Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.11, 11.4, 11.8, 12.3, 13.0, 13.1, 13.2
Description
Likely cause: commit 6197332366ec1908af34b2415f01ccca7757f0c2 (the SphinxSE import), in sphinx_snippets(). It is not a regression.
MDEV-35735 and MDEV-36337 fixed the same mismatch in other UDFs.
CREATE FUNCTION sphinx_snippets RETURNS STRING SONAME 'ha_sphinx.so'; |
SELECT sphinx_snippets(NULL,'idx','word'); |
DROP FUNCTION sphinx_snippets; |
Testcase is CLI/MTR compatible
Leads to:
|
CS 13.1.0 da18481158c81ca94689702073c3e04aad85a6a3 (Debug, UBASAN, Clang 22.1.8-20260622) Build 18/08/2026 |
/test/13.1_dbg_san/sql/item_func.cc:3836:13: runtime error: call to function sphinx_snippets through pointer to incorrect function type 'char *(*)(st_udf_init *, st_udf_args *, char *, unsigned long *, unsigned char *, unsigned char *)'
|
/test/13.1_dbg_san/storage/sphinx/snippets_udf.cc:708: note: sphinx_snippets defined here
|
#0 0x6299a0313d8c in udf_handler::val_str(String*, String*) /test/13.1_dbg_san/sql/item_func.cc:3836:13
|
#1 0x6299a031590e in Item_func_udf_str::val_str(String*) /test/13.1_dbg_san/sql/item_func.cc:3984:19
|
#2 0x6299a1c8b74c in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/13.1_dbg_san/sql/sql_type.cc:7679:19
|
#3 0x6299a0963973 in Protocol::send_result_set_row(List<Item>*) /test/13.1_dbg_san/sql/protocol.cc:1358:15
|
#4 0x6299a0c47078 in select_send::send_data(List<Item>&) /test/13.1_dbg_san/sql/sql_class.cc:3433:17
|
#5 0x6299a0c461a1 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/13.1_dbg_san/sql/sql_class.cc:3331:11
|
#6 0x6299a12f1c17 in JOIN::exec_inner() /test/13.1_dbg_san/sql/sql_select.cc:4997:22
|
#7 0x6299a12efdf8 in JOIN::exec() /test/13.1_dbg_san/sql/sql_select.cc:4914:8
|
#8 0x6299a124d4a7 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/13.1_dbg_san/sql/sql_select.cc:5440:21
|
#9 0x6299a124c1f1 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/13.1_dbg_san/sql/sql_select.cc:637:10
|
#10 0x6299a10e38c9 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/13.1_dbg_san/sql/sql_parse.cc:6229:12
|
#11 0x6299a10ce03c in mysql_execute_command(THD*, bool) /test/13.1_dbg_san/sql/sql_parse.cc:3997:12
|
#12 0x6299a10a7c9a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.1_dbg_san/sql/sql_parse.cc:7968:18
|
#13 0x6299a109fc7e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.1_dbg_san/sql/sql_parse.cc:1903:7
|
#14 0x6299a10aa086 in do_command(THD*, bool) /test/13.1_dbg_san/sql/sql_parse.cc:1437:17
|
#15 0x6299a18ea09c in do_handle_one_connection(CONNECT*, bool) /test/13.1_dbg_san/sql/sql_connect.cc:1514:11
|
#16 0x6299a18e9bc5 in handle_one_connection /test/13.1_dbg_san/sql/sql_connect.cc:1426:5
|
#17 0x72adc4148e16 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28
|
#18 0x72adc389cb83 in start_thread nptl/pthread_create.c:447:8
|
#19 0x72adc3929ecb in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
 |
SUMMARY: UndefinedBehaviorSanitizer: function-type-mismatch /test/13.1_dbg_san/sql/item_func.cc:3836:13
|
|
CS 13.1.0 da18481158c81ca94689702073c3e04aad85a6a3 (Optimized, UBASAN, Clang 22.1.8-20260622) Build 18/08/2026 |
/test/13.1_opt_san/sql/item_func.cc:3836:13: runtime error: call to function sphinx_snippets through pointer to incorrect function type 'char *(*)(st_udf_init *, st_udf_args *, char *, unsigned long *, unsigned char *, unsigned char *)'
|
/test/13.1_opt_san/storage/sphinx/snippets_udf.cc:708: note: sphinx_snippets defined here
|
#0 0x5b346df611f0 in udf_handler::val_str(String*, String*) /test/13.1_opt_san/sql/item_func.cc:3836:13
|
