Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41023

BINARY(0) leads to SIGSEGV in row_search_mvcc

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Major
    • Resolution: Unresolved
    • 10.11, 11.4, 11.8, 12.3, 13.0, 13.1
    • 10.11, 11.4, 11.8, 12.3, 13.0
    • None
    • None
    • Can result in hang or crash

    Description

      --source include/have_innodb.inc
      CREATE TABLE t1 (a BINARY(0), PRIMARY KEY (a)) ENGINE=InnoDB;
      INSERT INTO t1 VALUES ('');
      SELECT * FROM t1, t1 AS t2 WHERE t1.a=t2.a;
      

      Leads to:

      CS 13.1.0 b2a8c2234dbc276fe3947633c9ffea454badf48f (Optimized, Clang 22.1.8-20260621) Build 03/09/2026

      Core was generated by `/test/MD030926-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  row_search_mvcc<InnoDBPolicy<true, true> > (buf=0x7764c0056830 "\377", mode=PAGE_CUR_GE, prebuilt=0x7764c0057fd8, match_mode=1, direction=direction@entry=0)at /test/13.1_opt/storage/innobase/row/row0sel.cc:5089
       
      [Current thread is 1 (LWP 1930977)]
      (gdb) bt
      #0  row_search_mvcc<InnoDBPolicy<true, true> > (buf=0x7764c0056830 "\377", mode=PAGE_CUR_GE, prebuilt=0x7764c0057fd8, match_mode=1, direction=direction@entry=0)at /test/13.1_opt/storage/innobase/row/row0sel.cc:5089
      #1  0x000055d9066a1836 in ha_innobase::index_read (this=0x7764c0055fa0, buf=<optimized out>, key_ptr=<optimized out>, key_len=<optimized out>, find_flag=<optimized out>)at /test/13.1_opt/storage/innobase/handler/ha_innodb.cc:9224
      #2  0x000055d9063c26a2 in handler::ha_index_read_map (this=0x7764c0055fa0, buf=0x7764c0056830 "\377", key=<optimized out>, keypart_map=<optimized out>, find_flag=find_flag@entry=HA_READ_KEY_EXACT)at /test/13.1_opt/sql/handler.cc:4138
      #3  0x000055d9061aa837 in join_read_key2 (thd=0x7764c0000c70, tab=0x7764c001d748, table=0x7764c0055b40, table_ref=0x7764c001da30)at /test/13.1_opt/sql/sql_select.cc:25468
      #4  0x000055d90617447d in sub_select (join=0x7764c001a170, join_tab=0x7764c001d748, end_of_records=<optimized out>)at /test/13.1_opt/sql/sql_select.cc:24747
      #5  0x000055d9061aa48d in evaluate_join_record (join=join@entry=0x7764c001a170, join_tab=join_tab@entry=0x7764c001d2d0, error=<optimized out>) at /test/13.1_opt/sql/sql_select.cc:24983
      #6  0x000055d9061744b1 in sub_select (join=0x7764c001a170, join_tab=0x7764c001d2d0, end_of_records=<optimized out>)at /test/13.1_opt/sql/sql_select.cc:24750
