Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.11, 11.4, 11.8, 12.3, 13.0, 13.1
-
Can result in hang or crash
Description
INSTALL SONAME 'ha_connect'; |
CREATE TABLE t1( name CHAR(20) NOT NULL, birth CHAR(10) NOT NULL, children SMALLINT(2) NOT NULL) ENGINE=CONNECT TABLE_TYPE=CSV FILE_NAME='/tmp/csv_unterminated.csv' SEP_CHAR=';' QUOTED=1; |
SELECT * FROM t1; |
Leads to:
|
CS 13.1.0 f4299f0bbf38820794295bd4cae427544681cbd1 (Optimized, Clang 18.1.3-11) Build 17/08/2026 |
Core was generated by `/test/MD170826-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 TDBCSV::ReadBuffer (this=0x6ecbcffff4f8, g=0x6ecbd80368b0)at /test/13.1_opt/storage/connect/tabfmt.cpp:940
|
|
|
[Current thread is 1 (LWP 2393705)]
|
(gdb) bt
|
#0 TDBCSV::ReadBuffer (this=0x6ecbcffff4f8, g=0x6ecbd80368b0)at /test/13.1_opt/storage/connect/tabfmt.cpp:940
|
#1 0x000076cc826f4e74 in CntReadNext (g=0x6ecbd80368b0, tdbp=0x6ecbcffff4f8)at /test/13.1_opt/storage/connect/connect.cc:442
|
#2 0x000076cc826ebbfd in ha_connect::rnd_next (this=0x6ecbd80348f0, buf=0x6ecbd8035300 "\377", ' ' <repeats 120 times>)at /test/13.1_opt/storage/connect/ha_connect.cc:4193
|
#3 0x00005c9bfa2d691f in handler::ha_rnd_next (this=0x6ecbd80348f0, buf=0x6ecbd8035300 "\377", ' ' <repeats 120 times>)at /test/13.1_opt/sql/handler.cc:4051
|
#4 0x00005c9bf9f7fcb9 in rr_sequential (info=0x6ecbd801b150)at /test/13.1_opt/sql/records.cc:509
|
#5 0x00005c9bfa089d3d in sub_select (join=0x6ecbd8019520, join_tab=0x6ecbd801b080, end_of_records=<optimized out>)at /test/13.1_opt/sql/sql_select.cc:24747
|
#6 0x00005c9bfa0a42a6 in do_select (join=join@entry=0x6ecbd8019520, procedure=<optimized out>) at /test/13.1_opt/sql/sql_select.cc:24261
|
#7 0x00005c9bfa0a3d79 in JOIN::exec_inner (this=this@entry=0x6ecbd8019520)at /test/13.1_opt/sql/sql_select.cc:5126
|
#8 0x00005c9bfa08a530 in JOIN::exec (this=0x6ecbd8019520)at /test/13.1_opt/sql/sql_select.cc:4914
|
#9 mysql_select (thd=thd@entry=0x6ecbd8000c70, tables=<optimized out>, fields=@0x6ecbd8017f78: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6ecbd80182f0, last = 0x6ecbd801a120, elements = 3}, <No data fields>}, conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x6ecbd80194f0, unit=0x6ecbd8005230, select_lex=0x6ecbd8017cc0)at /test/13.1_opt/sql/sql_select.cc:5440
|
#10 0x00005c9bfa08a210 in handle_select (thd=thd@entry=0x6ecbd8000c70, lex=lex@entry=0x6ecbd8005150, result=result@entry=0x6ecbd80194f0, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/13.1_opt/sql/sql_select.cc:637
|
#11 0x00005c9bfa055975 in execute_sqlcom_select (thd=thd@entry=0x6ecbd8000c70, all_tables=0x6ecbd8018360) at /test/13.1_opt/sql/sql_parse.cc:6229
|
#12 0x00005c9bfa0511f1 in mysql_execute_command (thd=thd@entry=0x6ecbd8000c70, is_called_from_prepared_stmt=false) at /test/13.1_opt/sql/sql_parse.cc:3997
|
#13 0x00005c9bfa04c5d2 in mysql_parse (thd=thd@entry=0x6ecbd8000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x76cca1667580)at /test/13.1_opt/sql/sql_parse.cc:7968
|
#14 0x00005c9bfa04ab90 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x6ecbd8000c70, packet=packet@entry=0x6ecbd8008e61 "", packet_length=packet_length@entry=16, blocking=true)at /test/13.1_opt/sql/sql_parse.cc:1903
|
