Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41417

Assertion `hdr->name - hdr->nmpool < (long) 0x10000L' failed in put_header_entry_named on COLUMN_CREATE

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      SELECT COLUMN_CREATE(REPEAT('a',14000),1,REPEAT('b',14000),1,REPEAT('c',14000),1,REPEAT('d',14000),1,REPEAT('e',14000),1,REPEAT('f',14000),1);
      

      Leads to:

      CS 13.2.0 9d7ab2c0092df4bc73b64b915464aecf7e5fe6c4 (Debug, Clang 18.1.3-11) Build 06/10/2026

      mariadbd: /test/13.2_dbg/mysys/ma_dyncol.c:444: my_bool put_header_entry_named(DYN_HEADER *, void *, DYNAMIC_COLUMN_VALUE *, size_t): Assertion `hdr->name - hdr->nmpool < (long) 0x10000L' failed.
      

      CS 13.2.0 9d7ab2c0092df4bc73b64b915464aecf7e5fe6c4 (Debug, Clang 18.1.3-11) Build 06/10/2026

      Core was generated by `/test/MD061026-mariadb-13.2.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
       
      [Current thread is 1 (LWP 1505226)]
      (gdb) bt
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
      #1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
      #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
      #3  0x00007806b2a4527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
      #4  0x00007806b2a288ff in __GI_abort () at ./stdlib/abort.c:79
      #5  0x00007806b2a2881b in __assert_fail_base (fmt=0x7806b2bd1208 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5fbf43235d34 "hdr->name - hdr->nmpool < (long) 0x10000L", file=file@entry=0x5fbf4323554f "/test/13.2_dbg/mysys/ma_dyncol.c", line=line@entry=444, function=function@entry=0x5fbf43235cdf "my_bool put_header_entry_named(DYN_HEADER *, void *, DYNAMIC_COLUMN_VALUE *, size_t)") at ./assert/assert.c:96
      #6  0x00007806b2a3b517 in __assert_fail (assertion=0x5fbf43235d34 "hdr->name - hdr->nmpool < (long) 0x10000L", file=0x5fbf4323554f "/test/13.2_dbg/mysys/ma_dyncol.c", line=444, function=0x5fbf43235cdf "my_bool put_header_entry_named(DYN_HEADER *, void *, DYNAMIC_COLUMN_VALUE *, size_t)") at ./assert/assert.c:105
      #7  0x00005fbf42d09a27 in put_header_entry_named (hdr=0x70068c38c030, column_key=0x7005dc01dbc0, value=0x7005dc01db28, offset=5)at /test/13.2_dbg/mysys/ma_dyncol.c:444
      #8  0x00005fbf42d078bc in dynamic_new_column_store (str=0x70068c38c170, hdr=0x70068c38c030, column_count=6, column_keys=0x7005dc01db70, values=0x7005dc01d9c0, new_str=1 '\001')at /test/13.2_dbg/mysys/ma_dyncol.c:1707
      #9  0x00005fbf42d02a28 in dynamic_column_create_many_internal_fmt (str=0x70068c38c170, column_count=6, column_keys=0x7005dc01db70, values=0x7005dc01d9c0, new_str=1 '\001', string_keys=1 '\001')at /test/13.2_dbg/mysys/ma_dyncol.c:1809
      #10 0x00005fbf42d02abc in mariadb_dyncol_create_many_named (str=0x70068c38c170, column_count=6, column_keys=0x7005dc01db70, values=0x7005dc01d9c0, new_string=1 '\001')at /test/13.2_dbg/mysys/ma_dyncol.c:1884
      #11 0x00005fbf424227c5 in Item_func_dyncol_create::val_str (this=0x7005dc01c170, str=0x70068c38c330)at /test/13.2_dbg/sql/item_strfunc.cc:5004
      #12 0x00005fbf421a7e8d in Type_handler::Item_send_str (this=0x5fbf43d731b8 <type_handler_long_blob>, item=0x7005dc01c170, protocol=0x7005dc001440, buf=0x70068c38c300)at /test/13.2_dbg/sql/sql_type.cc:7679
