SIGSEGV in TDBCSV::ReadBuffer when reading a CONNECT table with TABLE_TYPE=CSV containing an unterminated quoted field

INSTALL SONAME 'ha_connect';

CREATE TABLE t1( name CHAR(20) NOT NULL, birth CHAR(10) NOT NULL, children SMALLINT(2) NOT NULL) ENGINE=CONNECT TABLE_TYPE=CSV FILE_NAME='/tmp/csv_unterminated.csv' SEP_CHAR=';' QUOTED=1;

SELECT * FROM t1;

Core was generated by `/test/MD170826-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  TDBCSV::ReadBuffer (this=0x6ecbcffff4f8, g=0x6ecbd80368b0)at /test/13.1_opt/storage/connect/tabfmt.cpp:940

[Current thread is 1 (LWP 2393705)]

(gdb) bt

#0  TDBCSV::ReadBuffer (this=0x6ecbcffff4f8, g=0x6ecbd80368b0)at /test/13.1_opt/storage/connect/tabfmt.cpp:940

#1  0x000076cc826f4e74 in CntReadNext (g=0x6ecbd80368b0, tdbp=0x6ecbcffff4f8)at /test/13.1_opt/storage/connect/connect.cc:442

#2  0x000076cc826ebbfd in ha_connect::rnd_next (this=0x6ecbd80348f0, buf=0x6ecbd8035300 "\377", ' ' <repeats 120 times>)at /test/13.1_opt/storage/connect/ha_connect.cc:4193

#3  0x00005c9bfa2d691f in handler::ha_rnd_next (this=0x6ecbd80348f0, buf=0x6ecbd8035300 "\377", ' ' <repeats 120 times>)at /test/13.1_opt/sql/handler.cc:4051

#4  0x00005c9bf9f7fcb9 in rr_sequential (info=0x6ecbd801b150)at /test/13.1_opt/sql/records.cc:509

#5  0x00005c9bfa089d3d in sub_select (join=0x6ecbd8019520, join_tab=0x6ecbd801b080, end_of_records=<optimized out>)at /test/13.1_opt/sql/sql_select.cc:24747

#6  0x00005c9bfa0a42a6 in do_select (join=join@entry=0x6ecbd8019520, procedure=<optimized out>) at /test/13.1_opt/sql/sql_select.cc:24261

#7  0x00005c9bfa0a3d79 in JOIN::exec_inner (this=this@entry=0x6ecbd8019520)at /test/13.1_opt/sql/sql_select.cc:5126

#8  0x00005c9bfa08a530 in JOIN::exec (this=0x6ecbd8019520)at /test/13.1_opt/sql/sql_select.cc:4914

#9  mysql_select (thd=thd@entry=0x6ecbd8000c70, tables=<optimized out>, fields=@0x6ecbd8017f78: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6ecbd80182f0, last = 0x6ecbd801a120, elements = 3}, <No data fields>}, conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x6ecbd80194f0, unit=0x6ecbd8005230, select_lex=0x6ecbd8017cc0)at /test/13.1_opt/sql/sql_select.cc:5440

#10 0x00005c9bfa08a210 in handle_select (thd=thd@entry=0x6ecbd8000c70, lex=lex@entry=0x6ecbd8005150, result=result@entry=0x6ecbd80194f0, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/13.1_opt/sql/sql_select.cc:637

#11 0x00005c9bfa055975 in execute_sqlcom_select (thd=thd@entry=0x6ecbd8000c70, all_tables=0x6ecbd8018360) at /test/13.1_opt/sql/sql_parse.cc:6229

#12 0x00005c9bfa0511f1 in mysql_execute_command (thd=thd@entry=0x6ecbd8000c70, is_called_from_prepared_stmt=false) at /test/13.1_opt/sql/sql_parse.cc:3997

#13 0x00005c9bfa04c5d2 in mysql_parse (thd=thd@entry=0x6ecbd8000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x76cca1667580)at /test/13.1_opt/sql/sql_parse.cc:7968

#14 0x00005c9bfa04ab90 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x6ecbd8000c70, packet=packet@entry=0x6ecbd8008e61 "", packet_length=packet_length@entry=16, blocking=true)at /test/13.1_opt/sql/sql_parse.cc:1903

