Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.11, 11.4, 11.8, 12.3, 13.0, 13.1, 13.2
-
None
Description
SET @save_max_allowed_packet= @@global.max_allowed_packet; |
SET GLOBAL max_allowed_packet= 1073741824; |
--connect (con1,localhost,root)
|
SET @a= REPEAT(_latin1'a',1073741824); |
--let $c= query_get_value(SELECT CHAR_LENGTH(CONVERT(@a USING utf8mb4)) AS c, c, 1)
|
if ($c != 1073741824) |
{
|
--die CONVERT of a 1073741824 character latin1 string to utf8mb4 returned $c characters |
}
|
--disconnect con1
|
--connection default
|
SET GLOBAL max_allowed_packet= @save_max_allowed_packet; |
Leads to:
|
CS 13.1.2 87e62ca17270e163a6d41b3fc8d6f4d440f1bb88 (Optimized, Clang 22.1.8-20260622) Build 05/10/2026 |
mysqltest: At line 8: CONVERT of a 1073741824 character latin1 string to utf8mb4 returned 8 characters
|
The conversion returns 8 characters and gives no warning. The same value goes into a LONGBLOB column in full, and LENGTH() on the stored row gives 1073741824. Storing CONVERT(@a USING utf8mb4) into a LONGTEXT CHARACTER SET utf8mb4 column stores 8 bytes, again with no warning.
Debug builds assert on the same statement:
|
CS 13.1.0 da18481158c81ca94689702073c3e04aad85a6a3 (Debug, Clang 22.1.8-20260622) Build 18/08/2026 |
mariadbd: sql/sql_string.cc:36: bool Binary_string::real_alloc(size_t): Assertion `length < 0xFFFFFFFFUL' failed.
|
|
CS 13.1.0 da18481158c81ca94689702073c3e04aad85a6a3 (Debug, Clang 22.1.8-20260622) Build 18/08/2026 |
#7 Binary_string::real_alloc (this=0x777c480167b8, length=4294967296) at sql/sql_string.cc:36
|
#8 Binary_string::alloc (this=0x777c480167b8, arg_length=4294967296) at sql/sql_string.h:744
|
#9 String::copy (this=0x777c480167b0, tocs=0x57946a4c97e8, fromcs=0x579450435b40 <my_charset_latin1>, src=0x777c07fff030 'a' <repeats 200 times>..., src_length=1073741824, nchars=1073741824, copier=0x777c84d8f060) at sql/sql_string.h:972
|
#10 String_copier_for_item::copy_with_warn (this=0x777c84d8f060, dstcs=0x57946a4c97e8, dst=0x777c480167b0, srccs=0x579450435b40 <my_charset_latin1>, src=0x777c07fff030 'a' <repeats 200 times>..., src_length=1073741824, nchars=1073741824) at sql/item.cc:7199
|
#11 Item_func_conv_charset::val_str (this=0x777c48016570, str=0x777c480167b0) at sql/item_strfunc.cc:3817
|
#12 Item_func_char_length::val_int (this=0x777c480166f0) at sql/item_func.cc:3222
|
#13 Type_handler::Item_send_long (this=0x5794505d1d38 <type_handler_slong>, item=0x777c480166f0, protocol=0x777c48001440, buf=0x777c84d8f210) at sql/sql_type.cc:7712
|
From the code it seems that String::copy() asks for to_cs->mbmaxlen*arg_length bytes (sql/sql_string.cc:489), which is 4294967296 for this value, and Binary_string::real_alloc() keeps that in a uint32 (Alloced_length=(uint32) arg_length, sql/sql_string.cc:45), so the buffer is 8 bytes and the copy stops there.
On a debug build that INSERT asserts in the same function, reached through Field_blob::store.
Attachments
Issue Links
- relates to
-
-
- Confirmed
-