      #13 0x00005fbf4208549d in Type_handler_string_result::Item_send (this=0x5fbf43d731b8 <type_handler_long_blob>, item=0x7005dc01c170, protocol=0x7005dc001440, buf=0x70068c38c300)at /test/13.2_dbg/sql/sql_type.h:5795
      #14 0x00005fbf41cc645d in Item::send (this=0x7005dc01c170, protocol=0x7005dc001440, buffer=0x70068c38c300)at /test/13.2_dbg/sql/item.h:1241
      #15 0x00005fbf41d1ed42 in Protocol::send_result_set_row (this=0x7005dc001440, row_items=0x7005dc01aad8) at /test/13.2_dbg/sql/protocol.cc:1358
      #16 0x00005fbf41dff5de in select_send::send_data (this=0x7005dc01cd70, items=@0x7005dc01aad8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7005dc01c320, last = 0x7005dc01c320, elements = 1}, <No data fields>})at /test/13.2_dbg/sql/sql_class.cc:3481
      #17 0x00005fbf41dff270 in select_result_sink::send_data_with_check (this=0x7005dc01cd70, items=@0x7005dc01aad8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7005dc01c320, last = 0x7005dc01c320, elements = 1}, <No data fields>}, u=0x7005dc0052f8, sent=0) at /test/13.2_dbg/sql/sql_class.cc:3379
      #18 0x00005fbf41f3a28b in JOIN::exec_inner (this=0x7005dc01cda0)at /test/13.2_dbg/sql/sql_select.cc:5011
      #19 0x00005fbf41f39ca0 in JOIN::exec (this=0x7005dc01cda0)at /test/13.2_dbg/sql/sql_select.cc:4928
      #20 0x00005fbf41f1446c in mysql_select (thd=0x7005dc000d60, tables=0x0, fields=@0x7005dc01aad8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7005dc01c320, last = 0x7005dc01c320, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x7005dc01cd70, unit=0x7005dc0052f8, select_lex=0x7005dc01a820) at /test/13.2_dbg/sql/sql_select.cc:5454
      #21 0x00005fbf41f13f45 in handle_select (thd=0x7005dc000d60, lex=0x7005dc005218, result=0x7005dc01cd70, setup_tables_done_option=0)at /test/13.2_dbg/sql/sql_select.cc:651
      #22 0x00005fbf41eb029d in execute_sqlcom_select (thd=0x7005dc000d60, all_tables=0x0) at /test/13.2_dbg/sql/sql_parse.cc:6266
      #23 0x00005fbf41ea4dc6 in mysql_execute_command (thd=0x7005dc000d60, is_called_from_prepared_stmt=false) at /test/13.2_dbg/sql/sql_parse.cc:4038
      #24 0x00005fbf41e9cdb4 in mysql_parse (thd=0x7005dc000d60, rawbuf=0x7005dc01a6a0 "SELECT COLUMN_CREATE(REPEAT('a',14000),1,REPEAT('b',14000),1,REPEAT('c',14000),1,REPEAT('d',14000),1,REPEAT('e',14000),1,REPEAT('f',14000),1)", length=141, parser_state=0x70068c38ea80)at /test/13.2_dbg/sql/sql_parse.cc:8005
      #25 0x00005fbf41e9a17d in dispatch_command (command=COM_QUERY, thd=0x7005dc000d60, packet=0x7005dc00b701 "", packet_length=141, blocking=true) at /test/13.2_dbg/sql/sql_parse.cc:1903
      #26 0x00005fbf41e9d963 in do_command (thd=0x7005dc000d60, blocking=true)at /test/13.2_dbg/sql/sql_parse.cc:1437
      #27 0x00005fbf420a3cd9 in do_handle_one_connection (connect=0x5fbf5516db50, put_in_cache=true) at /test/13.2_dbg/sql/sql_connect.cc:1514
      #28 0x00005fbf420a3a7e in handle_one_connection (arg=0x5fbf55106530)at /test/13.2_dbg/sql/sql_connect.cc:1426
      #29 0x00007806b2a9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #30 0x00007806b2b29ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.11  dbg  061026  76ed5b7ea0c9cddfe9386aee4a5ff42a2adf1593  hdr->name - hdr->nmpool < (long) 0x10000L|SIGABRT|put_header_entry_named|dynamic_new_column_store|dynamic_column_create_many_internal_fmt|mariadb_dyncol_create_many_named
      CS  10.11  opt  061026  76ed5b7ea0c9cddfe9386aee4a5ff42a2adf1593  No bug found
