[MDEV-23269] SIGSEGV in ft_boolean_check_syntax_string on setting ft_boolean_syntax Created: 2020-07-23  Updated: 2021-10-11  Resolved: 2021-10-11

Status: Closed
Project: MariaDB Server
Component/s: Character Sets
Affects Version/s: 10.1, 10.2, 10.3, 10.4, 10.5, 10.6, 10.7
Fix Version/s: 10.2.41, 10.3.32, 10.4.22, 10.5.13, 10.6.5, 10.7.1

Type: Bug Priority: Critical
Reporter: Roel Van de Paar Assignee: Alexander Barkov
Resolution: Fixed Votes: 0
Labels: affects-tests


 Description    

# mysqld options required for replay: --character-set-server=utf16
 
SET GLOBAL ft_boolean_syntax=' ~/!@#$%^&*()-';

Leads to:

10.5.5 054f10365c49b70a3868edc0c955ffe187f8344c (Debug)

 
Core was generated by `/test/MD200720-mariadb-10.5.5-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
 
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
 
[Current thread is 1 (Thread 0x14bb72bec700 (LWP 1762217))]
 
(gdb) bt
 
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
 
#1  0x000055f87fa7182d in my_write_core (sig=sig@entry=11) at /test/10.5_dbg/mysys/stacktrace.c:518
 
#2  0x000055f87f22b75c in handle_fatal_signal (sig=11) at /test/10.5_dbg/sql/signal_handler.cc:330
 
#3  <signal handler called>
 
#4  0x000055f87f9ff71d in ft_boolean_check_syntax_string (str=<optimized out>) at /test/10.5_dbg/storage/myisam/ft_parser.c:93
 
#5  0x000055f87f0eb83c in check_ftb_syntax (self=<optimized out>, thd=<optimized out>, var=<optimized out>) at /test/10.5_dbg/sql/sys_vars.cc:1183
 
#6  0x000055f87ee97150 in sys_var::check (this=0x55f8807eaac0 <Sys_ft_boolean_syntax>, thd=thd@entry=0x14bb4f015088, var=var@entry=0x14bb4f074398) at /test/10.5_dbg/sql/set_var.cc:246
 
#7  0x000055f87ee981e0 in set_var::check (this=0x14bb4f074398, thd=0x14bb4f015088) at /test/10.5_dbg/sql/set_var.cc:811
 
#8  0x000055f87ee9890c in sql_set_variables (thd=thd@entry=0x14bb4f015088, var_list=var_list@entry=0x14bb4f019fb0, free=free@entry=true) at /test/10.5_dbg/sql/set_var.cc:739
 
#9  0x000055f87ef81b8f in mysql_execute_command (thd=thd@entry=0x14bb4f015088) at /test/10.5_dbg/sql/sql_parse.cc:5008
 
#10 0x000055f87ef8bb8a in mysql_parse (thd=thd@entry=0x14bb4f015088, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14bb72beb350, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7993
 
#11 0x000055f87ef7863c in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14bb4f015088, packet=packet@entry=0x14bb4f067089 "SET GLOBAL ft_boolean_syntax=' ~/!@#$%^&*()-'", packet_length=packet_length@entry=45, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1866
 
#12 0x000055f87ef76e16 in do_command (thd=0x14bb4f015088) at /test/10.5_dbg/sql/sql_parse.cc:1347
 
#13 0x000055f87f0d34af in do_handle_one_connection (connect=<optimized out>, connect@entry=0x14bb51cc9808, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1411
 
#14 0x000055f87f0d3bcb in handle_one_connection (arg=arg@entry=0x14bb51cc9808) at /test/10.5_dbg/sql/sql_connect.cc:1313
 
#15 0x000055f87f537dca in pfs_spawn_thread (arg=0x14bb6f846508) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201
 
#16 0x000014bb71b656db in start_thread (arg=0x14bb72bec700) at pthread_create.c:463
 
#17 0x000014bb70f63a3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.1.46 (dbg), 10.1.46 (opt), 10.2.33 (dbg), 10.2.33 (opt), 10.3.24 (dbg), 10.3.24 (opt), 10.4.14 (dbg), 10.4.14 (opt), 10.5.5 (dbg), 10.5.5 (opt)

