UBSAN: null pointer passed as argument 2 in name_hash_search on CALL w/ DENY EXECUTE & SET PATH ALL

CREATE ROLE r2;

SET PATH ALL;

DENY EXECUTE ON * TO PUBLIC;

SET ROLE r2;

CALL sp1();

/test/13.1_dbg_san/sql/char_buffer.h:126:31: runtime error: null pointer passed as argument 2, which is declared to never be null

/usr/include/string.h:44:28: note: nonnull attribute specified here

    #0 0x5bde7a2d1024 in CharBuffer<793ul>::append(st_mysql_const_lex_string const&) /test/13.1_dbg_san/sql/char_buffer.h:126:5

    #1 0x5bde7a2a6d29 in name_hash_search(st_hash*, char const*, char const*, char const*, char const*, char const*, bool, bool) /test/13.1_dbg_san/sql/sql_acl.cc:6746:7

    #2 0x5bde7a27063d in routine_hash_search(char const*, char const*, char const*, char const*, char const*, Sp_handler const*, bool) /test/13.1_dbg_san/sql/sql_acl.cc:6785:5

    #3 0x5bde7a27063d in check_grant_routine(THD*, privilege_t, TABLE_LIST*, Sp_handler const*, bool) /test/13.1_dbg_san/sql/sql_acl.cc:10756:14

    #4 0x5bde7a65d7c4 in check_routine_access(THD*, privilege_t, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Sp_handler const*, bool) /test/13.1_dbg_san/sql/sql_parse.cc:7194:10

    #5 0x5bde7a65ce82 in Sql_cmd_call::execute(THD*) /test/13.1_dbg_san/sql/sql_parse.cc:3315:9

    #6 0x5bde7a663b8b in mysql_execute_command(THD*, bool) /test/13.1_dbg_san/sql/sql_parse.cc:5960:26

    #7 0x5bde7a64f8b9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.1_dbg_san/sql/sql_parse.cc:8018:18

    #8 0x5bde7a648bba in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.1_dbg_san/sql/sql_parse.cc:1903:7

    #9 0x5bde7a651003 in do_command(THD*, bool) /test/13.1_dbg_san/sql/sql_parse.cc:1437:17

    #10 0x5bde7ac49c4c in do_handle_one_connection(CONNECT*, bool) /test/13.1_dbg_san/sql/sql_connect.cc:1514:11

    #11 0x5bde7ac49868 in handle_one_connection /test/13.1_dbg_san/sql/sql_connect.cc:1426:5

    #12 0x5bde79907e56 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28

    #13 0x740cb929cb83 in start_thread nptl/pthread_create.c:447:8

    #14 0x740cb9329ecb in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: invalid-null-argument /test/13.1_dbg_san/sql/char_buffer.h:126:31 

Version: '13.1.0-MariaDB-asan'  socket: '/test/UBASAN_MD090926-mariadb-13.1.0-linux-x86_64-opt/socket.sock'  port: 10125  MariaDB Server

/test/13.1_opt_san/sql/char_buffer.h:126:31: runtime error: null pointer passed as argument 2, which is declared to never be null

/usr/include/string.h:44:28: note: nonnull attribute specified here

    #0 0x61a97c366066 in CharBuffer<793ul>::append(st_mysql_const_lex_string const&) /test/13.1_opt_san/sql/char_buffer.h:126:5

    #1 0x61a97c33f63e in name_hash_search(st_hash*, char const*, char const*, char const*, char const*, char const*, bool, bool) /test/13.1_opt_san/sql/sql_acl.cc:6746:7

    #2 0x61a97c3092d5 in routine_hash_search(char const*, char const*, char const*, char const*, char const*, Sp_handler const*, bool) /test/13.1_opt_san/sql/sql_acl.cc:6785:5

    #3 0x61a97c3092d5 in check_grant_routine(THD*, privilege_t, TABLE_LIST*, Sp_handler const*, bool) /test/13.1_opt_san/sql/sql_acl.cc:10756:14

    #4 0x61a97c6afbf7 in check_routine_access(THD*, privilege_t, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Sp_handler const*, bool) /test/13.1_opt_san/sql/sql_parse.cc:7194:10

