dbg_msan/storage/archive/ha_archive.cc:1585:9
          #5 0x555557525c33 in mysql_admin_table(THD*, TABLE_LIST*, st_ha_check_opt*, st_mysql_const_lex_string const*, thr_lock_type, bool, bool, unsigned int, int (*)(THD*, TABLE_LIST*, st_ha_check_opt*), int (handler::*)(THD*, st_ha_check_opt*), int (*)(THD*, TABLE_LIST*, st_ha_check_opt*), bool) /test/msan_slow_src/10.11_dbg_msan/sql/sql_admin.cc:918:21
          #6 0x55555752a2b1 in Sql_cmd_optimize_table::execute(THD*) /test/msan_slow_src/10.11_dbg_msan/sql/sql_admin.cc:1646:5
          #7 0x555557031f2c in mysql_execute_command(THD*, bool) /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:6199:26
          #8 0x5555570264ef in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:8219:18
          #9 0x55555701ff26 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:1924:7
          #10 0x555557026fae in do_command(THD*, bool) /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:1434:17
          #11 0x5555574f457c in do_handle_one_connection(CONNECT*, bool) /test/msan_slow_src/10.11_dbg_msan/sql/sql_connect.cc:1486:11
          #12 0x5555574f3f06 in handle_one_connection /test/msan_slow_src/10.11_dbg_msan/sql/sql_connect.cc:1398:5
          #13 0x7fffe689cb83 in start_thread nptl/pthread_create.c:447:8
          #14 0x7fffe6929d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
        Uninitialized value was created by a heap allocation
          #0 0x555556554abe in realloc (/test/MSAN_MD010826-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd+0x1000abe) (BuildId: 6999d25a3f2d8b356f53183bbc8e90162d24134e)
          #1 0x5555585559a1 in my_realloc /test/msan_slow_src/10.11_dbg_msan/mysys/my_malloc.c:155:7
       
      SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/msan_slow_src/10.11_dbg_msan/zlib/crc32.c:611:30 in crc_word
      

      grep: /test/MSAN_MD010826-mariadb-10.11.19-linux-x86_64-opt/log/master.err: No such file or directory
      grep: /test/MSAN_MD010826-mariadb-10.11.19-linux-x86_64-opt/log/master.err: No such file or directory

      Setup:

      Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
        # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18
           sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
      Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O1 -march=native -mtune=native'" and:
          -DWITH_MSAN=ON  # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)
      Set before execution:
          export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0
      

      MSAN Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.6   dbg  010826  4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe  No bug found                  
      CS  10.6   opt  010826  4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe  No bug found                  
      CS  10.11  dbg  010826  1dab253482dd562457c89deb68082fb647572959  MSAN|use-of-uninitialized-value|zlib/crc32.c|crc_word|crc32_z|azwrite|ha_archive::real_write_row
      CS  10.11  opt  010826  1dab253482dd562457c89deb68082fb647572959  No bug found                  
      CS  11.4   dbg  010826  c57069561c4fe8f72191d4a2a4a829e5b57537dc  No bug found                  
      CS  11.4   opt  010826  c57069561c4fe8f72191d4a2a4a829e5b57537dc  No bug found                  
      CS  11.8   dbg  010826  eaca80bf3208fb9657b7304b940a6726b4c86213  No bug found                  
      CS  11.8   opt  010826  eaca80bf3208fb9657b7304b940a6726b4c86213  No bug found                  
      CS  12.3   dbg  010826  51263b851df7093758e98c7029f091332c1c576f  MSAN|use-of-uninitialized-value|zlib/crc32.c|crc_word|crc32_z|azwrite|ha_archive::real_write_row
      CS  12.3   opt  010826  51263b851df7093758e98c7029f091332c1c576f  MSAN|use-of-uninitialized-value|zlib/crc32.c|crc_word|crc32_z|azwrite|ha_archive::real_write_row
      CS  13.0   dbg  010826  1a4bb1bbfde5fa17ba148cb62678902f11c66a1a  No bug found                  
      CS  13.0   opt  010826  1a4bb1bbfde5fa17ba148cb62678902f11c66a1a  No bug found                  
      CS  13.1   dbg  010826  548c80aeafb6dd2be64f56e902e921a4052b5fe0  No bug found                  
      CS  13.1   opt  010826  548c80aeafb6dd2be64f56e902e921a4052b5fe0  No bug found                  
      ES  10.6   dbg  010826  fcecb2620f25965723d640decede7c018bcb1dcc  No bug found                  
      ES  10.6   opt  010826  fcecb2620f25965723d640decede7c018bcb1dcc  No bug found                  
      ES  11.4   dbg  010826  3b34189bfe675c18c4ced3ef531d016ea74c76f4  No bug found                  
      ES  11.4   opt  010826  3b34189bfe675c18c4ced3ef531d016ea74c76f4  No bug found                  
      ES  11.8   dbg  010826  4694e931d10fecf733c34f83ea2146d31b708eb3  No bug found                  
      ES  11.8   opt  010826  4694e931d10fecf733c34f83ea2146d31b708eb3  No bug found                  
      ES  12.3   dbg  010826  c86ea989a715d9fbe1a5d760939acec22acfc0df  No bug found                  
      ES  12.3   opt  010826  c86ea989a715d9fbe1a5d760939acec22acfc0df  No bug found                  
      

      Attachments

        Activity

          People

            sanja Oleksandr Byelkin
            saahil Saahil Alam
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 1.5h
                1.5h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.