SIGSEGV in BDOC::ParseValue when reading a CONNECT table with TABLE_TYPE=BSON containing a malformed BSON file

INSTALL SONAME 'ha_connect';

CREATE TABLE t1 (a CHAR(10)) ENGINE=CONNECT TABLE_TYPE=BSON FILE_NAME='/tmp/bson_short.bson' LRECL=5000;

SELECT * FROM t1;

Core was generated by `/test/MD170826-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  __strnlen_evex () at ../sysdeps/x86_64/multiarch/strnlen-evex.S:403

[Current thread is 1 (LWP 3307783)]

(gdb) bt

#0  __strnlen_evex () at ../sysdeps/x86_64/multiarch/strnlen-evex.S:403

#1  0x0000797cc826983a in __printf_buffer (buf=buf@entry=0x797cc524e3d0, format=0x797cc41ab4cb "Unexpected character '%c' near %.*s", ap=0x797cc524e4a0, mode_flags=0)at ./stdio-common/vfprintf-process-arg.c:433

#2  0x0000797cc828fda6 in __vsnprintf_internal (string=<optimized out>, maxlen=<optimized out>, format=<optimized out>, args=args@entry=0x797cc524e4a0, mode_flags=mode_flags@entry=0)at ./libio/vsnprintf.c:96

#3  0x0000797cc8266406 in __GI___snprintf (s=<optimized out>, maxlen=<optimized out>, format=<optimized out>)at ./stdio-common/snprintf.c:31

#4  0x0000797cc416531d in BDOC::ParseValue (this=this@entry=0x717b87fff578, i=@0x797cc524e5e0: 0, bvp=bvp@entry=0x717b87fff624)at /test/13.1_opt/storage/connect/bson.cpp:402

#5  0x0000797cc41648fa in BDOC::ParseJson (this=0x717b87fff578, g=0x717b8c0369d0, js=<optimized out>, lng=<optimized out>)at /test/13.1_opt/storage/connect/bson.cpp:154

#6  0x0000797cc4177144 in TDBBSON::MakeDocument (this=0x717b87fff410, g=0x717b8c0369d0) at /test/13.1_opt/storage/connect/tabbson.cpp:2282

#7  0x0000797cc417ba34 in TDBBSON::Cardinality (this=0x797cc89b3ffd, g=0x18)at /test/13.1_opt/storage/connect/tabbson.cpp:2398

#8  0x0000797cc40f45eb in CntInfo (g=g@entry=0x717b8c0369d0, tp=0x717b87fff410, info=info@entry=0x717b8c035258)at /test/13.1_opt/storage/connect/connect.cc:166

#9  0x0000797cc40ea889 in ha_connect::info (this=0x717b8c0348f0, flag=18)at /test/13.1_opt/storage/connect/ha_connect.cc:4380

#10 0x000063a23765efa7 in make_join_statistics (join=join@entry=0x717b8c019520, tables_list=@0x717b8c017ed8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x717b8c019ce0, last = 0x717b8c019ce0, elements = 1}, <No data fields>}, keyuse_array=keyuse_array@entry=0x717b8c019878)at /test/13.1_opt/sql/sql_select.cc:5721

#11 0x000063a23765b867 in JOIN::optimize_inner (this=0x717b8c019520)at /test/13.1_opt/sql/sql_select.cc:2764

#12 0x000063a23765a3cd in JOIN::optimize (this=0x797cc89b3ffd, this@entry=0x717b8c019520) at /test/13.1_opt/sql/sql_select.cc:2017

#13 0x000063a23765448a in mysql_select (thd=thd@entry=0x717b8c000c70, tables=<optimized out>, fields=@0x717b8c017f78: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x717b8c0182f0, last = 0x717b8c0182f0, elements = 1}, <No data fields>}, conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x717b8c0194f0, unit=0x717b8c005230, select_lex=0x717b8c017cc0)at /test/13.1_opt/sql/sql_select.cc:5426

#14 0x000063a237654210 in handle_select (thd=thd@entry=0x717b8c000c70, lex=lex@entry=0x717b8c005150, result=result@entry=0x717b8c0194f0, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/13.1_opt/sql/sql_select.cc:637