Bug confirmed not present in:
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt)

 Comments   
Comment by Roel Van de Paar [ 2021-07-29 ] 

# mysqld options required for replay:  --character-set-server=utf32
 
SET GLOBAL ft_boolean_syntax=DEFAULT;

Leads to:

10.7.0 71ed8c136fa203b9b3a678a6d5cc72235ef73ef7 (Debug)

 
Core was generated by `/test/MD200721-mariadb-10.7.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  0x000055b514205be9 in ft_boolean_check_syntax_string (str=<optimized out>)
 
    at /test/10.7_dbg/storage/myisam/ft_parser.c:93
 
[Current thread is 1 (Thread 0x14c735967700 (LWP 1118074))]
 
(gdb) bt
 
#0  0x000055b514205be9 in ft_boolean_check_syntax_string (str=<optimized out>) at /test/10.7_dbg/storage/myisam/ft_parser.c:93
 
#1  0x000055b51390d51c in check_ftb_syntax (self=<optimized out>, thd=<optimized out>, var=<optimized out>) at /test/10.7_dbg/sql/sys_vars.cc:1239
 
#2  0x000055b51367cc60 in sys_var::check (this=this@entry=0x55b514d703e0 <Sys_ft_boolean_syntax>, thd=thd@entry=0x14c700000db8, var=var@entry=0x14c700013ec0) at /test/10.7_dbg/sql/set_var.cc:246
 
#3  0x000055b51367d064 in sys_var::set_default (this=0x55b514d703e0 <Sys_ft_boolean_syntax>, thd=0x14c700000db8, var=0x14c700013ec0) at /test/10.7_dbg/sql/set_var.cc:293
 
#4  0x000055b51367d0b5 in set_var::update (this=<optimized out>, thd=<optimized out>) at /test/10.7_dbg/sql/set_var.cc:863
 
#5  0x000055b51367e3ed in sql_set_variables (thd=thd@entry=0x14c700000db8, var_list=var_list@entry=0x14c700006038, free=free@entry=true) at /test/10.7_dbg/sql/set_var.cc:745
 
#6  0x000055b513782821 in mysql_execute_command (thd=thd@entry=0x14c700000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.7_dbg/sql/sql_parse.cc:5037
 
#7  0x000055b51376bead in mysql_parse (thd=thd@entry=0x14c700000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14c735966400) at /test/10.7_dbg/sql/sql_parse.cc:8026
 
#8  0x000055b51377a9f8 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14c700000db8, packet=packet@entry=0x14c70000b749 "SET GLOBAL ft_boolean_syntax=DEFAULT", packet_length=packet_length@entry=36, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_class.h:1340
 
#9  0x000055b51377de05 in do_command (thd=0x14c700000db8, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_parse.cc:1404
 
#10 0x000055b5138f3f48 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55b516b441d8, put_in_cache=put_in_cache@entry=true) at /test/10.7_dbg/sql/sql_connect.cc:1410
 
#11 0x000055b5138f454d in handle_one_connection (arg=arg@entry=0x55b516b441d8) at /test/10.7_dbg/sql/sql_connect.cc:1312
 
#12 0x000055b513d5c5b2 in pfs_spawn_thread (arg=0x55b516a2c278) at /test/10.7_dbg/storage/perfschema/pfs.cc:2201
 
#13 0x000014c74cd21609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#14 0x000014c74c90f293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.2.39 (dbg), 10.2.39 (opt), 10.3.30 (dbg), 10.3.30 (opt), 10.4.20 (dbg), 10.4.20 (opt), 10.5.11 (dbg), 10.5.11 (opt), 10.6.4 (dbg), 10.6.4 (opt), 10.7.0 (dbg), 10.7.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.34 (dbg), 5.7.34 (opt), 8.0.24 (dbg), 8.0.24 (opt)

Comment by Roel Van de Paar [ 2021-08-17 ]

Slightly different stack with

# mysqld options required for replay:  --character-set-server=utf16
 
SET @@global.ft_boolean_syntax=DEFAULT;

Leads to:

