[MDEV-33149] JSON_ARRAY_INTERSECT function crashes the server when called with empty json arrays. Created: 2024-01-01  Updated: 2024-01-01

Status: Open
Project: MariaDB Server
Component/s: JSON
Affects Version/s: 11.4
Fix Version/s: 11.4

Type: Bug Priority: Major
Reporter: Ramesh Sivaraman Assignee: Rucha Deodhar
Resolution: Unresolved Votes: 0
Labels: None


 Description   

SELECT json_array_intersect(@json1,@json2);

Leads to

11.4.0 3fad2b115569864d8c1b7ea90ce92aa895cfef08 (Optimized)

Core was generated by `/test/mtest/MD010124-mariadb-11.4.0-linux-x86_64-opt/bin/mariadbd --no-defaults'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000055fde5069d9d in Item_func_json_array_intersect::prepare_json_and_create_hash (this=this@entry=0x14dd5c0112d8, je1=je1@entry=0x14dda00cd270, js=0x0)
    at /test/mtest/11.4_opt/sql/item_jsonfunc.cc:5265
5265	  json_scan_start(je1, js->charset(), (const uchar *) js->ptr(),
[Current thread is 1 (Thread 0x14dda00cf700 (LWP 2799882))]
(gdb) bt
#0  0x000055fde5069d9d in Item_func_json_array_intersect::prepare_json_and_create_hash (this=this@entry=0x14dd5c0112d8, je1=je1@entry=0x14dda00cd270, js=0x0) at /test/mtest/11.4_opt/sql/item_jsonfunc.cc:5265
#1  0x000055fde506a56b in Item_func_json_array_intersect::fix_length_and_dec (this=0x14dd5c0112d8, thd=<optimized out>) at /test/mtest/11.4_opt/sql/item_jsonfunc.cc:5306
#2  0x000055fde51cc21b in Item_func::fix_fields (ref=<optimized out>, thd=0x14dd5c000c58, this=0x14dd5c0112d8) at /test/mtest/11.4_opt/sql/item_func.cc:377
#3  Item_func::fix_fields (this=this@entry=0x14dd5c0112d8, thd=thd@entry=0x14dd5c000c58, ref=<optimized out>) at /test/mtest/11.4_opt/sql/item_func.cc:326
#4  0x000055fde5202746 in Item_str_func::fix_fields (this=0x14dd5c0112d8, thd=0x14dd5c000c58, ref=<optimized out>) at /test/mtest/11.4_opt/sql/item_strfunc.cc:132
#5  0x000055fde4e6c6a0 in Item::fix_fields_if_needed (ref=0x14dd5c0114a0, thd=0x14dd5c000c58, this=0x14dd5c0112d8) at /test/mtest/11.4_opt/sql/item.h:1151
#6  Item::fix_fields_if_needed (ref=0x14dd5c0114a0, thd=0x14dd5c000c58, this=0x14dd5c0112d8) at /test/mtest/11.4_opt/sql/item.h:1151
#7  Item::fix_fields_if_needed_for_scalar (ref=0x14dd5c0114a0, thd=0x14dd5c000c58, this=0x14dd5c0112d8) at /test/mtest/11.4_opt/sql/item.h:1162
#8  setup_fields (thd=0x14dd5c000c58, ref_pointer_array=<optimized out>, fields=<optimized out>, column_usage=<optimized out>, sum_func_list=sum_func_list@entry=0x14dd5c0121b8, pre_fix=0x14dd5c010e78, allow_sum_func=true) at /test/mtest/11.4_opt/sql/sql_base.cc:8084
#9  0x000055fde4f46816 in JOIN::prepare (this=0x14dd5c011e18, tables_init=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=<optimized out>, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x14dd5c010ba8, unit_arg=0x14dd5c004f10) at /test/mtest/11.4_opt/sql/sql_select.cc:1549
#10 0x000055fde4f5a8ab in mysql_select (thd=0x14dd5c000c58, tables=0x0, fields=@0x14dd5c010e60: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14dd5c011498, last = 0x14dd5c011498, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x14dd5c011df0, unit=0x14dd5c004f10, select_lex=0x14dd5c010ba8) at /test/mtest/11.4_opt/sql/sql_select.cc:5278
#11 0x000055fde4f5aba7 in handle_select (thd=thd@entry=0x14dd5c000c58, lex=lex@entry=0x14dd5c004e30, result=result@entry=0x14dd5c011df0, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/mtest/11.4_opt/sql/sql_select.cc:630
#12 0x000055fde4ed458e in execute_sqlcom_select (thd=0x14dd5c000c58, all_tables=0x0) at /test/mtest/11.4_opt/sql/sql_parse.cc:6077
#13 0x000055fde4ee2bc1 in mysql_execute_command (thd=0x14dd5c000c58, is_called_from_prepared_stmt=<optimized out>) at /test/mtest/11.4_opt/sql/sql_parse.cc:3926
#14 0x000055fde4ecf156 in mysql_parse (thd=0x14dd5c000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/mtest/11.4_opt/sql/sql_parse.cc:7798
#15 0x000055fde4edb6d5 in dispatch_command (command=COM_QUERY, thd=0x14dd5c000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/mtest/11.4_opt/sql/sql_class.h:1552
#16 0x000055fde4edd91e in do_command (thd=0x14dd5c000c58, blocking=blocking@entry=true) at /test/mtest/11.4_opt/sql/sql_parse.cc:1406
#17 0x000055fde500d397 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/mtest/11.4_opt/sql/sql_connect.cc:1417
#18 0x000055fde500d6dd in handle_one_connection (arg=arg@entry=0x55fde8702d08) at /test/mtest/11.4_opt/sql/sql_connect.cc:1319
#19 0x000055fde53b599c in pfs_spawn_thread (arg=0x55fde86b7cb8) at /test/mtest/11.4_opt/storage/perfschema/pfs.cc:2201
#20 0x000014dda3576609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#21 0x000014dda3162133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

