[MDEV-29494] Assertion `0' failed in Item_type_holder::val_int Created: 2022-09-08  Updated: 2024-01-29  Resolved: 2024-01-22

Status: Closed
Project: MariaDB Server
Component/s: Data Manipulation - Subquery
Affects Version/s: 10.10.1, 10.6, 10.7, 10.8, 10.9, 10.10
Fix Version/s: 10.6.17, 10.11.7, 11.0.5, 11.1.4, 11.2.3

Type: Bug Priority: Critical
Reporter: Zuming Jiang Assignee: Oleg Smirnov
Resolution: Fixed Votes: 0
Labels: crash
Environment:

Ubuntu 20.04

Attachments: Text File bug_report.txt     File bug_trigger_stmt.sql     File mysql_bk.sql    

 Description   

Dear MariaDB developers,
I am Zu-Ming Jiang, a PhD student at ETH Zurich. I used my new fuzzer to fuzz MariaDB and found a bug that can directly crashes MariaDB 10.10.1 server. The bug information is following:

The installation process of MariaDB (debug mode, enable ASAN)

cd mariadb-10.10.1
mkdir build; cd build
cmake .. -DCMAKE_BUILD_TYPE=Debug -DWITH_ASAN=ON
make -j12 && sudo make install

Reproduce process

– step 1: set up MariaDB server and create a database named "testdb"
/usr/local/mysql/bin/mysqld --basedir=/usr/local/mysql --datadir=/usr/local/mysql/data --plugin-dir=/usr/local/mysql/lib/plugin --user=mysql&
/usr/local/mysql/bin/mysql -uroot
mysql> create database testdb;

– step2: trigger the bug
/usr/local/mysql/bin/mysql --force -uroot -Dtestdb < mysql_bk.sql
/usr/local/mysql/bin/mysql --force -uroot -Dtestdb < bug_trigger_stmt.sql

Bug Information

The bug-triggering files "mysql_bk.sql" and "bug_trigger_stmt.sql" is in the attached.
The error report of MariaDB is in the attached file "bug_report.txt"

 Comments   
Comment by Alice Sherepa [ 2022-09-13 ]

Thank you!
I reproduced the issue on 10.6-10.10, but it is a sporadic crash, so it might be that it is also repeatable on earlier versions.

please run the test with --repeat=N (on my machine I used N=10)

--source include/have_innodb.inc 
 
 
set character_set_database='latin1';
 
 
 
DROP TABLE IF EXISTS t1;
 
/*!40101 SET @saved_cs_client     = @@character_set_client */;
 
/*!40101 SET character_set_client = utf8 */;
 
CREATE TABLE t1 (
 
  wkey int(11) DEFAULT NULL,
 
  pkey int(11) NOT NULL,
 
  c_72_xob double DEFAULT NULL,
 
  c_zlh1ud text DEFAULT NULL,
 
  c_xcmo8c int(11) DEFAULT NULL,
 
  c_wwyiz int(11) DEFAULT NULL,
 
  c_s7edob int(11) DEFAULT NULL,
 
  PRIMARY KEY (pkey)
 
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
 
/*!40101 SET character_set_client = @saved_cs_client */;
 
 
 
 
 
LOCK TABLES t1 WRITE;
 
/*!40000 ALTER TABLE t1 DISABLE KEYS */;
 
INSERT INTO t1 VALUES
 
(6,34000,83.9,'ta76fd',NULL,78,NULL),
 
(6,35000,NULL,'jv3vgb',NULL,32,NULL),
 
(6,36000,NULL,NULL,NULL,99,NULL),
 
(8,43000,90.44,'yh2u_',99,NULL,78),
 
(8,44000,69.21,'sk8djd',18,NULL,46),
 
(8,45000,68.48,'7yjo8',60,NULL,71),
 
(10,54000,79.54,'giyn0c',27,NULL,67),
 
(10,55000,30.1,'ylxulc',11,NULL,22),
 
(10,56000,23.86,'yn_sfd',42,NULL,54),
 
(10,57000,57.3,'q4_nqc',48,NULL,42),
 
(10,58000,61.26,'zvjqzd',27,NULL,46),
 
(10,59000,39.92,'r4ski',51,NULL,78),
 
(11,60000,80.95,'i4lj9d',NULL,24,18),
 
(11,61000,48.97,'zcoc1b',NULL,18,76),
 
(11,62000,12.66,'jdomob',NULL,8,99),
 
(11,63000,39.39,'6wc41d',NULL,27,91),
 
(11,64000,35.19,NULL,NULL,26,48),
 
(11,65000,35.61,'ioip1',NULL,86,98),
 
(11,66000,15.9,NULL,NULL,67,47);
 
/*!40000 ALTER TABLE t1 ENABLE KEYS */;
 
UNLOCK TABLES;
 
 
 
 
 
DROP TABLE IF EXISTS t_esb_id;
 
/*!40101 SET @saved_cs_client     = @@character_set_client */;
 
