[MDEV-4224] [PATCH] Item_func_neg relies on undefined behavior and can misbehave Created: 2013-03-02  Updated: 2013-03-12  Resolved: 2013-03-12

Status: Closed
Project: MariaDB Server
Component/s: None
Affects Version/s: 10.0.1
Fix Version/s: 10.0.2, 5.5.31

Type: Bug Priority: Major
Reporter: Pavel Ivanov Assignee: Vladislav Vaintroub
Resolution: Fixed Votes: 0
Labels: None


 Description   

Class Item_func_neg has a lot of conversions between signed and unsigned datatypes. I believe at least to some degree these conversions are undefined behavior in C++, and thus Item_func_neg can misbehave when compiled with optimizations. In particular I've experienced misbehavior in the main.func_math test on line 483. This line expects that negation of -9223372036854775808 will throw DATA_OUT_OF_RANGE error, but sometimes it doesn't. The following patch fixes the problem. Please consider including it (or some modification of it) into MariaDB.

--- a/sql/item_func.cc
 
+++ b/sql/item_func.cc
 
@@ -1908,6 +1908,8 @@ longlong Item_func_neg::int_op()
 
   if (args[0]->unsigned_flag &&
 
       (ulonglong) value > (ulonglong) LONGLONG_MAX + 1)
 
     return raise_integer_overflow();
 
+  if (!args[0]->unsigned_flag && value == LONGLONG_MIN)
 
+    return raise_integer_overflow();
 
   return check_integer_overflow(-value, !args[0]->unsigned_flag && value < 0);
 
 }



 Comments   
Comment by Elena Stepanova [ 2013-03-03 ]

Assigned to Wlad arbitrarily, just because I remember (possibly wrongly) him having an opinion on how to deal with longlong. Please reassign if needed.

Comment by Vladislav Vaintroub [ 2013-03-03 ]

"This line expects that negation of -9223372036854775808 will throw DATA_OUT_OF_RANGE error, but sometimes it doesn't" .Pavel , can you please describe the environment necessary to reproduce this problem "sometimes does not"?

Comment by Pavel Ivanov [ 2013-03-04 ]

Here are my reproduction steps:

> clang --version
Ubuntu clang version 3.0-6ubuntu3 (tags/RELEASE_30/final) (based on LLVM 3.0)
Target: x86_64-pc-linux-gnu
Thread model: posix
> CC=clang CXX=clang++ cmake . DCMAKE_BUILD_TYPE=Release
...
> make
...
> cd mysql-test/
> ./mtr main.func_math
...
mysqltest: At line 483: query 'SELECT -a FROM t1' succeeded - should have failed with errno 1690...
...

Generated at Thu Feb 08 06:54:44 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.