Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-42090

UBSAN: call to function sphinx_snippets through pointer to incorrect function type in udf_handler::val_str on SELECT

    XMLWordPrintable

Details

    Description

      Likely cause: commit 6197332366ec1908af34b2415f01ccca7757f0c2 (the SphinxSE import), in sphinx_snippets(). It is not a regression.
      MDEV-35735 and MDEV-36337 fixed the same mismatch in other UDFs.

      CREATE FUNCTION sphinx_snippets RETURNS STRING SONAME 'ha_sphinx.so';
      SELECT sphinx_snippets(NULL,'idx','word');
      DROP FUNCTION sphinx_snippets;

      Testcase is CLI/MTR compatible

      Leads to:

      CS 13.1.0 da18481158c81ca94689702073c3e04aad85a6a3 (Debug, UBASAN, Clang 22.1.8-20260622) Build 18/08/2026

      /test/13.1_dbg_san/sql/item_func.cc:3836:13: runtime error: call to function sphinx_snippets through pointer to incorrect function type 'char *(*)(st_udf_init *, st_udf_args *, char *, unsigned long *, unsigned char *, unsigned char *)'
      /test/13.1_dbg_san/storage/sphinx/snippets_udf.cc:708: note: sphinx_snippets defined here
          #0 0x6299a0313d8c in udf_handler::val_str(String*, String*) /test/13.1_dbg_san/sql/item_func.cc:3836:13
          #1 0x6299a031590e in Item_func_udf_str::val_str(String*) /test/13.1_dbg_san/sql/item_func.cc:3984:19
          #2 0x6299a1c8b74c in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/13.1_dbg_san/sql/sql_type.cc:7679:19
          #3 0x6299a0963973 in Protocol::send_result_set_row(List<Item>*) /test/13.1_dbg_san/sql/protocol.cc:1358:15
          #4 0x6299a0c47078 in select_send::send_data(List<Item>&) /test/13.1_dbg_san/sql/sql_class.cc:3433:17
          #5 0x6299a0c461a1 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/13.1_dbg_san/sql/sql_class.cc:3331:11
          #6 0x6299a12f1c17 in JOIN::exec_inner() /test/13.1_dbg_san/sql/sql_select.cc:4997:22
          #7 0x6299a12efdf8 in JOIN::exec() /test/13.1_dbg_san/sql/sql_select.cc:4914:8
          #8 0x6299a124d4a7 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/13.1_dbg_san/sql/sql_select.cc:5440:21
          #9 0x6299a124c1f1 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/13.1_dbg_san/sql/sql_select.cc:637:10
          #10 0x6299a10e38c9 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/13.1_dbg_san/sql/sql_parse.cc:6229:12
          #11 0x6299a10ce03c in mysql_execute_command(THD*, bool) /test/13.1_dbg_san/sql/sql_parse.cc:3997:12
          #12 0x6299a10a7c9a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.1_dbg_san/sql/sql_parse.cc:7968:18
          #13 0x6299a109fc7e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.1_dbg_san/sql/sql_parse.cc:1903:7
          #14 0x6299a10aa086 in do_command(THD*, bool) /test/13.1_dbg_san/sql/sql_parse.cc:1437:17
          #15 0x6299a18ea09c in do_handle_one_connection(CONNECT*, bool) /test/13.1_dbg_san/sql/sql_connect.cc:1514:11
          #16 0x6299a18e9bc5 in handle_one_connection /test/13.1_dbg_san/sql/sql_connect.cc:1426:5
          #17 0x72adc4148e16 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28
          #18 0x72adc389cb83 in start_thread nptl/pthread_create.c:447:8
          #19 0x72adc3929ecb in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
      SUMMARY: UndefinedBehaviorSanitizer: function-type-mismatch /test/13.1_dbg_san/sql/item_func.cc:3836:13 

      CS 13.1.0 da18481158c81ca94689702073c3e04aad85a6a3 (Optimized, UBASAN, Clang 22.1.8-20260622) Build 18/08/2026

