MySQL Bugs: #34779: crash in checksum table on federated tables with blobs containing nulls

Bug #34779	crash in checksum table on federated tables with blobs containing nulls
Submitted:	23 Feb 2008 18:23	Modified:	16 Sep 2008 4:21
Reporter:	Shane Bester (Platinum Quality Contributor)	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Federated storage engine	Severity:	S1 (Critical)
Version:	5.0.56, 5.1.23	OS:	Any
Assigned to:	Ramil Kalimullin	CPU Architecture:	Any
Tags:	BLOB, checksum table, DoS, null

Description:
checksum table on federated tables can crash server.
stack trace is like this each time:

mysqld-release.exe!crc32_little
mysqld-release.exe!mysql_checksum_table
mysqld-release.exe!mysql_execute_command
mysqld-release.exe!mysql_parse
mysqld-release.exe!dispatch_command
mysqld-release.exe!do_command
mysqld-release.exe!handle_one_connection
mysqld-release.exe!pthread_start
mysqld-release.exe!_callthreadstart
mysqld-release.exe!_threadstart

How to repeat:
will upload testcase later. it's not deterministic enough to paste here.

in mysql_checksum_table(), we have this:

for (uint i= 0; i < t->s->fields; i++ )
{
 Field *f= t->field[i];
 if ((f->type() == MYSQL_TYPE_BLOB) ||
 (f->type() == MYSQL_TYPE_VARCHAR))
 {
  String tmp;
  f->val_str(&tmp);
  row_crc= my_checksum(row_crc, (uchar*) tmp.ptr(), tmp.length());<--crash
}

crash happens because tmp is 0xa5a5a5a5 uninitialized.

seems related to table cache + blobs!  try this deterministic testcase in debug version.  if that doesn't crash, only then try the .c app !

flush tables;
create database if not exists `realdb`;
create database if not exists `test`;
use `realdb`;
drop table if exists `t1`;
create table `t1`(`a` longblob,`b` longblob) engine=myisam;
insert into `t1` values ('aaaaaaaaaaaaaaaaaaaaaaaaaaaa',null);
use `test`;
drop table if exists `t1`;
create table `t1`(`a` longblob,`b` longblob) connection='mysql://root@127.0.0.1:3306/realdb/t1' engine=federated;
flush tables;
checksum table `t1`;

Last test case does not lead to crash for me in 5.1.23-debug on Windows XP.

Thank you for the bug report.

c:\dbs>5.1\bin\mysql -uroot test
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1
Server version: 5.1.24-rc-nt-debug-log Source distribution

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> flush tables;
Query OK, 0 rows affected (0.03 sec)

mysql> create database if not exists `realdb`;
Query OK, 1 row affected (0.03 sec)

mysql> create database if not exists `test`;
Query OK, 0 rows affected, 1 warning (0.00 sec)

mysql> use `realdb`;
Database changed
mysql> drop table if exists `t1`;
Query OK, 0 rows affected, 1 warning (0.06 sec)

mysql> create table `t1`(`a` longblob,`b` longblob) engine=myisam;
Query OK, 0 rows affected (0.08 sec)

mysql> insert into `t1` values ('aaaaaaaaaaaaaaaaaaaaaaaaaaaa',null);
Query OK, 1 row affected (0.03 sec)

mysql> use `test`;
Database changed
mysql> drop table if exists `t1`;
Query OK, 0 rows affected (0.06 sec)

mysql> create table `t1`(`a` longblob,`b` longblob)
    -> connection='mysql://root@127.0.0.1:3306/realdb/t1' engine=federated;
Query OK, 0 rows affected (0.16 sec)

mysql> flush tables;
Query OK, 0 rows affected (0.00 sec)

mysql> checksum table `t1`;
ERROR 2013 (HY000): Lost connection to MySQL server during query
mysql>

>mysqld-debug.exe!crc32_little(unsigned long crc=2465757603, const unsigned char * buf=0xa5a5a5a5, unsigned int len=2779096485)  Line 273 + 0x3	C
 mysqld-debug.exe!crc32(unsigned long crc=2465757603, const unsigned char * buf=0xa5a5a5a5, unsigned int len=2779096485)  Line 237 + 0x11	C
 mysqld-debug.exe!my_checksum(unsigned int crc=2465757603, const unsigned char * pos=0xa5a5a5a5, unsigned int length=2779096485)  Line 39 + 0x11	C
 mysqld-debug.exe!mysql_checksum_table(THD * thd=0x0171bbc8, TABLE_LIST * tables=0x01747e08, st_ha_check_opt * check_opt=0x0171d1f0)  Line 7259 + 0x24	C++
 mysqld-debug.exe!mysql_execute_command(THD * thd=0x0171bbc8)  Line 2747 + 0x17	C++
 mysqld-debug.exe!mysql_parse(THD * thd=0x0171bbc8, const char * inBuf=0x01747d60, unsigned int length=19, const char * * found_semicolon=0x038bfd00)  Line 5622 + 0x9	C++
 mysqld-debug.exe!dispatch_command(enum_server_command command=COM_QUERY, THD * thd=0x0171bbc8, char * packet=0x0173fcb1, unsigned int packet_length=19)  Line 1121 + 0x1e	C++
 mysqld-debug.exe!do_command(THD * thd=0x0171bbc8)  Line 781 + 0x1b	C++
 mysqld-debug.exe!handle_one_connection(void * arg=0x0171bbc8)  Line 1120 + 0x9	C++
 mysqld-debug.exe!pthread_start(void * param=0x011ef5e0)  Line 85 + 0x9	C
 mysqld-debug.exe!_threadstart(void * ptd=0x0173a4f8)  Line 196 + 0xd	C
 kernel32.dll!7c80b683()

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/46341

ChangeSet@1.2613, 2008-05-05 08:31:15+05:00, ramil@mysql.com +3 -0
  Fix for bug #34779: crash in checksum table on federated tables 
  with blobs containing nulls
  
  Problem: FEDERATED SE improperly stores NULL fields in the record buffer.
  
  Fix: store them properly.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/51696

2662 Ramil Kalimullin	2008-08-15
      Fix for bug #34779: crash in checksum table on federated tables 
      with blobs containing nulls
      
      Problem: FEDERATED SE improperly stores NULL fields in the record buffer.
      
      Fix: store them properly.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/51697

2662 Ramil Kalimullin	2008-08-15
      Fix for bug #34779: crash in checksum table on federated tables 
      with blobs containing nulls
      
      Problem: FEDERATED SE improperly stores NULL fields in the record buffer.
      
      Fix: store them properly.

Pushed into 5.1.28  (revid:ramil@mysql.com-20080815064005-yex49cj5dknqlwf6) (version source revid:sergefp@mysql.com-20080819132519-eimtstp3bx89ya9d) (pib:3)

Noted in 5.1.28 changelog.

Table checksum calculation could cause a server crash for FEDERATED
tables with BLOB columns containing NULL values.

Setting report to NDI pending push into 6.0.x.

Pushed into 6.0.7-alpha  (revid:ramil@mysql.com-20080815064005-yex49cj5dknqlwf6) (version source revid:timothy.smith@sun.com-20080813081634-s8rre51iveicu311) (pib:3)

Noted in 6.0.7 changelog.