[MDEV-32479] UBSAN null pointer passed as argument 2, which is declared to never be null in my_case_bin on SELECT Created: 2023-10-16  Updated: 2023-11-28

Status: Open
Project: MariaDB Server
Component/s: Data types
Affects Version/s: 10.6, 10.9, 10.10, 10.11, 11.0, 11.1, 11.2, 11.3
Fix Version/s: 10.6, 10.11, 11.0, 11.1, 11.2

Type: Bug Priority: Major
Reporter: Ramesh Sivaraman Assignee: Alexander Barkov
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-31845 UBSAN: runtime error: null pointer pa... Confirmed

 Description   

CREATE TABLE t (a SET('') CHARACTER SET BINARY);
INSERT INTO t VALUES ('');
SELECT * FROM t WHERE LOWER(a)=LOWER(0);

Leads to:

11.3.0 5fc19e71375fb39eb85354321bf852d998aecf81 (Optimized, UBASAN)

/test/11.3_opt_san/strings/ctype-bin.c:253:3: runtime error: null pointer passed as argument 2, which is declared to never be null

11.3.0 5fc19e71375fb39eb85354321bf852d998aecf81 (Optimized, UBASAN)

    #0 0x559a6d3e4ce9 in my_case_bin /test/11.3_opt_san/strings/ctype-bin.c:253
    #1 0x559a6fd2d776 in Item_str_conv::val_str(String*) /test/11.3_opt_san/sql/item_strfunc.cc:2011
    #2 0x559a6f7ca279 in Arg_comparator::compare_string() /test/11.3_opt_san/sql/item_cmpfunc.cc:771
    #3 0x559a6f7add5b in Arg_comparator::compare() /test/11.3_opt_san/sql/item_cmpfunc.h:104
    #4 0x559a6f7add5b in Item_func_eq::val_int() /test/11.3_opt_san/sql/item_cmpfunc.cc:1780
    #5 0x559a6e13548e in evaluate_join_record /test/11.3_opt_san/sql/sql_select.cc:23587
    #6 0x559a6e18aa81 in sub_select(JOIN*, st_join_table*, bool) /test/11.3_opt_san/sql/sql_select.cc:23486
    #7 0x559a6e3668be in do_select /test/11.3_opt_san/sql/sql_select.cc:23003
    #8 0x559a6e3668be in JOIN::exec_inner() /test/11.3_opt_san/sql/sql_select.cc:4949
    #9 0x559a6e36b6a9 in JOIN::exec() /test/11.3_opt_san/sql/sql_select.cc:4726
    #10 0x559a6e358a7c in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.3_opt_san/sql/sql_select.cc:5257
    #11 0x559a6e35c713 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.3_opt_san/sql/sql_select.cc:628
    #12 0x559a6df3443f in execute_sqlcom_select /test/11.3_opt_san/sql/sql_parse.cc:6021
    #13 0x559a6df837f5 in mysql_execute_command(THD*, bool) /test/11.3_opt_san/sql/sql_parse.cc:3921
    #14 0x559a6df036a0 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.3_opt_san/sql/sql_parse.cc:7743
    #15 0x559a6df5a750 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.3_opt_san/sql/sql_parse.cc:1893
    #16 0x559a6df659dd in do_command(THD*, bool) /test/11.3_opt_san/sql/sql_parse.cc:1406
    #17 0x559a6e8ab81d in do_handle_one_connection(CONNECT*, bool) /test/11.3_opt_san/sql/sql_connect.cc:1445
    #18 0x559a6e8ade8c in handle_one_connection /test/11.3_opt_san/sql/sql_connect.cc:1347
    #19 0x152d15ce7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
    #20 0x152d14f5c132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

Seems this issue is related to MDEV-31845
Setup:

Compiled with GCC >=7.5.0 (I use GCC 11.4.0) and:
    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
Set before execution:
    export UBSAN_OPTIONS=print_stacktrace=1

Bug confirmed present in:
MariaDB: 10.6.16 (dbg), 10.6.16 (opt), 10.9.8 (opt), 10.9.8 (dbg) 11.0.4 (dbg), 11.0.4 (opt), 11.2.2 (opt), 11.3.0 (dbg), 11.3.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.4.32 (dbg), 10.4.32 (opt)


Generated at Thu Feb 08 10:31:40 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.