      CS  11.4   dbg  061026  b6398296aeeeb253bdb3d1dd1620d2bb03836bf7  hdr->name - hdr->nmpool < (long) 0x10000L|SIGABRT|put_header_entry_named|dynamic_new_column_store|dynamic_column_create_many_internal_fmt|mariadb_dyncol_create_many_named
      CS  11.4   opt  061026  b6398296aeeeb253bdb3d1dd1620d2bb03836bf7  No bug found
      CS  11.8   dbg  061026  dddbd5ff427894941fee3d7528ca2058e026b82e  hdr->name - hdr->nmpool < (long) 0x10000L|SIGABRT|put_header_entry_named|dynamic_new_column_store|dynamic_column_create_many_internal_fmt|mariadb_dyncol_create_many_named
      CS  11.8   opt  061026  dddbd5ff427894941fee3d7528ca2058e026b82e  No bug found
      CS  12.3   dbg  061026  07b869588831fb9ebc6364c77cba105d6cca3b77  hdr->name - hdr->nmpool < (long) 0x10000L|SIGABRT|put_header_entry_named|dynamic_new_column_store|dynamic_column_create_many_internal_fmt|mariadb_dyncol_create_many_named
      CS  12.3   opt  061026  07b869588831fb9ebc6364c77cba105d6cca3b77  No bug found
      CS  13.0   dbg  061026  620a4b5624222048fece7fe1789978ae0675cae2  hdr->name - hdr->nmpool < (long) 0x10000L|SIGABRT|put_header_entry_named|dynamic_new_column_store|dynamic_column_create_many_internal_fmt|mariadb_dyncol_create_many_named
      CS  13.0   opt  061026  620a4b5624222048fece7fe1789978ae0675cae2  No bug found
      CS  13.1   dbg  061026  87e62ca17270e163a6d41b3fc8d6f4d440f1bb88  hdr->name - hdr->nmpool < (long) 0x10000L|SIGABRT|put_header_entry_named|dynamic_new_column_store|dynamic_column_create_many_internal_fmt|mariadb_dyncol_create_many_named
      CS  13.1   opt  061026  87e62ca17270e163a6d41b3fc8d6f4d440f1bb88  No bug found
      CS  13.2   dbg  061026  9d7ab2c0092df4bc73b64b915464aecf7e5fe6c4  hdr->name - hdr->nmpool < (long) 0x10000L|SIGABRT|put_header_entry_named|dynamic_new_column_store|dynamic_column_create_many_internal_fmt|mariadb_dyncol_create_many_named
      CS  13.2   opt  061026  9d7ab2c0092df4bc73b64b915464aecf7e5fe6c4  No bug found                  
      ES  11.4   dbg  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  hdr->name - hdr->nmpool < (long) 0x10000L|SIGABRT|put_header_entry_named|dynamic_new_column_store|dynamic_column_create_many_internal_fmt|mariadb_dyncol_create_many_named
      ES  11.4   opt  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  No bug found                  
      ES  11.8   dbg  060526  1499789de285a8109d68d79347de0281865b28f4  hdr->name - hdr->nmpool < (long) 0x10000L|SIGABRT|put_header_entry_named|dynamic_new_column_store|dynamic_column_create_many_internal_fmt|mariadb_dyncol_create_many_named
      ES  11.8   opt  060526  1499789de285a8109d68d79347de0281865b28f4  No bug found                  
      ES  12.3   dbg  280926  082387a5f3cbb877157998bb4baa95928f4aa121  hdr->name - hdr->nmpool < (long) 0x10000L|SIGABRT|put_header_entry_named|dynamic_new_column_store|dynamic_column_create_many_internal_fmt|mariadb_dyncol_create_many_named
      ES  12.3   opt  280926  082387a5f3cbb877157998bb4baa95928f4aa121  No bug found                  
      

      Attachments

        Activity

          People

            sanja Oleksandr Byelkin
            ramesh Ramesh Sivaraman
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 0.5h
                0.5h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.