      #7  0x000055d90618e9f3 in do_select (join=join@entry=0x7764c001a170, procedure=<optimized out>) at /test/13.1_opt/sql/sql_select.cc:24261
      #8  0x000055d90618e4c9 in JOIN::exec_inner (this=this@entry=0x7764c001a170)at /test/13.1_opt/sql/sql_select.cc:5126
      #9  0x000055d906174d47 in JOIN::exec (this=0x7764c001a170)at /test/13.1_opt/sql/sql_select.cc:4914
      #10 mysql_select (thd=thd@entry=0x7764c0000c70, tables=<optimized out>, fields=@0x7764c0017fa8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7764c0018320, last = 0x7764c001ac10, elements = 2}, <No data fields>}, conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x7764c001a140, unit=0x7764c0005230, select_lex=0x7764c0017cf0)at /test/13.1_opt/sql/sql_select.cc:5440
      #11 0x000055d906174960 in handle_select (thd=thd@entry=0x7764c0000c70, lex=lex@entry=0x7764c0005150, result=result@entry=0x7764c001a140, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/13.1_opt/sql/sql_select.cc:637
      #12 0x000055d906140427 in execute_sqlcom_select (thd=thd@entry=0x7764c0000c70, all_tables=0x7764c0018390) at /test/13.1_opt/sql/sql_parse.cc:6229
      #13 0x000055d90613bc67 in mysql_execute_command (thd=thd@entry=0x7764c0000c70, is_called_from_prepared_stmt=false) at /test/13.1_opt/sql/sql_parse.cc:3997
      #14 0x000055d906136ecd in mysql_parse (thd=thd@entry=0x7764c0000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7f65abe774e0)at /test/13.1_opt/sql/sql_parse.cc:7968
      #15 0x000055d9061356a5 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7764c0000c70, packet=packet@entry=0x7764c0008e61 "", packet_length=packet_length@entry=42, blocking=true)at /test/13.1_opt/sql/sql_parse.cc:1903
      #16 0x000055d906137350 in do_command (thd=thd@entry=0x7764c0000c70, blocking=true) at /test/13.1_opt/sql/sql_parse.cc:1437
      #17 0x000055d906262f7d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55d9116bc2b0, put_in_cache=true)at /test/13.1_opt/sql/sql_connect.cc:1514
      #18 0x000055d906262db2 in handle_one_connection (arg=arg@entry=0x55d9116bc2b0)at /test/13.1_opt/sql/sql_connect.cc:1426
      #19 0x000055d906610b43 in pfs_spawn_thread (arg=0x55d9116dce10)at /test/13.1_opt/storage/perfschema/pfs.cc:2198
      #20 0x00007f65d9a9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #21 0x00007f65d9b29d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      CS 13.1.0 b2a8c2234dbc276fe3947633c9ffea454badf48f (Debug, Clang 22.1.8-20260621) Build 03/09/2026