#15 0x000063a23761f975 in execute_sqlcom_select (thd=thd@entry=0x717b8c000c70, all_tables=0x717b8c018360) at /test/13.1_opt/sql/sql_parse.cc:6229

#16 0x000063a23761b1f1 in mysql_execute_command (thd=thd@entry=0x717b8c000c70, is_called_from_prepared_stmt=false) at /test/13.1_opt/sql/sql_parse.cc:3997

#17 0x000063a2376165d2 in mysql_parse (thd=thd@entry=0x717b8c000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x797cc524f580)at /test/13.1_opt/sql/sql_parse.cc:7968

#18 0x000063a237614b90 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x717b8c000c70, packet=packet@entry=0x717b8c008e61 "SELECT * FROM t1", packet_length=packet_length@entry=16, blocking=true)at /test/13.1_opt/sql/sql_parse.cc:1903

#19 0x000063a237616a51 in do_command (thd=thd@entry=0x717b8c000c70, blocking=true) at /test/13.1_opt/sql/sql_parse.cc:1437

#20 0x000063a23774294d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x63a252e88320, put_in_cache=true)at /test/13.1_opt/sql/sql_connect.cc:1514

#21 0x000063a237742782 in handle_one_connection (arg=arg@entry=0x63a252e88320)at /test/13.1_opt/sql/sql_connect.cc:1426

#22 0x000063a237aee6a3 in pfs_spawn_thread (arg=0x63a252ea8ce0)at /test/13.1_opt/storage/perfschema/pfs.cc:2198

#23 0x0000797cc829cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#24 0x0000797cc8329d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Core was generated by `/test/MD170826-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  __strnlen_evex () at ../sysdeps/x86_64/multiarch/strnlen-evex.S:403

[Current thread is 1 (LWP 3307163)]

(gdb) bt

#0  __strnlen_evex () at ../sysdeps/x86_64/multiarch/strnlen-evex.S:403

#1  0x00007e635166983a in __printf_buffer (buf=buf@entry=0x7e6350079e20, format=0x7e6328bf7717 "Unexpected character '%c' near %.*s", ap=0x7e6350079ef0, mode_flags=0)at ./stdio-common/vfprintf-process-arg.c:433

#2  0x00007e635168fda6 in __vsnprintf_internal (string=<optimized out>, maxlen=<optimized out>, format=<optimized out>, args=args@entry=0x7e6350079ef0, mode_flags=mode_flags@entry=0)at ./libio/vsnprintf.c:96

#3  0x00007e6351666406 in __GI___snprintf (s=<optimized out>, maxlen=<optimized out>, format=<optimized out>)at ./stdio-common/snprintf.c:31

#4  0x00007e6328b8e25c in BDOC::ParseValue (this=0x76622ffff578, i=@0x7e635007a0d0: 0, bvp=0x76622ffff624)at /test/13.1_dbg/storage/connect/bson.cpp:402

#5  0x00007e6328b8cef4 in BDOC::ParseJson (this=0x76622ffff578, g=0x766238049330, js=0x7e6351db9000 "pack('l',5) . \"\\x02\" . \"a\\x00\" . pack('l',2) . \"x\\x00\\x0", lng=63) at /test/13.1_dbg/storage/connect/bson.cpp:154

#6  0x00007e6328bac17f in TDBBSON::MakeDocument (this=0x76622ffff410, g=0x766238049330) at /test/13.1_dbg/storage/connect/tabbson.cpp:2282

#7  0x00007e6328bb303f in TDBBSON::Cardinality (this=0x76622ffff410, g=0x766238049330) at /test/13.1_dbg/storage/connect/tabbson.cpp:2398

#8  0x00007e6328ae0e4c in CntInfo (g=0x766238049330, tp=0x76622ffff410, info=0x766238046c78) at /test/13.1_dbg/storage/connect/connect.cc:166

#9  0x00007e6328ac84fc in ha_connect::info (this=0x766238046310, flag=18)at /test/13.1_dbg/storage/connect/ha_connect.cc:4380

#10 0x000062fabfbf230e in TABLE_LIST::fetch_number_of_rows (this=0x76623801abc0) at /test/13.1_dbg/sql/table.cc:10373

