Bug #195 Crash when NULL is casted

• Submitted: 26 Mar 2003 14:08
• Modified: 28 Mar 2003 7:06
• Reporter: jocelyn fournier (Silver Quality Contributor)
• Status: Closed
• Category: MySQL Server
• Severity: S1 (Critical)
• Version: 4.1
• OS: Any (ALL)
• CPU Architecture: Any

[26 Mar 2003 14:08] jocelyn fournier

Description:
MySQL crashes if NULL is casted

How to repeat:
SELECT CAST(NULL as DATE);

Stack trace :

0x80ad811 handle_segfault + 481
0x82ad358 pthread_sighandler + 176
0x8087be4 Item_typecast::val_str(String*) + 52
0x804b940 Item::get_date(st_time*, bool) + 64
0x804df3c Item::send(Protocol*, String*) + 476
0x80a12d0 select_send::send_data(List<Item>&) + 192
0x80dc4be JOIN::exec() + 334
0x80dd820 _Z12mysql_selectP3THDPPP4ItemP13st_table_listjR4ListIS1_ES2_jP8st_orderSB_S2_SB_mP13select_resultP18st_select_lex_unitP13st_sel + 288
0x80da9d1 handle_select(THD*, st_lex*, select_result*) + 337
0x80bbb34 mysql_execute_command(THD*) + 644
0x80c0ae8 mysql_parse(THD*, char*, unsigned) + 232
0x80ba693 dispatch_command(enum_server_command, THD*, char*, unsigned) + 867
0x80ba2e5 do_command(THD*) + 133
0x80b9b79 handle_one_connection + 857
0x82aad7a pthread_start_thread + 218
0x82df2ca thread_start + 4

[27 Mar 2003 6:05] MySQL Verification Team

===== sql/item_timefunc.h 1.29 vs edited =====
*** /tmp/item_timefunc.h-1.29-580       Mon Mar  3 08:53:06 2003
--- edited/sql/item_timefunc.h  Thu Mar 27 15:42:27 2003
***************
*** 527,533 ****
    {
      String *tmp=args[0]->val_str(a);
      null_value=args[0]->null_value;
!     tmp->set_charset(charset());
      return tmp;
    }
    void fix_length_and_dec()
--- 527,534 ----
    {
      String *tmp=args[0]->val_str(a);
      null_value=args[0]->null_value;
!     if (tmp)
!       tmp->set_charset(charset());
      return tmp;
    }
    void fix_length_and_dec()

[28 Mar 2003 4:48] jocelyn fournier

Another similar bug :

SELECT CAST(NULL as BINARY);

0x80ada11 handle_segfault + 481
0x82ad718 pthread_sighandler + 176
0x8080701 Item_func_binary::val_str(String*) + 49
0x804ddb0 Item::send(Protocol*, String*) + 80
0x80a14d0 select_send::send_data(List<Item>&) + 192
0x80dc87e JOIN::exec() + 334
0x80ddbe0 _Z12mysql_selectP3THDPPP4ItemP13st_table_listjR4ListIS1_ES2_jP8st_orderSB_S2_SB_mP13select_resultP18st_select_lex_unitP13st_sel + 288
0x80dad91 handle_select(THD*, st_lex*, select_result*) + 337
0x80bbd34 mysql_execute_command(THD*) + 644
0x80c0ce8 mysql_parse(THD*, char*, unsigned) + 232
0x80ba893 dispatch_command(enum_server_command, THD*, char*, unsigned) + 867
0x80ba4e5 do_command(THD*) + 133
0x80b9d79 handle_one_connection + 857
0x82ab13a pthread_start_thread + 218
0x82df68a thread_start + 4

[28 Mar 2003 7:06] MySQL Verification Team

Fixed with latest commits.

Both,

SELECT CAST(NULL as DATE)

and

SELECT CAST(NULL as BINARY)