Bug #39186 Crash in String::append when inserting duplicate empty strings an uft8 SET col

Submitted: 2 Sep 2008 13:49 Modified: 18 Oct 2008 15:56
Reporter: Davi Arnaut (OCA) Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server Severity:S3 (Non-critical)
Version:6.0 OS:Any
Assigned to: Georgi Kodinov CPU Architecture:Any
Tags: regression

[2 Sep 2008 13:49] Davi Arnaut
Description:
This is a bug split from Bug#38701 because on 5.1 it happens to trigger a different problem.

When executing a query that would insert a duplicate empty string in an uft8 SET column
with at least 20 different possible values, mysqld crashes as follows:

#5  0x00432f5f in memcpy () from /lib/libc.so.6
#6  0x082ece26 in String::append (this=0xad27d0cc, s=@0xad27c070) at sql_string.cc:351
#7  0x082d5fbd in key_unpack (to=0xad27d0cc, table=0x9dc9248, idx=0) at key.cc:391
#8  0x0841ae07 in handler::print_keydup_error (this=0x9dc9920, key_nr=0, msg=0x9d269f3
"Duplicate entry '%-.64s' for key '%-.192s'") at handler.cc:2530
#9  0x0841afc0 in handler::print_error (this=0x9dc9920, error=121, errflag=0) at
handler.cc:2583
#10 0x08391906 in write_record (thd=0x9d75d90, table=0x9dc9248, info=0xad27e36c) at
sql_insert.cc:1603
#11 0x08395913 in mysql_insert (thd=0x9d75d90, table_list=0x9dd1a20, fields=@0x9d77564,
values_list=@0x9d77588, update_fields=@0x9d7757c,
    update_values=@0x9d77570, duplic=DUP_ERROR, ignore=false) at sql_insert.cc:828
#12 0x08307ac2 in mysql_execute_command (thd=0x9d75d90) at sql_parse.cc:2944
#13 0x0830e1e1 in mysql_parse (thd=0x9d75d90, inBuf=0x9dd1720 "INSERT INTO C (
set_unique_utf8 ) VALUES ( '' )", length=47, found_semicolon=0xad27f270)
    at sql_parse.cc:5800
#14 0x0830ec55 in dispatch_command (command=COM_QUERY, thd=0x9d75d90, packet=0x9dc2b99
"INSERT INTO C ( set_unique_utf8 ) VALUES ( '' )", packet_length=47)
    at sql_parse.cc:1050
#15 0x0830ff1f in do_command (thd=0x9d75d90) at sql_parse.cc:723
#16 0x082fc99b in handle_one_connection (arg=0x9d75d90) at sql_connect.cc:1153
#17 0x0057d32f in start_thread () from /lib/libpthread.so.0
#18 0x0049a27e in clone () from /lib/libc.so.6

How to repeat:
CREATE TABLE t1 (set_unique_utf8 set ('a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z') CHARACTER SET utf8, unique (set_unique_utf8));
INSERT INTO t1 ( set_unique_utf8 ) VALUES ('');
--error ER_DUP_ENTRY 
INSERT INTO t1 ( set_unique_utf8 ) VALUES ('');
DROP TABLE t1;
[8 Sep 2008 14:55] Bugs System
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/53534

2692 Georgi Kodinov	2008-09-08
      Bug #39186: Crash in String::append when inserting duplicate empty strings an uft8 SET col
      
      Fixed a problem in constructing a string representation of a ENUM field when reporting
      key duplicate error.
      Note : no test case as the one for bug #38701 covers this one as well.
[9 Sep 2008 12:39] Bugs System
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/53604

2692 Georgi Kodinov	2008-09-08
      Bug #39186: Crash in String::append when inserting duplicate empty strings an uft8 SET col
      
      Fixed a problem in constructing a string representation of a ENUM field when reporting
      key duplicate error.
      Note : no test case as the one for bug #38701 covers this one as well.
[17 Oct 2008 16:41] Bugs System
Pushed into 6.0.8-alpha  (revid:kgeorge@mysql.com-20080908145416-wvmvl4aigvthra71) (version source revid:kpettersson@mysql.com-20080911114255-81pt7q1uvl1fkojq) (pib:5)
[18 Oct 2008 15:56] Paul DuBois
Noted in 6.0.8 changelog.

The server could crash when attempting to insert duplicate empty
strings into a utf8 SET column.

Portions of this website are copyright © 2001, 2002 The PHP Group

Page generated in 0.063 sec. using MySQL 8.4.7-u6-cloud

Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the respective copyright holders.
It is not reviewed in advance by Oracle and does not necessarily represent the opinion of Oracle or any other party.