10.6.5 9ac1ac006197c8979db1dc73f4e983f623e831e8 (Debug)

 
Core was generated by `/test/MD160821-mariadb-10.6.5-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  0x0000562d8cdc8613 in ft_boolean_check_syntax_string (str=<optimized out>)
 
    at /test/10.6_dbg/storage/myisam/ft_parser.c:93
 
[Current thread is 1 (Thread 0x148224e3f700 (LWP 2114415))]
 
(gdb) bt
 
#0  0x0000562d8cdc8613 in ft_boolean_check_syntax_string (str=<optimized out>) at /test/10.6_dbg/storage/myisam/ft_parser.c:93
 
#1  0x0000562d8c48a559 in check_ftb_syntax (self=<optimized out>, thd=<optimized out>, var=<optimized out>) at /test/10.6_dbg/sql/sys_vars.cc:1215
 
#2  0x0000562d8c21067a in sys_var::check (this=this@entry=0x562d8d934280 <Sys_ft_boolean_syntax>, thd=thd@entry=0x1481d8000db8, var=var@entry=0x1481d80141d0) at /test/10.6_dbg/sql/set_var.cc:246
 
#3  0x0000562d8c210a7e in sys_var::set_default (this=0x562d8d934280 <Sys_ft_boolean_syntax>, thd=0x1481d8000db8, var=0x1481d80141d0) at /test/10.6_dbg/sql/set_var.cc:293
 
#4  0x0000562d8c210acf in set_var::update (this=<optimized out>, thd=<optimized out>) at /test/10.6_dbg/sql/set_var.cc:863
 
#5  0x0000562d8c211e07 in sql_set_variables (thd=thd@entry=0x1481d8000db8, var_list=var_list@entry=0x1481d8006028, free=free@entry=true) at /test/10.6_dbg/sql/set_var.cc:745
 
#6  0x0000562d8c3113af in mysql_execute_command (thd=thd@entry=0x1481d8000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.6_dbg/sql/sql_parse.cc:5036
 
#7  0x0000562d8c2fa955 in mysql_parse (thd=thd@entry=0x1481d8000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148224e3e400) at /test/10.6_dbg/sql/sql_parse.cc:8030
 
#8  0x0000562d8c30957a in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1481d8000db8, packet=packet@entry=0x1481d800b759 "SET @@global.ft_boolean_syntax=DEFAULT", packet_length=packet_length@entry=38, blocking=blocking@entry=true) at /test/10.6_dbg/sql/sql_class.h:1357
 
#9  0x0000562d8c30c993 in do_command (thd=0x1481d8000db8, blocking=blocking@entry=true) at /test/10.6_dbg/sql/sql_parse.cc:1404
 
#10 0x0000562d8c471264 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x562d9008e0c8, put_in_cache=put_in_cache@entry=true) at /test/10.6_dbg/sql/sql_connect.cc:1418
 
#11 0x0000562d8c471869 in handle_one_connection (arg=arg@entry=0x562d9008e0c8) at /test/10.6_dbg/sql/sql_connect.cc:1312
 
#12 0x0000562d8c9201ec in pfs_spawn_thread (arg=0x562d8ff766c8) at /test/10.6_dbg/storage/perfschema/pfs.cc:2201
 
#13 0x000014823a1c6609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#14 0x0000148239db4293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

10.6.5 9ac1ac006197c8979db1dc73f4e983f623e831e8 (Optimized)

 
Core was generated by `/test/MD160821-mariadb-10.6.5-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  0x0000562daae59112 in ft_boolean_check_syntax_string (
 
    str=0x562dab06033c "+ -><()~*:\"\"&|")
 
    at /test/10.6_opt/storage/myisam/ft_parser.c:93
 
[Current thread is 1 (Thread 0x14a8c4079700 (LWP 2114213))]
 
(gdb) bt
 
#0  0x0000562daae59112 in ft_boolean_check_syntax_string (str=0x562dab06033c "+ -><()~*:\"\"&|") at /test/10.6_opt/storage/myisam/ft_parser.c:93
 
