[MDEV-31844] Server crashes when executing PS having ALTER statement after setting empty character_set_collations, UBSAN: member call on null pointer of type 'struct Reprepare_observer' Created: 2023-08-04  Updated: 2023-12-12

Status: Open
Project: MariaDB Server
Component/s: Prepared Statements
Affects Version/s: 11.2, 11.3
Fix Version/s: 11.2

Type: Bug Priority: Critical
Reporter: Ramesh Sivaraman Assignee: Dmitry Shulga
Resolution: Unresolved Votes: 0
Labels: crash-recovery, not-10.10, not-10.11, not-10.4, not-10.5, not-10.6, not-10.9, not-11.0


 Description   

PREPARE s FROM "ALTER TABLE t modify b TEXT CHARACTER SET utf8 DEFAULT '' ";
SET @@character_set_collations='';
EXECUTE s;

Leads to:

11.2.0 e81fa345020ec6a067583db6a7019d6404b26f93 (Optimized)

Core was generated by `/test/MD270723-mariadb-11.2.0-linux-x86_64-opt/bin/mariadbd --no-defaults --cor'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  Reprepare_observer::report_error (this=0x0, thd=<optimized out>)
    at /test/11.2_opt/sql/sql_prepare.cc:3808
[Current thread is 1 (Thread 0x14f500088700 (LWP 3371857))]
(gdb) bt
#0  Reprepare_observer::report_error (this=0x0, thd=<optimized out>) at /test/11.2_opt/sql/sql_prepare.cc:3808
#1  0x0000560e602cf83b in Prepared_statement::check_charset_collation_map_version (this=0x14f4a4016948, this=0x14f4a4016948, observer=<optimized out>, thd=<optimized out>) at /test/11.2_opt/sql/sql_prepare.cc:238
#2  Prepared_statement::execute (this=0x14f4a4016948, expanded_query=0x14f500086e00, open_cursor=false) at /test/11.2_opt/sql/sql_prepare.cc:4898
#3  0x0000560e602cfb65 in Prepared_statement::execute_loop (this=this@entry=0x14f4a4016948, expanded_query=expanded_query@entry=0x14f500086e00, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/11.2_opt/sql/sql_prepare.cc:4433
#4  0x0000560e602cfe7b in mysql_sql_stmt_execute (thd=thd@entry=0x14f4a4000c58) at /test/11.2_opt/sql/sql_prepare.cc:3470
#5  0x0000560e602af911 in mysql_execute_command (thd=0x14f4a4000c58, is_called_from_prepared_stmt=<optimized out>) at /test/11.2_opt/sql/sql_parse.cc:3960
#6  0x0000560e6029e1e5 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x14f4a4000c58) at /test/11.2_opt/sql/sql_parse.cc:7800
#7  mysql_parse (thd=0x14f4a4000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/11.2_opt/sql/sql_parse.cc:7722
#8  0x0000560e602aa092 in dispatch_command (command=COM_QUERY, thd=0x14f4a4000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/11.2_opt/sql/sql_class.h:1374
#9  0x0000560e602abf7e in do_command (thd=0x14f4a4000c58, blocking=blocking@entry=true) at /test/11.2_opt/sql/sql_parse.cc:1405
#10 0x0000560e603cb6cf in do_handle_one_connection (connect=<optimized out>, connect@entry=0x560e628f4b78, put_in_cache=put_in_cache@entry=true) at /test/11.2_opt/sql/sql_connect.cc:1445
#11 0x0000560e603cb9bd in handle_one_connection (arg=0x560e628f4b78) at /test/11.2_opt/sql/sql_connect.cc:1347
#12 0x000014f519530609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#13 0x000014f51911c133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 11.2.0 (dbg), 11.2.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.4.31 (dbg), 10.4.31 (opt), 10.5.22 (dbg), 10.5.22 (opt), 10.6.15 (dbg), 10.6.15 (opt), 10.9.8 (dbg), 10.9.8 (opt), 10.10.6 (dbg), 10.10.6 (opt), 10.11.5 (dbg), 10.11.5 (opt), 11.0.2 (dbg), 11.0.3 (dbg), 11.0.3 (opt), 11.1.2 (dbg), 11.1.2 (opt)



 Comments   
Comment by Ramesh Sivaraman [ 2023-09-22 ]

11.3.0 fa64a7a10cb23475c3008ff3d935d12659d2a81f (Optimized, UBASAN)

/test/mtest/MDEV-31606/11.3_opt_san/sql/sql_prepare.cc:238:29: runtime error: member call on null pointer of type 'struct Reprepare_observer'
    #0 0x5609a6886a39 in Prepared_statement::check_charset_collation_map_version(THD*, Reprepare_observer*) /test/mtest/MDEV-31606/11.3_opt_san/sql/sql_prepare.cc:238

Generated at Thu Feb 08 10:26:54 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.