[MDEV-13972] crash in Item_func_sec_to_time::get_date Created: 2017-10-01 Updated: 2017-10-10 Resolved: 2017-10-10 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Temporal Types |
| Affects Version/s: | 5.5, 10.0, 10.1, 10.2.9, 10.2 |
| Fix Version/s: | 5.5.58, 10.0.33, 10.1.29, 10.2.10, 10.3.3 |
| Type: | Bug | Priority: | Major |
| Reporter: | sbester1 | Assignee: | Sergei Golubchik |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Environment: |
Win64 |
||
| Issue Links: |
|
||||||||
| Description |
|
How to repeat
|
| Comments |
| Comment by Elena Stepanova [ 2017-10-01 ] | |||||||||||||||||||||||||||||||
|
Thanks for the report and test case. | |||||||||||||||||||||||||||||||
| Comment by Alexander Barkov [ 2017-10-05 ] | |||||||||||||||||||||||||||||||
|
These simplified queries also crashes the server:
| |||||||||||||||||||||||||||||||
| Comment by Alexander Barkov [ 2017-10-09 ] | |||||||||||||||||||||||||||||||
|
The problem happens because Item_func_sec_to_time::get_date() fetches the value for the second time in case of overflow, using val_str(), which can return NULL when the argument is not deterministic (e.g. uses RAND() directly or indirectly). The code calling make_truncated_value_warning() does not expect this. Also, Item_func_sec_to_time::get_date() abuses make_truncate_value_warning() in another way:
The expected warning would be:
| |||||||||||||||||||||||||||||||
| Comment by Alexander Barkov [ 2017-10-10 ] | |||||||||||||||||||||||||||||||
|
Opps, forgot to add the supposed commit comment when pushing:
|