    #5 0x61a97c6af4c2 in Sql_cmd_call::execute(THD*) /test/13.1_opt_san/sql/sql_parse.cc:3315:9

    #6 0x61a97c6b5532 in mysql_execute_command(THD*, bool) /test/13.1_opt_san/sql/sql_parse.cc:5960:26

    #7 0x61a97c6a2fd4 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.1_opt_san/sql/sql_parse.cc:8018:18

    #8 0x61a97c69c84e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.1_opt_san/sql/sql_parse.cc:1903:7

    #9 0x61a97c6a3de0 in do_command(THD*, bool) /test/13.1_opt_san/sql/sql_parse.cc:1437:17

    #10 0x61a97cc468fc in do_handle_one_connection(CONNECT*, bool) /test/13.1_opt_san/sql/sql_connect.cc:1514:11

    #11 0x61a97cc464c9 in handle_one_connection /test/13.1_opt_san/sql/sql_connect.cc:1426:5

    #12 0x61a97d3a6028 in pfs_spawn_thread /test/13.1_opt_san/storage/perfschema/pfs.cc:2198:3

    #13 0x61a97ba41616 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28

    #14 0x7a50c0c9cb83 in start_thread nptl/pthread_create.c:447:8

    #15 0x7a50c0d29ecb in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: invalid-null-argument /test/13.1_opt_san/sql/char_buffer.h:126:31 

Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O1 -march=native -mtune=native'" and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter

    Rel    o/d  Build   Commit                                    UniqueID observed             

CS  10.11  dbg  090926  2753b5919a10abd32ba822877c6a1cbf602d3748  No bug found                  

CS  10.11  opt  090926  2753b5919a10abd32ba822877c6a1cbf602d3748  No bug found                  

CS  11.4   dbg  090926  42038e1145dd43b3910055c364fb720a8a152d61  No bug found                  

CS  11.4   opt  090926  42038e1145dd43b3910055c364fb720a8a152d61  No bug found                  

CS  11.8   dbg  090926  e2e060ce3d8c3ce11b6c7ba28ced0f1a30c50a54  No bug found                  

CS  11.8   opt  090926  e2e060ce3d8c3ce11b6c7ba28ced0f1a30c50a54  No bug found                  

CS  12.3   dbg  090926  e9f84a1fdf7093191e55b55dc14b08b9d4ebaa20  No bug found                  

CS  12.3   opt  090926  e9f84a1fdf7093191e55b55dc14b08b9d4ebaa20  No bug found                  

CS  13.0   dbg  090926  b2c4e675049e23ce8c7346985f40840fcd4e583f  No bug found                  

CS  13.0   opt  090926  b2c4e675049e23ce8c7346985f40840fcd4e583f  No bug found                  

CS  13.1   dbg  090926  02c842c30dcb05a962eaac58c69920e6be3369cf  UBSAN|null pointer passed as argument 2, which is declared to never be null|sql/char_buffer.h|CharBuffer<793ul>::append|name_hash_search|routine_hash_search|check_grant_routine

CS  13.1   opt  090926  02c842c30dcb05a962eaac58c69920e6be3369cf  UBSAN|null pointer passed as argument 2, which is declared to never be null|sql/char_buffer.h|CharBuffer<793ul>::append|name_hash_search|routine_hash_search|check_grant_routine

ES  10.6   dbg  090926  aa3fb9800c358182ee2a1f8cca8ffbdd6d0a37eb  No bug found                  

ES  10.6   opt  090926  aa3fb9800c358182ee2a1f8cca8ffbdd6d0a37eb  No bug found                  

ES  11.4   dbg  090926  32807340954440071ca8ae8e2de51fb180d134c6  No bug found                  

ES  11.4   opt  090926  32807340954440071ca8ae8e2de51fb180d134c6  No bug found                  

ES  11.8   dbg  090926  c4af6f687a2dd983072457429aa2294f11957650  No bug found                  

ES  11.8   opt  090926  c4af6f687a2dd983072457429aa2294f11957650  No bug found                  

ES  12.3   dbg  090926  c3bd5108d81f19e33efb93f7b6ae971293732fd0  No bug found                  

ES  12.3   opt  090926  c3bd5108d81f19e33efb93f7b6ae971293732fd0  No bug found