      /test/13.1_opt_san/sql/item_func.cc:3836:13: runtime error: call to function sphinx_snippets through pointer to incorrect function type 'char *(*)(st_udf_init *, st_udf_args *, char *, unsigned long *, unsigned char *, unsigned char *)'
      /test/13.1_opt_san/storage/sphinx/snippets_udf.cc:708: note: sphinx_snippets defined here
          #0 0x5b346df611f0 in udf_handler::val_str(String*, String*) /test/13.1_opt_san/sql/item_func.cc:3836:13
          #1 0x5b346df62ac8 in Item_func_udf_str::val_str(String*) /test/13.1_opt_san/sql/item_func.cc:3984:19
          #2 0x5b346f748d75 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/13.1_opt_san/sql/sql_type.cc:7679:19
          #3 0x5b346e544932 in Protocol::send_result_set_row(List<Item>*) /test/13.1_opt_san/sql/protocol.cc:1358:15
          #4 0x5b346e7f955b in select_send::send_data(List<Item>&) /test/13.1_opt_san/sql/sql_class.cc:3433:17
          #5 0x5b346e7f8681 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/13.1_opt_san/sql/sql_class.cc:3331:11
          #6 0x5b346ee327cb in JOIN::exec_inner() /test/13.1_opt_san/sql/sql_select.cc:4997:22
          #7 0x5b346ee30c2a in JOIN::exec() /test/13.1_opt_san/sql/sql_select.cc:4914:8
          #8 0x5b346ed982f7 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/13.1_opt_san/sql/sql_select.cc:5440:21
          #9 0x5b346ed96a8f in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/13.1_opt_san/sql/sql_select.cc:637:10
          #10 0x5b346ec51b43 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/13.1_opt_san/sql/sql_parse.cc:6229:12
          #11 0x5b346ec3688c in mysql_execute_command(THD*, bool) /test/13.1_opt_san/sql/sql_parse.cc:3997:12
          #12 0x5b346ec1ab56 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.1_opt_san/sql/sql_parse.cc:7968:18
          #13 0x5b346ec1046e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.1_opt_san/sql/sql_parse.cc:1903:7
          #14 0x5b346ec1ca5c in do_command(THD*, bool) /test/13.1_opt_san/sql/sql_parse.cc:1437:17
          #15 0x5b346f3e00bc in do_handle_one_connection(CONNECT*, bool) /test/13.1_opt_san/sql/sql_connect.cc:1514:11
          #16 0x5b346f3dfb5d in handle_one_connection /test/13.1_opt_san/sql/sql_connect.cc:1426:5
          #17 0x5b346fde1d25 in pfs_spawn_thread /test/13.1_opt_san/storage/perfschema/pfs.cc:2198:3
          #18 0x72906ab48e16 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28
          #19 0x72906a09cb83 in start_thread nptl/pthread_create.c:447:8
          #20 0x72906a129ecb in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
      SUMMARY: UndefinedBehaviorSanitizer: function-type-mismatch /test/13.1_opt_san/sql/item_func.cc:3836:13 

      Setup:

      Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
        # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18
           sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
      Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O1 -march=native -mtune=native'" and:
          -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
      Set before execution:
          export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter

      With a NULL first argument, sphinx_snippets() returns at once, so the testcase needs no searchd.

      From the code it seems that the ColumnStore UDFs also declare is_null and error as char *. They are in dbcon/mysql/ha_mcs_udf.cpp, dbcon/mysql/ha_mcs_client_udfs.cpp, dbcon/mysql/ha_pseudocolumn.cpp and utils/regr/regrmysql.cpp, under storage/columnstore/columnstore. None of our test builds ship the ColumnStore engine, so that part was not run.

      Attachments

        Issue Links

          Activity

            People

              danblack Daniel Black
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - Not Specified
                  Not Specified
                  Logged:
                  Time Spent - 1h
                  1h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.