/*!40101 SET character_set_client = utf8 */;
 
CREATE TABLE t_esb_id (
 
  wkey int(11) DEFAULT NULL,
 
  pkey int(11) NOT NULL,
 
  c_y3v2ud text DEFAULT NULL,
 
  c_t2zrt text DEFAULT NULL,
 
  c_fvch6 int(11) DEFAULT NULL,
 
  c_jtjr_c int(11) DEFAULT NULL,
 
  c_uq1mvd int(11) DEFAULT NULL,
 
  PRIMARY KEY (pkey)
 
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
 
/*!40101 SET character_set_client = @saved_cs_client */;
 
 
 
LOCK TABLES t_esb_id WRITE;
 
/*!40000 ALTER TABLE t_esb_id DISABLE KEYS */;
 
INSERT INTO t_esb_id VALUES
 
(1,11000,'gjjtv','s14rvb',3,54,NULL),
 
(1,12000,'pxkm9c',NULL,16,53,NULL),
 
(1,13000,'fe6c0d','izdnlc',71,11,NULL),
 
(1,14000,'iot45b','rkmr4c',86,38,NULL),
 
(2,15000,NULL,'wckpwb',34,53,67),
 
(2,16000,NULL,'yrhs8c',58,49,35),
 
(2,17000,NULL,'kitrmb',32,15,91),
 
(2,18000,NULL,'3za5ab',92,47,18),
 
(2,19000,NULL,'evzu8b',52,76,29),
 
(2,20000,NULL,'pwt0kb',27,78,53),
 
(2,21000,NULL,'wyebvd',32,69,97),
 
(3,22000,'uzru9','tvuxsb',34,48,3),
 
(3,23000,'nunfmc',NULL,23,23,13),
 
(3,24000,'pcv7w','sqdezd',94,47,51),
 
(3,25000,'1iefuc',NULL,60,75,100),
 
(4,26000,NULL,'r2s6cb',19,63,99),
 
(4,27000,NULL,'v1yokd',73,71,78),
 
(4,28000,NULL,'wnkh_d',87,46,11),
 
(5,29000,NULL,'glhoh',NULL,33,89),
 
(5,30000,NULL,'ixnvgd',NULL,62,15),
 
(5,31000,NULL,'txd8ub',NULL,63,1),
 
(5,32000,NULL,'v3l_cb',NULL,40,73),
 
(5,33000,NULL,'gitx0d',NULL,42,40),
 
(7,37000,NULL,'r5ddyc',57,65,96),
 
(7,38000,NULL,'4li_ab',100,42,71),
 
(7,39000,NULL,'cewbfd',63,18,24),
 
(7,40000,NULL,'ko9pb',80,61,84),
 
(7,41000,NULL,NULL,71,67,37),
 
(7,42000,NULL,'u95kz',86,35,95),
 
(9,46000,NULL,NULL,26,NULL,81),
 
(9,47000,NULL,NULL,41,NULL,51),
 
(9,48000,NULL,NULL,48,NULL,65),
 
(9,49000,NULL,NULL,72,NULL,82),
 
(9,50000,NULL,NULL,23,NULL,35),
 
(9,51000,NULL,NULL,88,NULL,26),
 
(9,52000,NULL,NULL,75,NULL,80),
 
(9,53000,NULL,NULL,47,NULL,13),
 
(12,67000,'wr78bd','he339c',38,NULL,54),
 
(12,68000,'n8djb','j82bv',45,NULL,48),
 
(12,69000,'ezlvc','3i0j1b',17,NULL,2),
 
(12,70000,'2ikhyc','n1x0o',67,NULL,29),
 
(13,71000,NULL,NULL,NULL,81,8),
 
(13,72000,NULL,'fgwjdd',NULL,42,75),
 
(13,73000,NULL,'gx93gd',NULL,27,35),
 
(13,74000,NULL,'yc4ouc',NULL,99,71),
 
(13,75000,NULL,'mfyumb',NULL,20,71),
 
(13,76000,NULL,'qwqeic',NULL,15,97),
 
(13,77000,NULL,'ek6gec',NULL,86,73),
 
(14,78000,'h6rfrc','cfubq',NULL,NULL,34),
 
(14,79000,'k3dzbd',NULL,NULL,NULL,50),
 
(14,80000,'njjry','js8rac',NULL,NULL,76),
 
(15,81000,'u1i1jd','foj9yc',55,4,NULL),
 
(15,82000,'3vtvxd','segeac',39,26,NULL),
 
(15,83000,'philtc','qdqlw',97,70,NULL),
 
(15,84000,'_z1zjb','9gppfd',75,44,NULL),
 
(15,85000,NULL,'rtg5',87,34,NULL);
 
/*!40000 ALTER TABLE t_esb_id ENABLE KEYS */;
 
UNLOCK TABLES;
 
 
 
SELECT subq_0.c0 AS c0
 
FROM
 
 (SELECT ref_0.c_s7edob AS c0
 
  FROM t1 AS ref_0
 
  WHERE ref_0.c_s7edob NOT IN
 
    (SELECT ref_1.c_wwyiz AS c0
 
     FROM t1 AS ref_1)) AS subq_0
 
WHERE subq_0.c0 =
 
  (SELECT ref_3.c_wwyiz AS c0
 
   FROM (t1 AS ref_2
 
         CROSS JOIN t1 AS ref_3)
 
   UNION SELECT ref_4.c_wwyiz AS c0
 
   FROM t1 AS ref_4 LIMIT 1);

10.6 fd0bdd3180a7d5f4b9804d372d6a63b6

 
/10.6/src/sql/item.cc:10661: virtual longlong Item_type_holder::val_int(): Assertion `0' failed.
 