#15 0x00005c9bfa04ca51 in do_command (thd=thd@entry=0x6ecbd8000c70, blocking=true) at /test/13.1_opt/sql/sql_parse.cc:1437

#16 0x00005c9bfa17894d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5c9c2b6324a0, put_in_cache=true)at /test/13.1_opt/sql/sql_connect.cc:1514

#17 0x00005c9bfa178782 in handle_one_connection (arg=arg@entry=0x5c9c2b6324a0)at /test/13.1_opt/sql/sql_connect.cc:1426

#18 0x00005c9bfa5246a3 in pfs_spawn_thread (arg=0x5c9c2b652ac0)at /test/13.1_opt/storage/perfschema/pfs.cc:2198

#19 0x000076cccee9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#20 0x000076cccef29d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Core was generated by `/test/MD170826-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x0000716848d40069 in TDBCSV::ReadBuffer (this=0x71672ffff4f8, g=0x716738049120) at /test/13.1_dbg/storage/connect/tabfmt.cpp:940

[Current thread is 1 (LWP 2394167)]

(gdb) bt

#0  0x0000716848d40069 in TDBCSV::ReadBuffer (this=0x71672ffff4f8, g=0x716738049120) at /test/13.1_dbg/storage/connect/tabfmt.cpp:940

#1  0x0000716848d33849 in TDBDOS::ReadDB (this=0x71672ffff4f8, g=0x716738049120) at /test/13.1_dbg/storage/connect/tabdos.cpp:2275

#2  0x0000716848ce1fbb in CntReadNext (g=0x716738049120, tdbp=0x71672ffff4f8)at /test/13.1_dbg/storage/connect/connect.cc:442

#3  0x0000716848cc9f8c in ha_connect::rnd_next (this=0x716738045da0, buf=0x7167380467b0 "\377", ' ' <repeats 120 times>)at /test/13.1_dbg/storage/connect/ha_connect.cc:4193

#4  0x000064c9e18e73ef in handler::ha_rnd_next (this=0x716738045da0, buf=0x7167380467b0 "\377", ' ' <repeats 120 times>)at /test/13.1_dbg/sql/handler.cc:4051

#5  0x000064c9e12edfb0 in rr_sequential (info=0x71673801da30)at /test/13.1_dbg/sql/records.cc:509

#6  0x000064c9e12d2a86 in READ_RECORD::read_record (this=0x71673801da30)at /test/13.1_dbg/sql/records.h:77

#7  0x000064c9e14fe0a8 in join_init_read_record (tab=0x71673801d960)at /test/13.1_dbg/sql/sql_select.cc:25869

#8  0x000064c9e14d96d1 in sub_select (join=0x71673801bd80, join_tab=0x71673801d960, end_of_records=false)at /test/13.1_dbg/sql/sql_select.cc:24747

#9  0x000064c9e1501295 in do_select (join=0x71673801bd80, procedure=0x0)at /test/13.1_dbg/sql/sql_select.cc:24261

#10 0x000064c9e1500641 in JOIN::exec_inner (this=0x71673801bd80)at /test/13.1_dbg/sql/sql_select.cc:5126

#11 0x000064c9e14ff840 in JOIN::exec (this=0x71673801bd80)at /test/13.1_dbg/sql/sql_select.cc:4914

#12 0x000064c9e14d9ffc in mysql_select (thd=0x716738000d60, tables=0x71673801abc0, fields=@0x71673801a7d8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x71673801ab50, last = 0x71673801c990, elements = 3}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x71673801bd50, unit=0x7167380052f8, select_lex=0x71673801a520) at /test/13.1_dbg/sql/sql_select.cc:5440

#13 0x000064c9e14d9ad5 in handle_select (thd=0x716738000d60, lex=0x716738005218, result=0x71673801bd50, setup_tables_done_option=0)at /test/13.1_dbg/sql/sql_select.cc:637

#14 0x000064c9e1476d9d in execute_sqlcom_select (thd=0x716738000d60, all_tables=0x71673801abc0) at /test/13.1_dbg/sql/sql_parse.cc:6229