#11 0x000062fabfac69d4 in make_join_statistics (join=0x76623801bd80, tables_list=@0x76623801a738: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x76623801c550, last = 0x76623801c550, elements = 1}, <No data fields>}, keyuse_array=0x76623801c0e0) at /test/13.1_dbg/sql/sql_select.cc:5721

#12 0x000062fabfac0a92 in JOIN::optimize_inner (this=0x76623801bd80)at /test/13.1_dbg/sql/sql_select.cc:2764

#13 0x000062fabfabe35d in JOIN::optimize (this=0x76623801bd80)at /test/13.1_dbg/sql/sql_select.cc:2017

#14 0x000062fabfab5f48 in mysql_select (thd=0x766238000d60, tables=0x76623801abc0, fields=@0x76623801a7d8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x76623801ab50, last = 0x76623801ab50, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x76623801bd50, unit=0x7662380052f8, select_lex=0x76623801a520) at /test/13.1_dbg/sql/sql_select.cc:5426

#15 0x000062fabfab5ad5 in handle_select (thd=0x766238000d60, lex=0x766238005218, result=0x76623801bd50, setup_tables_done_option=0)at /test/13.1_dbg/sql/sql_select.cc:637

#16 0x000062fabfa52d9d in execute_sqlcom_select (thd=0x766238000d60, all_tables=0x76623801abc0) at /test/13.1_dbg/sql/sql_parse.cc:6229

#17 0x000062fabfa478b6 in mysql_execute_command (thd=0x766238000d60, is_called_from_prepared_stmt=false) at /test/13.1_dbg/sql/sql_parse.cc:3997

#18 0x000062fabfa3f974 in mysql_parse (thd=0x766238000d60, rawbuf=0x76623801a490 "SELECT * FROM t1", length=16, parser_state=0x7e635007ca80) at /test/13.1_dbg/sql/sql_parse.cc:7968

#19 0x000062fabfa3cc9d in dispatch_command (command=COM_QUERY, thd=0x766238000d60, packet=0x76623800b6c1 "SELECT * FROM t1", packet_length=16, blocking=true) at /test/13.1_dbg/sql/sql_parse.cc:1903

#20 0x000062fabfa40523 in do_command (thd=0x766238000d60, blocking=true)at /test/13.1_dbg/sql/sql_parse.cc:1437

#21 0x000062fabfc45969 in do_handle_one_connection (connect=0x62facf4ecda0, put_in_cache=true) at /test/13.1_dbg/sql/sql_connect.cc:1514

#22 0x000062fabfc4570e in handle_one_connection (arg=0x62facf4a66d0)at /test/13.1_dbg/sql/sql_connect.cc:1426

#23 0x00007e635169cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#24 0x00007e6351729d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

    Rel    o/d  Build   Commit                                    UniqueID observed

CS  10.6   dbg  170826  210ab6edf47fa73f3b77e974ed2e9357ccdd051c  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

CS  10.6   opt  170826  210ab6edf47fa73f3b77e974ed2e9357ccdd051c  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

CS  10.11  dbg  170826  0fe578244bc2904ae482d7836a7e3d4415e3482f  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

CS  10.11  opt  170826  0fe578244bc2904ae482d7836a7e3d4415e3482f  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

CS  11.4   dbg  170826  77c8f791618136002e5724ca81f365134b583a29  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

CS  11.4   opt  170826  77c8f791618136002e5724ca81f365134b583a29  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

CS  11.8   dbg  170826  d26f9ab217a7fcf9d4eccc62c01020ff275ff42e  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

CS  11.8   opt  170826  d26f9ab217a7fcf9d4eccc62c01020ff275ff42e  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

CS  12.3   dbg  170826  91156c3de58762196605150ab3f756fe952592d1  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

CS  12.3   opt  170826  91156c3de58762196605150ab3f756fe952592d1  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

CS  13.0   dbg  170826  a848493c6fe031f23606144420c1ca1e467cbd81  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

CS  13.0   opt  170826  a848493c6fe031f23606144420c1ca1e467cbd81  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

CS  13.1   dbg  170826  f4299f0bbf38820794295bd4cae427544681cbd1  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