220913 17:24:25 [ERROR] mysqld got signal 6 ;
 
 
 
Server version: 10.6.10-MariaDB-debug-log
 
 
 
??:0(__assert_fail)[0x7f15b6a23fd6]
 
sql/item.cc:10662(Item_type_holder::val_int())[0x55e6793f5cb1]
 
sql/item.h:1760(Item::val_int_result())[0x55e6788002f4]
 
sql/item.cc:10087(Item_cache_int::cache_value())[0x55e6793ef9fc]
 
sql/item.h:7088(Item_cache::has_value())[0x55e67911d6e4]
 
sql/item.h:7097(Item_cache::is_null())[0x55e67911d8e4]
 
sql/item_subselect.h:673(Item_in_subselect::disable_cond_guard_for_const_null_left_expr(int))[0x55e6795b12a9]
 
sql/item_subselect.cc:2395(Item_in_subselect::create_single_in_to_exists_cond(JOIN*, Item**, Item**))[0x55e679587786]
 
sql/item_subselect.cc:2800(Item_in_subselect::create_in_to_exists_cond(JOIN*))[0x55e67958d492]
 
sql/opt_subselect.cc:6522(JOIN::choose_subquery_plan(unsigned long long))[0x55e679045e66]
 
sql/sql_select.cc:5969(make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*))[0x55e678bb8b11]
 
sql/sql_select.cc:2494(JOIN::optimize_inner())[0x55e678b94b73]
 
sql/sql_select.cc:1836(JOIN::optimize())[0x55e678b8dc12]
 
sql/sql_lex.cc:4944(st_select_lex::optimize_unflattened_subqueries(bool))[0x55e678a58c4f]
 
sql/opt_subselect.cc:5656(JOIN::optimize_unflattened_subqueries())[0x55e67904007f]
 
sql/sql_select.cc:3097(JOIN::optimize_stage2())[0x55e678b9b0ff]
 
sql/sql_select.cc:2520(JOIN::optimize_inner())[0x55e678b94e7e]
 
sql/sql_select.cc:1836(JOIN::optimize())[0x55e678b8dc12]
 
sql/sql_select.cc:5027(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55e678baf550]
 
sql/sql_select.cc:554(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55e678b7f679]
 
sql/sql_parse.cc:6256(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55e678ae3c72]
 
sql/sql_parse.cc:3946(mysql_execute_command(THD*, bool))[0x55e678ad2826]
 
sql/sql_parse.cc:8030(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x55e678aeef41]
 
sql/sql_parse.cc:1898(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x55e678ac5109]
 
sql/sql_parse.cc:1409(do_command(THD*, bool))[0x55e678ac1e60]
 
sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x55e678f2d034]
 
sql/sql_connect.cc:1320(handle_one_connection)[0x55e678f2c991]
 
perfschema/pfs.cc:2203(pfs_spawn_thread)[0x55e679ba851a]
 
nptl/pthread_create.c:478(start_thread)[0x7f15b6f3e609]
 
 
 
??:0(clone)[0x7f15b6b0f133]
 
 
 
Trying to get some variables.
 
Some pointers may be invalid and cause the dump to abort.
 
Query (0x62b0000c42a8): SELECT subq_0.c0 AS c0
 
FROM
 
(SELECT ref_0.c_s7edob AS c0
 
FROM t1 AS ref_0
 
WHERE ref_0.c_s7edob NOT IN
 
(SELECT ref_1.c_wwyiz AS c0
 
FROM t1 AS ref_1)) AS subq_0
 
WHERE subq_0.c0 =
 
(SELECT ref_3.c_wwyiz AS c0
 
FROM (t1 AS ref_2
 
CROSS JOIN t1 AS ref_3)
 
UNION SELECT ref_4.c_wwyiz AS c0
 
FROM t1 AS ref_4 LIMIT 1)

Comment by Oleg Smirnov [ 2024-01-19 ]

This issue is fixed by MDEV-29070. Once the patch for MDEV-29070 is merged upstream (which should be done before next series of releases), this task can be marked as resolved.

Comment by Oleg Smirnov [ 2024-01-22 ]

Actually, MDEV-29070 is already merged upstream, so the issue is fixed.

Generated at Thu Feb 08 10:09:02 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.