MySQL Bugs: #58154: uninitialized variable format in str_to

Bug #58154	uninitialized variable format in str_to_date function
Submitted:	12 Nov 2010 6:43	Modified:	19 Apr 2011 16:40
Reporter:	Shane Bester (Platinum Quality Contributor)	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Data Types	Severity:	S2 (Serious)
Version:	5.1.54, 5.5.9	OS:	Any
Assigned to:		CPU Architecture:	Any
Tags:	STR_TO_DATE

Description:
This bug is existing with th efix for bug #57512 
5.5.8: 
Conditional jump or move depends on uninitialised value(s)
at make_datetime (item_timefunc.cc:67)
by Item_func_str_to_date::val_str (item_timefunc.cc:3376)
by Item_str_func::val_int (item_strfunc.cc:107)
by mysql_do (sql_do.cc:29)
by mysql_execute_command (sql_parse.cc:2315)
by mysql_parse (sql_parse.cc:6068)
by dispatch_command (sql_parse.cc:1261)
by do_command (sql_parse.cc:889)
by handle_one_connection (sql_connect.cc:1136)
by start_thread (pthread_create.c:301)

This is code:

(gdb) frame 0
#0  0x0000000000645cee in make_datetime (format=17768736, ltime=0xe10e2d0, str=0xe10e320) at item_timefunc.cc:67
67        switch (format) {
(gdb) list
62
63        if (str->alloc(length))
64          return 1;
65        buff= (char*) str->ptr();
66
67        switch (format) {
68        case TIME_ONLY:
69          length= cs->cset->snprintf(cs, buff, length, "%s%02d:%02d:%02d",
70                                     ltime->neg ? "-" : "",
71                                     ltime->hour, ltime->minute, ltime->second);
(gdb) print format
$1 = 17768736

How to repeat:
run mysqld in valgrind, then:

set global sql_mode='';
do str_to_date((''),(from_days(@@global.sql_mode)));

sorry, the bug is in 5.1.54, not 5.5.8.

Verified on 32-bit Ubuntu 10.04:

...
==1731== Use of uninitialised value of size 4
==1731==    at 0x8210841: make_datetime(date_time_format_types, st_mysql_time*, String*) (item_timefunc.cc:67)
==1731==    by 0x82197D2: Item_func_str_to_date::val_str(String*) (item_timefunc.cc:3376)
==1731==    by 0x8203323: Item_str_func::val_int() (item_strfunc.cc:107)
==1731==    by 0x83454B5: mysql_do(THD*, List<Item>&) (sql_do.cc:29)
==1731==    by 0x828D48A: mysql_execute_command(THD*) (sql_parse.cc:2314)
==1731==    by 0x8298EE1: mysql_parse(THD*, char*, unsigned int, char const**) (sql_parse.cc:6051)
==1731==    by 0x828AD28: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1260)
==1731==    by 0x8289E30: do_command(THD*) (sql_parse.cc:888)
==1731==    by 0x8287FD1: handle_one_connection (sql_connect.cc:1136)
==1731==    by 0x404196D: start_thread (pthread_create.c:300)
==1731==    by 0x4196A4D: clone (clone.S:130)
...

A testcase for 5.5.9 also:

select str_to_date('',@@global.init_slave | 1) - null;

Version: '5.5.9-valgrind-max-debug'  socket: 'sock'  port: 3307  Source distribution
Thread 17:
Conditional jump or move depends on uninitialised value(s)
at: make_datetime (item_timefunc.cc:88)
by: Item_func_str_to_date::val_str (item_timefunc.cc:3488)
by: Item_str_func::val_real (item_strfunc.cc:149)
by: Item_func_minus::real_op (item_func.cc:1257)
by: Item_func_numhybrid::val_real (item_func.cc:828)
by: Item::send (item.cc:5892)
by: Protocol::send_result_set_row (protocol.cc:848)
by: select_send::send_data (sql_class.cc:1862)
by: JOIN::exec (sql_select.cc:1860)
by: mysql_select (sql_select.cc:2571)
by: handle_select (sql_select.cc:297)
by: execute_sqlcom_select (sql_parse.cc:4472)
by: mysql_execute_command (sql_parse.cc:2053)
by: mysql_parse (sql_parse.cc:5509)
by: dispatch_command (sql_parse.cc:1035)
by: do_command (sql_parse.cc:772)
by: do_handle_one_connection (sql_connect.cc:748)
by: handle_one_connection (sql_connect.cc:684)
by: start_thread (pthread_create.c:301)

88        switch (format) {
(gdb) print format
$1 = TIME_ONLY
(gdb) list
83
84        if (str->alloc(length))
85          return 1;
86        buff= (char*) str->ptr();
87
88        switch (format) {
89        case TIME_ONLY:
90          length= cs->cset->snprintf(cs, buff, length, "%s%02d:%02d:%02d",
91                                     ltime->neg ? "-" : "",
92                                     ltime->hour, ltime->minute, ltime->second);
(

Noted in 5.1.57, 5.5.12, 5.6.3 changelogs.

In Item_func_str_to_date::val_str, a Valgrind warning for an
uninitialized variable was corrected. 

CHANGESET - http://lists.mysql.com/commits/134056