MySQL Bugs: #47382: 'mysqladmin debug' crash on 64-bit windows

Bug #47382	'mysqladmin debug' crash on 64-bit windows
Submitted:	16 Sep 2009 17:02	Modified:	12 Mar 2010 17:29
Reporter:	Shane Bester (Platinum Quality Contributor)	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: General	Severity:	S1 (Critical)
Version:	5.1.38-debug-x64, 5.4.2-debug-x64	OS:	Windows (xp64)
Assigned to:	Christopher Powers	CPU Architecture:	Any
Tags:	regression

Description:
during memory allocation dump, there's an invalid filename causing crash;

mysqld-debug.exe!_output_l()[output.c:1648]
mysqld-debug.exe!fprintf()[fprintf.c:70]
mysqld-debug.exe!TERMINATE()[safemalloc.c:410]
mysqld-debug.exe!mysql_print_status()[sql_test.cc:519]
mysqld-debug.exe!dispatch_command()[sql_parse.cc:1550]
mysqld-debug.exe!do_command()[sql_parse.cc:854]
mysqld-debug.exe!handle_one_connection()[sql_connect.cc:1127]
mysqld-debug.exe!pthread_start()[my_winthread.c:85]
mysqld-debug.exe!_callthreadstart()[thread.c:295]
mysqld-debug.exe!_threadstart()[thread.c:277]
kernel32.dll!BaseThreadStart()

How to repeat:
start the x64 5.1.38-debug binary:

mysqld --no-defaults --console

run "mysqladmin -uroot debug"

Thank you fro the report.

Verified as described. Bug is not repeatable with version 5.0

The crash occurs because TERMINATE() encounters a pointer to an uninitialized filename string passed into the memory subsystem by the Archive plugin. 

The filename was not initialized because SAFEMALLOC is defined for the MySQL server but not for the Archive storage engine library, resulting in a parameter mismatch between the function interface (prototype) and the actual function definition.

When SAFEMALLOC is defined, functions declared with the CALL_INFO and CALL_INFO_PROTO macros are compiled with two additional paramters: __FILE__ and __LINE__. For example, my_hash_init() and init_dynamic_array() are declared with the CALLER_INFO macro.

If SAFEMALLOC is not defined, then functions declared with CALL_INFO* are not compiled with the file and line parameters.

For 5.1 Windows builds, SAFEMALLOC is defined by default in the CMakeLists.txt file associated with each library, including the static and dynamic storage engine libraries. For reasons unknown, SAFEMALLOC is not defined for the Archive and Federated engines. 

This mismatch is a serious problem in debug builds. Calls from archive.lib into any function defined with CALLER_INFO will fail to pass the __FILE__ and __LINE__ values. The target function (hash_init() in this case) receives two uninitialized stack parameters, eventually causing a crash.

In 5.4, SAFEMALLOC is only defined once, in the main CMakeLists.txt. Also, SAFEMALLOC is no longer defined by default for Windows builds, but for reasons unrelated to this bug.

For 5.1, the best solution would be to model the 5.4 approach, i.e. move SAFEMALLOC out of the submodules, but the simplest solution would be to add SAFEMALLOC to the Archive and Federated build configurations.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/90003

3196 Christopher Powers	2009-11-10
      Bug#47382 'mysqladmin debug' crash on 64-bit Windows
      
      The crash occurs because SAFEMALLOC is defined for the MySQL server
      but not for the Archive or Federated engines, resulting in a 
      parameter mismatch between the function prototype and definition
      for functions using the CALLER_INFO macro.
      modified:
        storage/archive/CMakeLists.txt*
        storage/federated/CMakeLists.txt*

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/90133

3677 Christopher Powers	2009-11-11 [merge]
      Bug#47382 'mysqladmin debug' crash on 64-bit Windows
            
      The crash occurs because SAFEMALLOC is defined for the MySQL server
      but not for the Archive or Federated engines, resulting in a 
      parameter mismatch between the function prototype and definition
      for functions using the CALLER_INFO macro.
      modified:
        storage/archive/CMakeLists.txt*
        storage/federated/CMakeLists.txt*

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/91386

2928 Alexey Kopytov	2009-11-24 [merge]
      Null merge of the patch for bug #47382 from mysql-5.1-bugteam.

Pushed into 5.1.42 (revid:joro@sun.com-20091202080033-mndu4sxwx19lz2zs) (version source revid:christopher.powers@sun.com-20091110194143-ecku9un62omre96w) (merge vers: 5.1.41) (pib:13)

Pushed into 6.0.14-alpha (revid:alik@sun.com-20091216083311-xorsasf5kopjxshf) (version source revid:alik@sun.com-20091215065750-5m04ogppd5l0pol5) (merge vers: 6.0.14-alpha) (pib:14)

Pushed into 5.5.0-beta (revid:alik@sun.com-20091216082430-s0gtzibcgkv4pqul) (version source revid:alexey.kopytov@sun.com-20091124082434-ilmdycc59qemh3hp) (merge vers: 5.5.0-beta) (pib:14)

Pushed into mysql-next-mr (revid:alik@sun.com-20091216083231-rp8ecpnvkkbhtb27) (version source revid:alik@sun.com-20091212203859-fx4rx5uab47wwuzd) (merge vers: 5.6.0-beta) (pib:14)

Noted in 5.1.42, 5.5.0, 6.0.14 changelogs.

"mysqladmin debug" could crash on 64-bit systems.

Setting report to Need Merge pending push to Celosia.

Pushed into 5.1.44-ndb-7.0.14 (revid:jonas@mysql.com-20100312135944-t0z8s1da2orvl66x) (version source revid:jonas@mysql.com-20100312115609-woou0te4a6s4ae9y) (merge vers: 5.1.44-ndb-7.0.14) (pib:16)

Pushed into 5.1.44-ndb-6.2.19 (revid:jonas@mysql.com-20100312134846-tuqhd9w3tv4xgl3d) (version source revid:jonas@mysql.com-20100312060623-mx6407w2vx76h3by) (merge vers: 5.1.44-ndb-6.2.19) (pib:16)

Pushed into 5.1.44-ndb-6.3.33 (revid:jonas@mysql.com-20100312135724-xcw8vw2lu3mijrhn) (version source revid:jonas@mysql.com-20100312103652-snkltsd197l7q2yg) (merge vers: 5.1.44-ndb-6.3.33) (pib:16)

Fixed in earlier 5.1.x, 5.5.x.