[MDEV-32992] Server crashes when the result set has a decimal part when using the UNION with ORDER BY (SELECT .. LIMIT) clause Created: 2023-12-12  Updated: 2023-12-12

Status: Open
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 11.4
Fix Version/s: 11.4

Type: Bug Priority: Major
Reporter: Ramesh Sivaraman Assignee: Sergei Petrunia
Resolution: Unresolved Votes: 0
Labels: None


 Description   

The stack is almost identical to MDEV-32606, but the crash is in a different location in sql/my_decimal.h.

SELECT 0.0 a UNION SELECT 0 ORDER BY (SELECT a LIMIT 0);

Leads to

11.4.0 6b2287fff23fbdc362499501c562f01d0d2db52e (Optimized)

Core was generated by `/test/MD301123-mariadb-11.4.0-linux-x86_64-opt/bin/mariadbd --no-defaults --cor'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00005616befc5d52 in my_decimal::operator= (rhs=..., this=0x14cce80bfc00)
    at /test/11.4_opt/sql/my_decimal.h:353
[Current thread is 1 (Thread 0x14cce80c2700 (LWP 2551264))]
(gdb) bt
#0  0x00005616befc5d52 in my_decimal::operator= (rhs=<error reading variable>, this=0x14cce80bfc00) at /test/11.4_opt/sql/my_decimal.h:353
#1  my_decimal2decimal (to=0x14cce80bfc00, from=0x0) at /test/11.4_opt/sql/my_decimal.h:353
#2  my_decimal::to_binary (this=0x0, bin=bin@entry=0x14ccb003c548 "", prec=3, scale=1, mask=mask@entry=30) at /test/11.4_opt/sql/my_decimal.cc:206
#3  0x00005616bee7022f in Type_handler_decimal_result::make_sort_key_part (this=<optimized out>, to=0x14ccb003c548 "", item=0x14ccb001c4b8, sort_field=0x14ccb001c878, tmp_buffer=<optimized out>) at /test/11.4_opt/sql/filesort.cc:1382
#4  0x00005616bee71253 in make_sortkey (to=0x14ccb003c548 "", param=0x14cce80bfe90) at /test/11.4_opt/sql/filesort.cc:2956
#5  make_sortkey (param=param@entry=0x14cce80bfe90, to=0x14ccb003c548 "", ref_pos=ref_pos@entry=0x14ccb0017948 "\230\323\001\260\314\024", using_packed_sortkeys=using_packed_sortkeys@entry=false) at /test/11.4_opt/sql/filesort.cc:1415
#6  0x00005616bee73d3f in find_all_keys (found_rows=0x14ccb003c520, pq=0x0, tempfile=0x14cce80bff50, buffpek_pointers=0x14cce80c0040, fs_info=0x14ccb003c3b0, select=0x14ccb001c1f8, param=0x14cce80bfe90, thd=0x14ccb0000c58) at /test/11.4_opt/sql/filesort.cc:1031
#7  filesort (thd=0x14ccb0000c58, table=table@entry=0x14ccb0016bd0, filesort=filesort@entry=0x14ccb001c7c8, tracker=0x14ccb001c810, join=join@entry=0x14ccb0019330, first_table_bit=<optimized out>) at /test/11.4_opt/sql/filesort.cc:408
#8  0x00005616bec5d9f2 in create_sort_index (thd=<optimized out>, join=0x14ccb0019330, tab=tab@entry=0x14ccb001b300, fsort=0x14ccb001c7c8, fsort@entry=0x0) at /test/11.4_opt/sql/sql_select.cc:26903
#9  0x00005616bec5dda2 in st_join_table::sort_table (this=this@entry=0x14ccb001b300) at /test/11.4_opt/sql/sql_select.cc:24542
#10 0x00005616bec5de75 in join_init_read_record (tab=0x14ccb001b300) at /test/11.4_opt/sql/sql_select.cc:24462
#11 0x00005616bec4576f in sub_select (join=0x14ccb0019330, join_tab=0x14ccb001b300, end_of_records=false) at /test/11.4_opt/sql/sql_select.cc:23497
#12 0x00005616bec77e6d in do_select (procedure=<optimized out>, join=0x14ccb0019330) at /test/11.4_opt/sql/sql_select.cc:23017
#13 JOIN::exec_inner (this=0x14ccb0019330) at /test/11.4_opt/sql/sql_select.cc:4940
#14 0x00005616bec7828e in JOIN::exec (this=this@entry=0x14ccb0019330) at /test/11.4_opt/sql/sql_select.cc:4726
#15 0x00005616bec762d0 in mysql_select (thd=0x14ccb0000c58, tables=0x14ccb0004f58, fields=<optimized out>, conds=conds@entry=0x0, og_num=1, order=0x14ccb0013478, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x14ccb0013590, unit=0x14ccb0004f10, select_lex=0x14ccb0011ee8) at /test/11.4_opt/sql/sql_select.cc:5249
#16 0x00005616becce061 in st_select_lex_unit::exec_inner (this=0x14ccb0004f10) at /test/11.4_opt/sql/sql_lex.h:970
#17 0x00005616becd1098 in mysql_union (thd=thd@entry=0x14ccb0000c58, lex=lex@entry=0x14ccb0004e30, result=result@entry=0x14ccb0013590, unit=unit@entry=0x14ccb0004f10, setup_tables_done_option=<optimized out>) at /test/11.4_opt/sql/sql_union.cc:45
#18 0x00005616bec769da in handle_select (thd=thd@entry=0x14ccb0000c58, lex=lex@entry=0x14ccb0004e30, result=result@entry=0x14ccb0013590, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/11.4_opt/sql/sql_select.cc:618
#19 0x00005616bebf120e in execute_sqlcom_select (thd=0x14ccb0000c58, all_tables=0x0) at /test/11.4_opt/sql/sql_parse.cc:6029
#20 0x00005616bebff897 in mysql_execute_command (thd=0x14ccb0000c58, is_called_from_prepared_stmt=<optimized out>) at /test/11.4_opt/sql/sql_parse.cc:3924
#21 0x00005616bebebdd6 in mysql_parse (thd=0x14ccb0000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/11.4_opt/sql/sql_parse.cc:7748
#22 0x00005616bebf8345 in dispatch_command (command=COM_QUERY, thd=0x14ccb0000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/11.4_opt/sql/sql_class.h:1551
#23 0x00005616bebfa59e in do_command (thd=0x14ccb0000c58, blocking=blocking@entry=true) at /test/11.4_opt/sql/sql_parse.cc:1406
#24 0x00005616bed291b7 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/11.4_opt/sql/sql_connect.cc:1418
#25 0x00005616bed294fd in handle_one_connection (arg=arg@entry=0x5616c1f9bd78) at /test/11.4_opt/sql/sql_connect.cc:1320
#26 0x00005616bf0cf35c in pfs_spawn_thread (arg=0x5616c1fc3b48) at /test/11.4_opt/storage/perfschema/pfs.cc:2201
#27 0x000014ccfce63609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#28 0x000014ccfca4f133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