      mariadbd: /test/13.1_dbg/sql/sql_select.cc:13793: bool create_ref_for_key(JOIN *, JOIN_TAB *, KEYUSE *, bool, table_map): Assertion `length > 0' failed.
      

      CS 13.1.0 b2a8c2234dbc276fe3947633c9ffea454badf48f (Debug, Clang 22.1.8-20260621) Build 03/09/2026

      Core was generated by `/test/MD030926-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
       
      [Current thread is 1 (LWP 1930936)]
      (gdb) bt
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
      #1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
      #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
      #3  0x0000713c0004527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
      #4  0x0000713c000288ff in __GI_abort () at ./stdlib/abort.c:79
      #5  0x0000713c0002881b in __assert_fail_base (fmt=0x713c001d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5eaaf093fb61 "length > 0", file=file@entry=0x5eaaf0734038 "/test/13.1_dbg/sql/sql_select.cc", line=line@entry=13793, function=function@entry=0x5eaaf0738ba4 "bool create_ref_for_key(JOIN *, JOIN_TAB *, KEYUSE *, bool, table_map)") at ./assert/assert.c:96
      #6  0x0000713c0003b517 in __assert_fail (assertion=0x5eaaf093fb61 "length > 0", file=0x5eaaf0734038 "/test/13.1_dbg/sql/sql_select.cc", line=13793, function=0x5eaaf0738ba4 "bool create_ref_for_key(JOIN *, JOIN_TAB *, KEYUSE *, bool, table_map)") at ./assert/assert.c:105
      #7  0x00005eaaef7b1722 in create_ref_for_key (join=0x693ac801c9d0, j=0x693ac8020028, org_keyuse=0x693ac801f528, allow_full_scan=true, used_tables=4611686018427387907) at /test/13.1_dbg/sql/sql_select.cc:13793
      #8  0x00005eaaef7908ef in JOIN::get_best_combination (this=0x693ac801c9d0)at /test/13.1_dbg/sql/sql_select.cc:13542
      #9  0x00005eaaef787d3f in JOIN::optimize_stage2 (this=0x693ac801c9d0)at /test/13.1_dbg/sql/sql_select.cc:2824
      #10 0x00005eaaef787abf in JOIN::optimize_inner (this=0x693ac801c9d0)at /test/13.1_dbg/sql/sql_select.cc:2790
      #11 0x00005eaaef785696 in JOIN::optimize (this=0x693ac801c9d0)at /test/13.1_dbg/sql/sql_select.cc:2017
      #12 0x00005eaaef77decd in mysql_select (thd=0x693ac8000d60, tables=0x693ac801abf0, fields=@0x693ac801a808: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x693ac801ab80, last = 0x693ac801d480, elements = 2}, <No data fields>}, conds=0x693ac801bde0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x693ac801c9a0, unit=0x693ac80052f8, select_lex=0x693ac801a550)at /test/13.1_dbg/sql/sql_select.cc:5426
      #13 0x00005eaaef77dacd in handle_select (thd=0x693ac8000d60, lex=0x693ac8005218, result=0x693ac801c9a0, setup_tables_done_option=0)at /test/13.1_dbg/sql/sql_select.cc:637
      #14 0x00005eaaef7238c6 in execute_sqlcom_select (thd=0x693ac8000d60, all_tables=0x693ac801abf0) at /test/13.1_dbg/sql/sql_parse.cc:6229
      #15 0x00005eaaef719b2b in mysql_execute_command (thd=0x693ac8000d60, is_called_from_prepared_stmt=false) at /test/13.1_dbg/sql/sql_parse.cc:3997
      #16 0x00005eaaef7128b8 in mysql_parse (thd=0x693ac8000d60, rawbuf=0x693ac801a490 "SELECT * FROM t1, t1 AS t2 WHERE t1.a=t2.a", length=42, parser_state=0x713bd88059c0)at /test/13.1_dbg/sql/sql_parse.cc:7968
      #17 0x00005eaaef70ffde in dispatch_command (command=COM_QUERY, thd=0x693ac8000d60, packet=0x693ac800b6c1 "SELECT * FROM t1, t1 AS t2 WHERE t1.a=t2.a", packet_length=42, blocking=true) at /test/13.1_dbg/sql/sql_parse.cc:1903
      #18 0x00005eaaef71333a in do_command (thd=0x693ac8000d60, blocking=true)at /test/13.1_dbg/sql/sql_parse.cc:1437
      #19 0x00005eaaef8eaa5e in do_handle_one_connection (connect=0x5eab1c122560, put_in_cache=true) at /test/13.1_dbg/sql/sql_connect.cc:1514
      #20 0x00005eaaef8ea841 in handle_one_connection (arg=0x5eab1c0baf10)at /test/13.1_dbg/sql/sql_connect.cc:1426
      #21 0x0000713c0009cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #22 0x0000713c00129d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.11  dbg  030926  1bc9eca856a32065fddce1db68edcfa6f4342578  length > 0|SIGABRT|create_ref_for_key|JOIN::get_best_combination|JOIN::optimize_stage2|JOIN::optimize_inner