#1 0x5b346df62ac8 in Item_func_udf_str::val_str(String*) /test/13.1_opt_san/sql/item_func.cc:3984:19
|
#2 0x5b346f748d75 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/13.1_opt_san/sql/sql_type.cc:7679:19
|
#3 0x5b346e544932 in Protocol::send_result_set_row(List<Item>*) /test/13.1_opt_san/sql/protocol.cc:1358:15
|
#4 0x5b346e7f955b in select_send::send_data(List<Item>&) /test/13.1_opt_san/sql/sql_class.cc:3433:17
|
#5 0x5b346e7f8681 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/13.1_opt_san/sql/sql_class.cc:3331:11
|
#6 0x5b346ee327cb in JOIN::exec_inner() /test/13.1_opt_san/sql/sql_select.cc:4997:22
|
#7 0x5b346ee30c2a in JOIN::exec() /test/13.1_opt_san/sql/sql_select.cc:4914:8
|
#8 0x5b346ed982f7 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/13.1_opt_san/sql/sql_select.cc:5440:21
|
#9 0x5b346ed96a8f in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/13.1_opt_san/sql/sql_select.cc:637:10
|
#10 0x5b346ec51b43 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/13.1_opt_san/sql/sql_parse.cc:6229:12
|
#11 0x5b346ec3688c in mysql_execute_command(THD*, bool) /test/13.1_opt_san/sql/sql_parse.cc:3997:12
|
#12 0x5b346ec1ab56 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.1_opt_san/sql/sql_parse.cc:7968:18
|
#13 0x5b346ec1046e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.1_opt_san/sql/sql_parse.cc:1903:7
|
#14 0x5b346ec1ca5c in do_command(THD*, bool) /test/13.1_opt_san/sql/sql_parse.cc:1437:17
|
#15 0x5b346f3e00bc in do_handle_one_connection(CONNECT*, bool) /test/13.1_opt_san/sql/sql_connect.cc:1514:11
|
#16 0x5b346f3dfb5d in handle_one_connection /test/13.1_opt_san/sql/sql_connect.cc:1426:5
|
#17 0x5b346fde1d25 in pfs_spawn_thread /test/13.1_opt_san/storage/perfschema/pfs.cc:2198:3
|
#18 0x72906ab48e16 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28
|
#19 0x72906a09cb83 in start_thread nptl/pthread_create.c:447:8
|
#20 0x72906a129ecb in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
 |
SUMMARY: UndefinedBehaviorSanitizer: function-type-mismatch /test/13.1_opt_san/sql/item_func.cc:3836:13
|
Setup:
Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
|
# Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref dpkg --list | grep -iE 'clang|llvm' and use apt purge and dpkg --purge to remove the packages), before installing Clang/LLVM 18
|
sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
|
Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O1 -march=native -mtune=native'" and:
|
-DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
|
Set before execution:
|
export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1 # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter
|
With a NULL first argument, sphinx_snippets() returns at once, so the testcase needs no searchd.
From the code it seems that the ColumnStore UDFs also declare is_null and error as char *. They are in dbcon/mysql/ha_mcs_udf.cpp, dbcon/mysql/ha_mcs_client_udfs.cpp, dbcon/mysql/ha_pseudocolumn.cpp and utils/regr/regrmysql.cpp, under storage/columnstore/columnstore. None of our test builds ship the ColumnStore engine, so that part was not run.
Attachments
Issue Links
- relates to
-
MDEV-35735 runtime error: call to function spider_direct_sql, spider_flush_table_mon_cache, spider_copy_tables through pointer to incorrect function type in udf_handler::val_in
-
- Closed
-
-
MDEV-36337 runtime error: call to function (udf_example) netaphon through pointer to incorrect function type 'char *(*)(st_udf_init *, st_udf_args *, char *, unsigned long *, unsigned char *, unsigned char *)
-
- Closed
-