#15 0x00005c9bfa04ca51 in do_command (thd=thd@entry=0x6ecbd8000c70, blocking=true) at /test/13.1_opt/sql/sql_parse.cc:1437
|
#16 0x00005c9bfa17894d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5c9c2b6324a0, put_in_cache=true)at /test/13.1_opt/sql/sql_connect.cc:1514
|
#17 0x00005c9bfa178782 in handle_one_connection (arg=arg@entry=0x5c9c2b6324a0)at /test/13.1_opt/sql/sql_connect.cc:1426
|
#18 0x00005c9bfa5246a3 in pfs_spawn_thread (arg=0x5c9c2b652ac0)at /test/13.1_opt/storage/perfschema/pfs.cc:2198
|
#19 0x000076cccee9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#20 0x000076cccef29d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
CS 13.1.0 f4299f0bbf38820794295bd4cae427544681cbd1 (Debug, Clang 18.1.3-11) Build 17/08/2026 |
Core was generated by `/test/MD170826-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x0000716848d40069 in TDBCSV::ReadBuffer (this=0x71672ffff4f8, g=0x716738049120) at /test/13.1_dbg/storage/connect/tabfmt.cpp:940
|
|
|
[Current thread is 1 (LWP 2394167)]
|
(gdb) bt
|
#0 0x0000716848d40069 in TDBCSV::ReadBuffer (this=0x71672ffff4f8, g=0x716738049120) at /test/13.1_dbg/storage/connect/tabfmt.cpp:940
|
#1 0x0000716848d33849 in TDBDOS::ReadDB (this=0x71672ffff4f8, g=0x716738049120) at /test/13.1_dbg/storage/connect/tabdos.cpp:2275
|
#2 0x0000716848ce1fbb in CntReadNext (g=0x716738049120, tdbp=0x71672ffff4f8)at /test/13.1_dbg/storage/connect/connect.cc:442
|
#3 0x0000716848cc9f8c in ha_connect::rnd_next (this=0x716738045da0, buf=0x7167380467b0 "\377", ' ' <repeats 120 times>)at /test/13.1_dbg/storage/connect/ha_connect.cc:4193
|
#4 0x000064c9e18e73ef in handler::ha_rnd_next (this=0x716738045da0, buf=0x7167380467b0 "\377", ' ' <repeats 120 times>)at /test/13.1_dbg/sql/handler.cc:4051
|
#5 0x000064c9e12edfb0 in rr_sequential (info=0x71673801da30)at /test/13.1_dbg/sql/records.cc:509
|
#6 0x000064c9e12d2a86 in READ_RECORD::read_record (this=0x71673801da30)at /test/13.1_dbg/sql/records.h:77
|
#7 0x000064c9e14fe0a8 in join_init_read_record (tab=0x71673801d960)at /test/13.1_dbg/sql/sql_select.cc:25869
|
#8 0x000064c9e14d96d1 in sub_select (join=0x71673801bd80, join_tab=0x71673801d960, end_of_records=false)at /test/13.1_dbg/sql/sql_select.cc:24747
|
#9 0x000064c9e1501295 in do_select (join=0x71673801bd80, procedure=0x0)at /test/13.1_dbg/sql/sql_select.cc:24261
|
#10 0x000064c9e1500641 in JOIN::exec_inner (this=0x71673801bd80)at /test/13.1_dbg/sql/sql_select.cc:5126
|
#11 0x000064c9e14ff840 in JOIN::exec (this=0x71673801bd80)at /test/13.1_dbg/sql/sql_select.cc:4914
|
#12 0x000064c9e14d9ffc in mysql_select (thd=0x716738000d60, tables=0x71673801abc0, fields=@0x71673801a7d8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x71673801ab50, last = 0x71673801c990, elements = 3}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x71673801bd50, unit=0x7167380052f8, select_lex=0x71673801a520) at /test/13.1_dbg/sql/sql_select.cc:5440
|
#13 0x000064c9e14d9ad5 in handle_select (thd=0x716738000d60, lex=0x716738005218, result=0x71673801bd50, setup_tables_done_option=0)at /test/13.1_dbg/sql/sql_select.cc:637
|
#14 0x000064c9e1476d9d in execute_sqlcom_select (thd=0x716738000d60, all_tables=0x71673801abc0) at /test/13.1_dbg/sql/sql_parse.cc:6229
|