      CS  10.11  opt  030926  1bc9eca856a32065fddce1db68edcfa6f4342578  SIGSEGV|row_search_mvcc|ha_innobase::index_read|handler::ha_index_read_map|join_read_key2
      CS  11.4   dbg  030926  79f96bf15d2538cb78201cc85681571f56548957  length > 0|SIGABRT|create_ref_for_key|JOIN::get_best_combination|JOIN::optimize_stage2|JOIN::optimize_inner
      CS  11.4   opt  030926  79f96bf15d2538cb78201cc85681571f56548957  SIGSEGV|row_search_mvcc|ha_innobase::index_read|handler::ha_index_read_map|join_read_key2
      CS  11.8   dbg  030926  e2e060ce3d8c3ce11b6c7ba28ced0f1a30c50a54  length > 0|SIGABRT|create_ref_for_key|JOIN::get_best_combination|JOIN::optimize_stage2|JOIN::optimize_inner
      CS  11.8   opt  030926  e2e060ce3d8c3ce11b6c7ba28ced0f1a30c50a54  SIGSEGV|row_search_mvcc|ha_innobase::index_read|handler::ha_index_read_map|join_read_key2
      CS  12.3   dbg  030926  ab9657491197ac6a32f4f325388badda974f2fe2  length > 0|SIGABRT|create_ref_for_key|JOIN::get_best_combination|JOIN::optimize_stage2|JOIN::optimize_inner
      CS  12.3   opt  030926  ab9657491197ac6a32f4f325388badda974f2fe2  SIGSEGV|row_search_mvcc|ha_innobase::index_read|handler::ha_index_read_map|join_read_key2
      CS  13.0   dbg  030926  b2c4e675049e23ce8c7346985f40840fcd4e583f  length > 0|SIGABRT|create_ref_for_key|JOIN::get_best_combination|JOIN::optimize_stage2|JOIN::optimize_inner
      CS  13.0   opt  030926  b2c4e675049e23ce8c7346985f40840fcd4e583f  SIGSEGV|row_search_mvcc|ha_innobase::index_read|handler::ha_index_read_map|join_read_key2
      CS  13.1   dbg  030926  b2a8c2234dbc276fe3947633c9ffea454badf48f  length > 0|SIGABRT|create_ref_for_key|JOIN::get_best_combination|JOIN::optimize_stage2|JOIN::optimize_inner
      CS  13.1   opt  030926  b2a8c2234dbc276fe3947633c9ffea454badf48f  SIGSEGV|row_search_mvcc<InnoDBPolicy<true, true> >|ha_innobase::index_read|handler::ha_index_read_map|join_read_key2
      ES  10.6   dbg  030926  47e099839c30841f59054ff738662d3fd5f58a08  length > 0|SIGABRT|create_ref_for_key|JOIN::get_best_combination|JOIN::optimize_stage2|JOIN::optimize_inner
      ES  10.6   opt  030926  47e099839c30841f59054ff738662d3fd5f58a08  SIGSEGV|row_search_mvcc|ha_innobase::index_read|handler::ha_index_read_map|join_read_key2
      ES  11.4   dbg  030926  e953e9092e7e78da74eec4a80ead7b67d55f3772  length > 0|SIGABRT|create_ref_for_key|JOIN::get_best_combination|JOIN::optimize_stage2|JOIN::optimize_inner
      ES  11.4   opt  030926  e953e9092e7e78da74eec4a80ead7b67d55f3772  SIGSEGV|row_search_mvcc|ha_innobase::index_read|handler::ha_index_read_map|join_read_key2
      ES  11.8   dbg  030926  72bfb892c8537baa3e0e5ea16e24e79171a9be22  length > 0|SIGABRT|create_ref_for_key|JOIN::get_best_combination|JOIN::optimize_stage2|JOIN::optimize_inner
      ES  11.8   opt  030926  72bfb892c8537baa3e0e5ea16e24e79171a9be22  SIGSEGV|row_search_mvcc|ha_innobase::index_read|handler::ha_index_read_map|join_read_key2
      ES  12.3   dbg  030926  31a1c7393d7f943ff9e335c84923988876681b44  length > 0|SIGABRT|create_ref_for_key|JOIN::get_best_combination|JOIN::optimize_stage2|JOIN::optimize_inner
      ES  12.3   opt  030926  31a1c7393d7f943ff9e335c84923988876681b44  SIGSEGV|row_search_mvcc|ha_innobase::index_read|handler::ha_index_read_map|join_read_key2
      

      Attachments

        Issue Links

          Activity

            People

              raghunandan.bhat Raghunandan Bhat
              saahil Saahil Alam
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - 0d
                  0d
                  Remaining:
                  Time Spent - 1.75h Remaining Estimate - 1.5d
                  1.5d
                  Logged:
                  Time Spent - 1.75h Remaining Estimate - 1.5d
                  1.75h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.