#1  0x0000562daa8439c1 in check_ftb_syntax (self=<optimized out>, thd=<optimized out>, var=<optimized out>) at /test/10.6_opt/sql/sys_vars.cc:1215
 
#2  0x0000562daa6607af in sys_var::check (this=0x562dab885480 <Sys_ft_boolean_syntax>, thd=0x14a854000c58, var=0x14a854010a70) at /test/10.6_opt/sql/sql_string.h:682
 
#3  0x0000562daa6609d0 in sys_var::set_default (this=0x562dab885480 <Sys_ft_boolean_syntax>, thd=0x14a854000c58, var=0x14a854010a70) at /test/10.6_opt/sql/set_var.cc:293
 
#4  0x0000562daa660a35 in set_var::update (thd=<optimized out>, this=<optimized out>) at /test/10.6_opt/sql/set_var.cc:861
 
#5  set_var::update (this=<optimized out>, thd=<optimized out>) at /test/10.6_opt/sql/set_var.cc:861
 
#6  0x0000562daa661bb9 in sql_set_variables (thd=thd@entry=0x14a854000c58, var_list=var_list@entry=0x14a854005d08, free=free@entry=true) at /test/10.6_opt/sql/set_var.cc:745
 
#7  0x0000562daa7262a9 in mysql_execute_command (thd=0x14a854000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.6_opt/sql/sql_parse.cc:5036
 
#8  0x0000562daa7155c6 in mysql_parse (thd=0x14a854000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.6_opt/sql/sql_parse.cc:8030
 
#9  0x0000562daa7214c5 in dispatch_command (command=COM_QUERY, thd=0x14a854000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.6_opt/sql/sql_class.h:1357
 
#10 0x0000562daa7233e7 in do_command (thd=0x14a854000c58, blocking=blocking@entry=true) at /test/10.6_opt/sql/sql_parse.cc:1404
 
#11 0x0000562daa831ef7 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/10.6_opt/sql/sql_connect.cc:1418
 
#12 0x0000562daa83223d in handle_one_connection (arg=arg@entry=0x562dad36e588) at /test/10.6_opt/sql/sql_connect.cc:1312
 
#13 0x0000562daabbc778 in pfs_spawn_thread (arg=0x562dad2e55d8) at /test/10.6_opt/storage/perfschema/pfs.cc:2201
 
#14 0x000014a8cca09609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#15 0x000014a8cc5f7293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.2.41 (dbg), 10.2.41 (opt), 10.3.32 (dbg), 10.4.22 (opt), 10.5.13 (opt), 10.6.5 (dbg), 10.6.5 (opt), 10.7.0 (dbg), 10.7.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.32 (opt), 10.4.22 (dbg), 10.5.13 (dbg)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.35 (dbg), 5.7.35 (opt), 8.0.26 (dbg), 8.0.26 (opt)

Comment by Roel Van de Paar [ 2021-08-17 ]

The

str=0x562dab06033c "+ -><()~*:\"\"&|"

in the optimized stack seems odd?

Comment by Alexander Barkov [ 2021-10-08 ]

The crash is repeatable with "mtr ctype_utf16_def" if I apply this patch:

diff --git a/mysql-test/t/ctype_utf16_def.test b/mysql-test/t/ctype_utf16_def.test
 
index 0829cd53285..9faa7f6a037 100644
 
--- a/mysql-test/t/ctype_utf16_def.test
 
+++ b/mysql-test/t/ctype_utf16_def.test
 
@@ -7,3 +7,5 @@ call mtr.add_suppression("'utf16' can not be used as client character set");
 
 SHOW VARIABLES LIKE 'collation_server';
 
 SHOW VARIABLES LIKE 'character_set_server';
 
 SHOW VARIABLES LIKE 'ft_stopword_file';
 
+
 
+SET GLOBAL ft_boolean_syntax=DEFAULT;

Comment by Alexander Barkov [ 2021-10-08 ]

sanja_byelkin, please review a patch:

https://github.com/MariaDB/server/commit/2deca3caab531fd046fa58034cae2a1a67ebf713

Comment by Oleksandr Byelkin [ 2021-10-11 ]

OK to push

Generated at Thu Feb 08 09:21:08 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.