[MDEV-22625] SIGSEGV in intern_find_sys_var (optimized builds) Created: 2020-05-19  Updated: 2020-05-29  Resolved: 2020-05-29

Status: Closed
Project: MariaDB Server
Component/s: Character Sets, Variables
Affects Version/s: 10.5.4, 10.5.2, 10.5.3
Fix Version/s: 10.5.4

Type: Bug Priority: Blocker
Reporter: Roel Van de Paar Assignee: Alexander Barkov
Resolution: Fixed Votes: 0
Labels: not-10.1, not-10.2, not-10.3, not-10.4, regression

Attachments: File in.sql     File in2.sql    

 Description   

SOURCE in.sql  # attached to this report, 2 lines

Leads to:

10.5.3 cfe5ee90c8e4b9dfa98a41fcd299197a59261be7

Core was generated by `/test/MD110520-mariadb-10.5.3-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
[Current thread is 1 (Thread 0x1522efa56700 (LWP 1258888))]
(gdb) bt
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
#1  0x000055e9164d1c11 in my_write_core (sig=sig@entry=11) at /test/10.5_dbg/mysys/stacktrace.c:518
#2  0x000055e915c76f8d in handle_fatal_signal (sig=11) at /test/10.5_dbg/sql/signal_handler.cc:329
#3  <signal handler called>
#4  0x000055e9158e8558 in intern_find_sys_var (str=str@entry=0x0, length=length@entry=0) at /test/10.5_dbg/sql/set_var.cc:702
#5  0x000055e9159e4a2c in find_sys_var (thd=0x1522cc815088, str=0x0, length=0, throw_error=throw_error@entry=false) at /test/10.5_dbg/sql/sql_plugin.cc:2885
#6  0x000055e9159ad72d in LEX::set_system_variable (this=this@entry=0x1522cc818fd0, var_type=SHOW_OPT_SESSION, name=name@entry=0x1522efa545a0, val=val@entry=0x1522cc874130) at /test/10.5_dbg/sql/sql_lex.cc:8297
#7  0x000055e9159ad891 in LEX::set_variable (this=0x1522cc818fd0, name=name@entry=0x1522efa545a0, item=0x1522cc874130) at /test/10.5_dbg/sql/sql_lex.cc:8237
#8  0x000055e915c02da0 in MYSQLparse (thd=thd@entry=0x1522cc815088) at /test/10.5_dbg/sql/sql_yacc.yy:16245
#9  0x000055e9159e0086 in parse_sql (thd=thd@entry=0x1522cc815088, parser_state=parser_state@entry=0x1522efa553e0, creation_ctx=creation_ctx@entry=0x0, do_pfs_digest=do_pfs_digest@entry=true) at /test/10.5_dbg/sql/sql_parse.cc:10263
#10 0x000055e9159da60a in mysql_parse (thd=thd@entry=0x1522cc815088, rawbuf=<optimized out>, length=8, parser_state=parser_state@entry=0x1522efa553e0, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7910
#11 0x000055e9159c6ffd in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1522cc815088, packet=packet@entry=0x1522cc867089 "SET \320=''", packet_length=packet_length@entry=8, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1839
#12 0x000055e9159c58cc in do_command (thd=0x1522cc815088) at /test/10.5_dbg/sql/sql_parse.cc:1358
#13 0x000055e915b1f99d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x1522ce4433a8, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1411
#14 0x000055e915b200b9 in handle_one_connection (arg=arg@entry=0x1522ce4433a8) at /test/10.5_dbg/sql/sql_connect.cc:1313
#15 0x000055e915f7e10a in pfs_spawn_thread (arg=0x1522ed445888) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201
#16 0x00001522eee7d6db in start_thread (arg=0x1522efa56700) at pthread_create.c:463
#17 0x00001522ee27b88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.5.2 (dbg), 10.5.2 (opt), 10.5.3 (dbg), 10.5.3 (opt), 10.5.4 (dbg), 10.5.4 (opt)

Bug confirmed not present in:
MariaDB: 10.1.45 (dbg), 10.1.45 (opt), 10.2.32 (dbg), 10.2.32 (opt), 10.3.23 (dbg), 10.3.23 (opt), 10.4.13 (dbg), 10.4.13 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt)

MariaDB 10.4.13 gives:

ERROR 1300 (HY000) at line 2 in file: 'in.sql': Invalid dec8 character string: '\xD0'



 Comments   
Comment by Roel Van de Paar [ 2020-05-20 ]

Additional testcase added.

Note to self; needs bit more research on why this shows two different unique bug ID's (__strlen_avx2 ?)

SIGSEGV|__strlen_avx2|intern_find_sys_var|find_sys_var|LEX::set_system_variable
SIGSEGV|intern_find_sys_var|find_sys_var|LEX::set_system_variable|LEX::set_variable

Comment by Alexander Barkov [ 2020-05-28 ]

The same crash happens with the following scripts:

SET NAMES dec8;
EXECUTE IMMEDIATE CONCAT('SET ', 0xD0, '=1');

SET NAMES big5;
EXECUTE IMMEDIATE CONCAT('SET ', 0xA3C0, '=1');

SET NAMES cp932;
EXECUTE IMMEDIATE CONCAT('SET ', 0x81AD, '=1');

SET NAMES eucjpms;
EXECUTE IMMEDIATE CONCAT('SET ', 0x8FA1A1, '=1');

SET NAMES euckr;
EXECUTE IMMEDIATE CONCAT('SET ', 0xA2E8, '=1');

SET NAMES gb2312;
EXECUTE IMMEDIATE CONCAT('SET ', 0xA2A1, '=1');

SET NAMES gbk;
EXECUTE IMMEDIATE CONCAT('SET ', 0xAAA1, '=1');

SET NAMES sjis;
EXECUTE IMMEDIATE CONCAT('SET ', 0x81AD, '=1');

SET NAMES sjis;
EXECUTE IMMEDIATE CONCAT('SET ', 0x8EA8, '=1');

Comment by Alexander Barkov [ 2020-05-28 ]

More scripts:

SET NAMES dec8;
SET sql_mode=ORACLE;
EXECUTE IMMEDIATE CONCAT(0xD0, ':=1');

SET NAMES dec8;
SET sql_mode=ORACLE;
EXECUTE IMMEDIATE CONCAT('BEGIN ',0xD0, '(1); END;');

Comment by Alexander Barkov [ 2020-05-28 ]

More scripts:

SET NAMES dec8;
EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',0xD0, '=1 SELECT 1');

Generated at Thu Feb 08 09:16:11 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.