[MDEV-31221] UBSAN runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int' in my_strtoll10_utf32 Created: 2023-05-09  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: Character Sets, Data types
Affects Version/s: 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10, 10.11, 11.0, 11.1
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Alexander Barkov
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-28386 UBSAN: runtime error: negation of -X ... Confirmed

 Description   

SELECT CAST(CONVERT('-9223372036854775808' USING utf32) AS SIGNED);

Leads to:

11.0.2 8e55d7ea4a2f94ae3f38fdd8785778612d4b1203 (Debug)

/test/11.0_dbg_san/strings/ctype-ucs2.c:2604:11: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself

11.0.2 8e55d7ea4a2f94ae3f38fdd8785778612d4b1203 (Debug)

    #0 0x560ec6266926 in my_strtoll10_utf32 /test/11.0_dbg_san/strings/ctype-ucs2.c:2604
    #1 0x560ec3b8cb34 in charset_info_st::strtoll10(char const*, char**, int*) const /test/11.0_dbg_san/include/m_ctype.h:932
    #2 0x560ec3b8cb34 in Value_source::Converter_strtoll10::Converter_strtoll10(charset_info_st const*, char const*, unsigned long) /test/11.0_dbg_san/sql/field.h:247
    #3 0x560ec3b8cb34 in Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn(THD*, Value_source::Warn_filter, charset_info_st const*, char const*, unsigned long) /test/11.0_dbg_san/sql/field.h:305
    #4 0x560ec3b8cb34 in Item::val_int_from_str(int*) /test/11.0_dbg_san/sql/item.cc:252
    #5 0x560ec3b8d272 in Item::val_int_signed_typecast_from_str() /test/11.0_dbg_san/sql/item.cc:261
    #6 0x560ec320996f in Type_handler_string_result::Item_val_int_signed_typecast(Item*) const /test/11.0_dbg_san/sql/sql_type.cc:5218
    #7 0x560ec1abcacf in Item::val_int_signed_typecast() /test/11.0_dbg_san/sql/item.h:1472
    #8 0x560ec40f12c6 in Item_func_signed::val_int() /test/11.0_dbg_san/sql/item_func.h:1330
    #9 0x560ec32c61ec in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7488
    #10 0x560ec332e1c4 in Type_handler_longlong::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5760
    #11 0x560ec1ab669e in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235
    #12 0x560ec1c7215e in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
    #13 0x560ec203be8c in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
    #14 0x560ec27b2fc5 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
    #15 0x560ec27b2fc5 in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4761
    #16 0x560ec27b9a3c in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4672
    #17 0x560ec27a81fa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5153
    #18 0x560ec27ac655 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:611
    #19 0x560ec232be35 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6267
    #20 0x560ec238d190 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
    #21 0x560ec23bcaa8 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
    #22 0x560ec23cc83c in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
    #23 0x560ec23da641 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
    #24 0x560ec2d9e91b in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
    #25 0x560ec2d9fe36 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
    #26 0x152b8be94b42 in start_thread nptl/pthread_create.c:442
    #27 0x152b8bf269ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

Setup:

Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and:
    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON
Set before execution:
    export UBSAN_OPTIONS=print_stacktrace=1

Bug confirmed present in:
MariaDB: 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt), 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.3 (dbg), 10.11.3 (opt), 11.0.2 (dbg), 11.0.2 (opt), 11.1.0 (dbg), 11.1.0 (opt)



 Comments   
Comment by Roel Van de Paar [ 2023-05-13 ]

Four additional stacks/UniqueID's with this additional testcase:

SELECT (-1/1)/(-1/CONV(0,0,'-9223372036854775808/-1'));

Leads to (one additional stack/UniqueID per line):

UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn|Value_source::longlong_from_string_with_check
UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|charset_info_st::strtoll10|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn
UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|my_strtoll10_8bit|Value_source::Converter_strtoll10::Converter_strtoll10|Value_source::Converter_strtoll10_with_warn::Converter_strtoll10_with_warn
UBSAN|negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself|strings/my_strtoll10.c|my_strtoll10|my_strtoll10_8bit|charset_info_st::strtoll10|Value_source::Converter_strtoll10::Converter_strtoll10

Across versions/build types.

Generated at Thu Feb 08 10:22:11 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.