CS  13.1   opt  170826  f4299f0bbf38820794295bd4cae427544681cbd1  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

ES  11.4   dbg  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

ES  11.4   opt  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

ES  11.8   dbg  060526  1499789de285a8109d68d79347de0281865b28f4  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

ES  11.8   opt  060526  1499789de285a8109d68d79347de0281865b28f4  SIGSEGV|__strnlen_evex|__vsnprintf_internal|__GI___snprintf|BDOC::ParseValue

(Builds used: /test/UBASAN_MD290726-mariadb-11.4.13-linux-x86_64-opt and _dbg)

 opt: UBSAN|addition of unsigned offset to X overflowed to Y|storage/connect/bson.cpp|BDOC::ParseValue|BDOC::ParseJson|TDBBSON::MakeDocument|TDBBSON::Cardinality

 dbg: UBSAN|addition of unsigned offset to X overflowed to Y|storage/connect/bson.cpp|BDOC::ParseValue|BDOC::ParseJson|TDBBSON::MakeDocument|TDBBSON::Cardinality

/test/11.4_opt_san/storage/connect/bson.cpp:402:95: runtime error: addition of unsigned offset to 0x79c2e40ca000 overflowed to 0x79c2e40c9ffd

    #0 0x71c22f9c52a5 in BDOC::ParseValue(unsigned long&, _jvalue*) /test/11.4_opt_san/storage/connect/bson.cpp:402:95

    #1 0x71c22f9bf185 in BDOC::ParseJson(_global*, char*, unsigned long) /test/11.4_opt_san/storage/connect/bson.cpp:154:39

    #2 0x71c22fa33d2b in TDBBSON::MakeDocument(_global*) /test/11.4_opt_san/storage/connect/tabbson.cpp:2282:19

    #3 0x71c22fa633ed in TDBBSON::Cardinality(_global*) /test/11.4_opt_san/storage/connect/tabbson.cpp:2398:11

    #4 0x71c22f61336f in CntInfo(_global*, TDB*, _xinfo*) /test/11.4_opt_san/storage/connect/connect.cc:172:36

    #5 0x71c22f5e3177 in ha_connect::info(unsigned int) /test/11.4_opt_san/storage/connect/ha_connect.cc:4389:17

    #6 0x58cb6979ebd1 in make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*) /test/11.4_opt_san/sql/sql_select.cc:5693:20

    #7 0x58cb6978a135 in JOIN::optimize_inner() /test/11.4_opt_san/sql/sql_select.cc:2744:7

    #8 0x58cb697846f8 in JOIN::optimize() /test/11.4_opt_san/sql/sql_select.cc:2016:10

    #9 0x58cb69767739 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.4_opt_san/sql/sql_select.cc:5402:19

    #10 0x58cb697660fb in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.4_opt_san/sql/sql_select.cc:643:10

    #11 0x58cb6964aa78 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/11.4_opt_san/sql/sql_parse.cc:6222:12

    #12 0x58cb6962bd7c in mysql_execute_command(THD*, bool) /test/11.4_opt_san/sql/sql_parse.cc:4010:12

    #13 0x58cb6960cb12 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.4_opt_san/sql/sql_parse.cc:7941:18

    #14 0x58cb69602ded in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.4_opt_san/sql/sql_parse.cc:1925:7

    #15 0x58cb6960e34c in do_command(THD*, bool) /test/11.4_opt_san/sql/sql_parse.cc:1433:17

    #16 0x58cb69d163cc in do_handle_one_connection(CONNECT*, bool) /test/11.4_opt_san/sql/sql_connect.cc:1508:11

    #17 0x58cb69d15b06 in handle_one_connection /test/11.4_opt_san/sql/sql_connect.cc:1420:5

    #18 0x58cb6a5956ec in pfs_spawn_thread /test/11.4_opt_san/storage/perfschema/pfs.cc:2201:3

    #19 0x58cb686084dc in asan_thread_start(void*) crtstuff.c

    #20 0x79c2e3a9cb83 in start_thread nptl/pthread_create.c:447:8

    #21 0x79c2e3b29d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: pointer-overflow /test/11.4_opt_san/storage/connect/bson.cpp:402:95