UBSAN Error member call on null pointer of type 'struct my_decimal' in sql/filesort.cc

11.4.0 70de4075a18c12ed7e55db9a49e66eb6cff308b2 (Optimized, UBASAN)

/test/11.4_opt_san/sql/filesort.cc:1382:21: runtime error: member call on null pointer of type 'struct my_decimal'
    #0 0x562075bed443 in Type_handler_decimal_result::make_sort_key_part(unsigned char*, Item*, SORT_FIELD_ATTR const*, String*) const /test/11.4_opt_san/sql/filesort.cc:1382
    #1 0x562075bf5b30 in make_sortkey /test/11.4_opt_san/sql/filesort.cc:2956
    #2 0x562075bf5b30 in make_sortkey /test/11.4_opt_san/sql/filesort.cc:1415
    #3 0x562075c03508 in find_all_keys /test/11.4_opt_san/sql/filesort.cc:1031
    #4 0x562075c03508 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /test/11.4_opt_san/sql/filesort.cc:408
    #5 0x5620748f1589 in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /test/11.4_opt_san/sql/sql_select.cc:26903
    #6 0x5620748f2f92 in st_join_table::sort_table() /test/11.4_opt_san/sql/sql_select.cc:24542
    #7 0x5620748f3549 in join_init_read_record(st_join_table*) /test/11.4_opt_san/sql/sql_select.cc:24462
    #8 0x56207485366c in sub_select(JOIN*, st_join_table*, bool) /test/11.4_opt_san/sql/sql_select.cc:23497
    #9 0x562074a2eb0e in do_select /test/11.4_opt_san/sql/sql_select.cc:23017
    #10 0x562074a2eb0e in JOIN::exec_inner() /test/11.4_opt_san/sql/sql_select.cc:4940
    #11 0x562074a33a09 in JOIN::exec() /test/11.4_opt_san/sql/sql_select.cc:4726
    #12 0x562074a20edc in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/
11.4_opt_san/sql/sql_select.cc:5249
    #13 0x562074cf3024 in st_select_lex_unit::exec_inner() /test/11.4_opt_san/sql/sql_union.cc:2477
    #14 0x562074d0b51c in mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long long) /test/11.4_opt_san/sql/sql_union.cc:45
    #15 0x562074a24576 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.4_opt_san/sql/sql_select.cc:618
    #16 0x5620745fb53f in execute_sqlcom_select /test/11.4_opt_san/sql/sql_parse.cc:6029
    #17 0x56207464b4ed in mysql_execute_command(THD*, bool) /test/11.4_opt_san/sql/sql_parse.cc:3924
    #18 0x5620745ca7a0 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.4_opt_san/sql/sql_parse.cc:7748
    #19 0x562074621868 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.4_opt_san/sql/sql_parse.cc:1893
    #20 0x56207462d0bd in do_command(THD*, bool) /test/11.4_opt_san/sql/sql_parse.cc:1406
    #21 0x562074f7e20d in do_handle_one_connection(CONNECT*, bool) /test/11.4_opt_san/sql/sql_connect.cc:1418
    #22 0x562074f8087c in handle_one_connection /test/11.4_opt_san/sql/sql_connect.cc:1320
    #23 0x151ddc916608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
    #24 0x151ddbb8b132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)


Generated at Thu Feb 08 10:35:34 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.