11.4.0 3fad2b115569864d8c1b7ea90ce92aa895cfef08 (Debug)

Core was generated by `/test/mtest/MD010124-mariadb-11.4.0-linux-x86_64-dbg/bin/mariadbd --no-defaults'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  Binary_string::ptr (this=0x8) at /test/mtest/11.4_dbg/sql/sql_string.h:359
359	  inline const char *ptr() const { return Ptr; }
[Current thread is 1 (Thread 0x1489fc09c700 (LWP 1846667))]
(gdb) bt
#0  Binary_string::ptr (this=0x8) at /test/mtest/11.4_dbg/sql/sql_string.h:359
#1  Item_func_json_array_intersect::prepare_json_and_create_hash (this=this@entry=0x1489b4013cd8, je1=je1@entry=0x1489fc09a1c0, js=0x0) at /test/mtest/11.4_dbg/sql/item_jsonfunc.cc:5266
#2  0x00005594b2cc4515 in Item_func_json_array_intersect::fix_length_and_dec (this=0x1489b4013cd8, thd=<optimized out>) at /test/mtest/11.4_dbg/sql/item_jsonfunc.cc:5306
#3  0x00005594b2e7cb2d in Item_func::fix_fields (this=this@entry=0x1489b4013cd8, thd=thd@entry=0x1489b4000d48, ref=<optimized out>) at /test/mtest/11.4_dbg/sql/item_func.cc:377
#4  0x00005594b2ec75c2 in Item_str_func::fix_fields (this=0x1489b4013cd8, thd=0x1489b4000d48, ref=<optimized out>) at /test/mtest/11.4_dbg/sql/item_strfunc.cc:132
#5  0x00005594b2a49034 in Item::fix_fields_if_needed (ref=0x1489b4013ea0, thd=0x1489b4000d48, this=0x1489b4013cd8) at /test/mtest/11.4_dbg/sql/item.h:1162
#6  Item::fix_fields_if_needed_for_scalar (ref=0x1489b4013ea0, thd=0x1489b4000d48, this=0x1489b4013cd8) at /test/mtest/11.4_dbg/sql/item.h:1162
#7  setup_fields (thd=0x1489b4000d48, ref_pointer_array=<optimized out>, fields=<optimized out>, column_usage=<optimized out>, sum_func_list=sum_func_list@entry=0x1489b4014bc0, pre_fix=0x1489b4013878, allow_sum_func=true) at /test/mtest/11.4_dbg/sql/sql_base.cc:8084
#8  0x00005594b2b4aa31 in JOIN::prepare (this=this@entry=0x1489b4014818, tables_init=tables_init@entry=0x0, conds_init=conds_init@entry=0x0, og_num=og_num@entry=0, order_init=order_init@entry=0x0, skip_order_by=skip_order_by@entry=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x1489b40135a8, unit_arg=0x1489b40051c8) at /test/mtest/11.4_dbg/sql/sql_select.cc:1549
#9  0x00005594b2b633d9 in mysql_select (thd=thd@entry=0x1489b4000d48, tables=0x0, fields=@0x1489b4013860: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1489b4013e98, last = 0x1489b4013e98, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x1489b40147f0, unit=0x1489b40051c8, select_lex=0x1489b40135a8) at /test/mtest/11.4_dbg/sql/sql_select.cc:5278
#10 0x00005594b2b63603 in handle_select (thd=thd@entry=0x1489b4000d48, lex=lex@entry=0x1489b40050e8, result=result@entry=0x1489b40147f0, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/mtest/11.4_dbg/sql/sql_select.cc:630
#11 0x00005594b2ac2da4 in execute_sqlcom_select (thd=thd@entry=0x1489b4000d48, all_tables=0x0) at /test/mtest/11.4_dbg/sql/sql_parse.cc:6077
#12 0x00005594b2acf89d in mysql_execute_command (thd=thd@entry=0x1489b4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/mtest/11.4_dbg/sql/sql_parse.cc:3926
#13 0x00005594b2abcd20 in mysql_parse (thd=thd@entry=0x1489b4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1489fc09b2b0) at /test/mtest/11.4_dbg/sql/sql_parse.cc:7798
#14 0x00005594b2acabfc in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1489b4000d48, packet=packet@entry=0x1489b400b1b9 "SELECT json_array_intersect(@json1,@json2)", packet_length=packet_length@entry=42, blocking=blocking@entry=true) at /test/mtest/11.4_dbg/sql/sql_class.h:1552
#15 0x00005594b2acd328 in do_command (thd=0x1489b4000d48, blocking=blocking@entry=true) at /test/mtest/11.4_dbg/sql/sql_parse.cc:1406
#16 0x00005594b2c47eb5 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5594b6aebd08, put_in_cache=put_in_cache@entry=true) at /test/mtest/11.4_dbg/sql/sql_connect.cc:1417
#17 0x00005594b2c4846a in handle_one_connection (arg=arg@entry=0x5594b6aebd08) at /test/mtest/11.4_dbg/sql/sql_connect.cc:1319
#18 0x00005594b30b654c in pfs_spawn_thread (arg=0x5594b6a3f2b8) at /test/mtest/11.4_dbg/storage/perfschema/pfs.cc:2201
#19 0x00001489ffb7d609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#20 0x00001489ff769133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95


Generated at Thu Feb 08 10:36:45 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.