#15 0x000064c9e146b8b6 in mysql_execute_command (thd=0x716738000d60, is_called_from_prepared_stmt=false) at /test/13.1_dbg/sql/sql_parse.cc:3997

#16 0x000064c9e1463974 in mysql_parse (thd=0x716738000d60, rawbuf=0x71673801a490 "SELECT * FROM t1", length=16, parser_state=0x7968700a8a80) at /test/13.1_dbg/sql/sql_parse.cc:7968

#17 0x000064c9e1460c9d in dispatch_command (command=COM_QUERY, thd=0x716738000d60, packet=0x71673800b6c1 "", packet_length=16, blocking=true) at /test/13.1_dbg/sql/sql_parse.cc:1903

#18 0x000064c9e1464523 in do_command (thd=0x716738000d60, blocking=true)at /test/13.1_dbg/sql/sql_parse.cc:1437

#19 0x000064c9e1669969 in do_handle_one_connection (connect=0x64c9ea10cda0, put_in_cache=true) at /test/13.1_dbg/sql/sql_connect.cc:1514

#20 0x000064c9e166970e in handle_one_connection (arg=0x64c9ea0c66d0)at /test/13.1_dbg/sql/sql_connect.cc:1426

#21 0x000079687189cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#22 0x0000796871929d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

    Rel    o/d  Build   Commit                                    UniqueID observed

CS  10.6   dbg  170826  210ab6edf47fa73f3b77e974ed2e9357ccdd051c  SIGSEGV|TDBCSV::ReadBuffer|TDBDOS::ReadDB|CntReadNext|ha_connect::rnd_next

CS  10.6   opt  170826  210ab6edf47fa73f3b77e974ed2e9357ccdd051c  SIGSEGV|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next

CS  10.11  dbg  170826  0fe578244bc2904ae482d7836a7e3d4415e3482f  SIGSEGV|TDBCSV::ReadBuffer|TDBDOS::ReadDB|CntReadNext|ha_connect::rnd_next

CS  10.11  opt  170826  0fe578244bc2904ae482d7836a7e3d4415e3482f  SIGSEGV|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next

CS  11.4   dbg  170826  77c8f791618136002e5724ca81f365134b583a29  SIGSEGV|TDBCSV::ReadBuffer|TDBDOS::ReadDB|CntReadNext|ha_connect::rnd_next

CS  11.4   opt  170826  77c8f791618136002e5724ca81f365134b583a29  SIGSEGV|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next

CS  11.8   dbg  170826  d26f9ab217a7fcf9d4eccc62c01020ff275ff42e  SIGSEGV|TDBCSV::ReadBuffer|TDBDOS::ReadDB|CntReadNext|ha_connect::rnd_next

CS  11.8   opt  170826  d26f9ab217a7fcf9d4eccc62c01020ff275ff42e  SIGSEGV|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next

CS  12.3   dbg  170826  91156c3de58762196605150ab3f756fe952592d1  SIGSEGV|TDBCSV::ReadBuffer|TDBDOS::ReadDB|CntReadNext|ha_connect::rnd_next

CS  12.3   opt  170826  91156c3de58762196605150ab3f756fe952592d1  SIGSEGV|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next

CS  13.0   dbg  170826  a848493c6fe031f23606144420c1ca1e467cbd81  SIGSEGV|TDBCSV::ReadBuffer|TDBDOS::ReadDB|CntReadNext|ha_connect::rnd_next

CS  13.0   opt  170826  a848493c6fe031f23606144420c1ca1e467cbd81  SIGSEGV|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next

CS  13.1   dbg  170826  f4299f0bbf38820794295bd4cae427544681cbd1  SIGSEGV|TDBCSV::ReadBuffer|TDBDOS::ReadDB|CntReadNext|ha_connect::rnd_next

CS  13.1   opt  170826  f4299f0bbf38820794295bd4cae427544681cbd1  SIGSEGV|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next

ES  11.4   dbg  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  No bug found

ES  11.4   opt  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  No bug found

ES  11.8   dbg  060526  1499789de285a8109d68d79347de0281865b28f4  No bug found

ES  11.8   opt  060526  1499789de285a8109d68d79347de0281865b28f4  No bug found

 ASAN|heap-buffer-overflow|storage/connect/tabfmt.cpp|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next