#15 0x000064c9e146b8b6 in mysql_execute_command (thd=0x716738000d60, is_called_from_prepared_stmt=false) at /test/13.1_dbg/sql/sql_parse.cc:3997
|
#16 0x000064c9e1463974 in mysql_parse (thd=0x716738000d60, rawbuf=0x71673801a490 "SELECT * FROM t1", length=16, parser_state=0x7968700a8a80) at /test/13.1_dbg/sql/sql_parse.cc:7968
|
#17 0x000064c9e1460c9d in dispatch_command (command=COM_QUERY, thd=0x716738000d60, packet=0x71673800b6c1 "", packet_length=16, blocking=true) at /test/13.1_dbg/sql/sql_parse.cc:1903
|
#18 0x000064c9e1464523 in do_command (thd=0x716738000d60, blocking=true)at /test/13.1_dbg/sql/sql_parse.cc:1437
|
#19 0x000064c9e1669969 in do_handle_one_connection (connect=0x64c9ea10cda0, put_in_cache=true) at /test/13.1_dbg/sql/sql_connect.cc:1514
|
#20 0x000064c9e166970e in handle_one_connection (arg=0x64c9ea0c66d0)at /test/13.1_dbg/sql/sql_connect.cc:1426
|
#21 0x000079687189cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#22 0x0000796871929d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 170826 210ab6edf47fa73f3b77e974ed2e9357ccdd051c SIGSEGV|TDBCSV::ReadBuffer|TDBDOS::ReadDB|CntReadNext|ha_connect::rnd_next
|
CS 10.6 opt 170826 210ab6edf47fa73f3b77e974ed2e9357ccdd051c SIGSEGV|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next
|
CS 10.11 dbg 170826 0fe578244bc2904ae482d7836a7e3d4415e3482f SIGSEGV|TDBCSV::ReadBuffer|TDBDOS::ReadDB|CntReadNext|ha_connect::rnd_next
|
CS 10.11 opt 170826 0fe578244bc2904ae482d7836a7e3d4415e3482f SIGSEGV|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next
|
CS 11.4 dbg 170826 77c8f791618136002e5724ca81f365134b583a29 SIGSEGV|TDBCSV::ReadBuffer|TDBDOS::ReadDB|CntReadNext|ha_connect::rnd_next
|
CS 11.4 opt 170826 77c8f791618136002e5724ca81f365134b583a29 SIGSEGV|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next
|
CS 11.8 dbg 170826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e SIGSEGV|TDBCSV::ReadBuffer|TDBDOS::ReadDB|CntReadNext|ha_connect::rnd_next
|
CS 11.8 opt 170826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e SIGSEGV|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next
|
CS 12.3 dbg 170826 91156c3de58762196605150ab3f756fe952592d1 SIGSEGV|TDBCSV::ReadBuffer|TDBDOS::ReadDB|CntReadNext|ha_connect::rnd_next
|
CS 12.3 opt 170826 91156c3de58762196605150ab3f756fe952592d1 SIGSEGV|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next
|
CS 13.0 dbg 170826 a848493c6fe031f23606144420c1ca1e467cbd81 SIGSEGV|TDBCSV::ReadBuffer|TDBDOS::ReadDB|CntReadNext|ha_connect::rnd_next
|
CS 13.0 opt 170826 a848493c6fe031f23606144420c1ca1e467cbd81 SIGSEGV|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next
|
CS 13.1 dbg 170826 f4299f0bbf38820794295bd4cae427544681cbd1 SIGSEGV|TDBCSV::ReadBuffer|TDBDOS::ReadDB|CntReadNext|ha_connect::rnd_next
|
CS 13.1 opt 170826 f4299f0bbf38820794295bd4cae427544681cbd1 SIGSEGV|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next
|
ES 11.4 dbg 060526 90f707057d44f1b5c013a0c3672fd12f32ea7085 No bug found
|
ES 11.4 opt 060526 90f707057d44f1b5c013a0c3672fd12f32ea7085 No bug found
|
ES 11.8 dbg 060526 1499789de285a8109d68d79347de0281865b28f4 No bug found
|
ES 11.8 opt 060526 1499789de285a8109d68d79347de0281865b28f4 No bug found
|
SAN ID
ASAN|heap-buffer-overflow|storage/connect/tabfmt.cpp|TDBCSV::ReadBuffer|CntReadNext|ha_connect::rnd_next|handler::ha_rnd_next
|
