Bug #83106 Segmentation fault in 'mysql_stmt_fetch' using embedded server
Submitted: 22 Sep 2016 19:48 Modified: 25 Sep 2016 15:34
Reporter: Daniel Beer Email Updates:
Status: Verified Impact on me:
None 
Category:MySQL Server: Embedded Library ( libmysqld ) Severity:S1 (Critical)
Version:5.6.33 OS:Red Hat (6.6)
Assigned to: CPU Architecture:Any

[22 Sep 2016 19:48] Daniel Beer
Description:
mysql_client_test_embedded crashes when running test "test_basic_cursors".

Stack trace:
#0  0x082d3500 in Protocol_binary::net_store_data (this=0x95d802c, 
    from=0x95dd1ee "Ja", length=2)
    at libmysqld/lib_sql.cc:1350
#1  0x083eb20b in Protocol::store_string_aux (this=0x95d802c, 
    from=0x95dd1ee "Ja", length=2, fromcs=0x8d70fc0 <my_charset_latin1>, 
    tocs=0x8d70fc0 <my_charset_latin1>)
    at sql/protocol.cc:958
#2  0x083ec16f in Protocol_binary::store (this=0x95d802c, from=0x95dd1ee "Ja", 
    length=2, fromcs=0x8d70fc0 <my_charset_latin1>)
    at sql/protocol.cc:1259
#3  0x085f3eaf in Field::send_binary (this=0x95dd018, protocol=0x95d802c)
    at sql/field.cc:1408
#4  0x083ec68c in Protocol_binary::store (this=0x95d802c, field=0x95dd018)
    at sql/protocol.cc:1365
#5  0x0833befb in Item_field::send (this=0x95dd878, protocol=0x95d802c, 
    buffer=0xffffbd98) at sql/item.cc:7086
#6  0x083eaee3 in Protocol::send_result_set_row (this=0x95d802c, 
    row_items=0x95dd848)
    at sql/protocol.cc:844
#7  0x084325ed in select_send::send_data (this=0x95d8014, items=...)
    at sql/sql_class.cc:2538
#8  0x084803c5 in Select_fetch_protocol_binary::send_data (this=0x95d8014, 
    fields=...) at sql/sql_prepare.cc:3084
#9  0x0843b192 in Materialized_cursor::fetch (this=0x95dd3a8, num_rows=1)
    at sql/sql_cursor.cc:339
#10 0x0847fb2b in mysqld_stmt_fetch (thd=0x95c86c8, packet=0xffffcb0c "\001", 
    packet_length=8)
    at sql/sql_prepare.cc:2808
#11 0x08463764 in dispatch_command (command=COM_STMT_FETCH, thd=0x95c86c8, 
    packet=0xffffcb0c "\001", packet_length=8)
    at sql/sql_parse.cc:1287
#12 0x082d0cd6 in emb_advanced_command (mysql=0x90c9070, 
    command=COM_STMT_FETCH, header=0xffffcb0c "\001", header_length=8, 
    arg=0xffffcb0c "\001", arg_length=8, skip_check=1 '\001', stmt=0x90d0a48)
    at libmysqld/lib_sql.cc:165
#13 0x082917d2 in stmt_read_row_from_cursor (stmt=0x90d0a48, row=0xffffcb58)
    at libmysql/libmysql.c:2314
#14 0x08294e5f in mysql_stmt_fetch (stmt=0x90d0a48)
    at libmysql/libmysql.c:4219
#15 0x0821abdd in stmt_fetch_fetch_row (fetch=0x9593c48)
    at tests/mysql_client_fw.c:1037
#16 0x0821aebe in fetch_n (query_list=0xffffcc44, query_count=2, 
    fetch_type=USE_ROW_BY_ROW_FETCH)
    at tests/mysql_client_fw.c:1108
#17 0x0825837b in test_basic_cursors ()
    at tests/mysql_client_test.c:12105
#18 0x0821b7ad in main (argc=1, argv=0x9081124)
    at tests/mysql_client_fw.c:1446

How to repeat:
Build and run mysql_client_test_embedded with mysql 5.6.33:

$ mkdir /tmp/testdb
$ mysql_install_db --datadir=/tmp/testdb
$ mysql_client_test_embedded --server-arg=--datadir=/tmp/testdb test_basic_cursors

#####################################
client_connect  
#####################################

 Establishing a connection to '' ...OK
Connected to MySQL server version: 5.6.33-embedded-debug (50633)

 Creating a test database 'client_test_db' ...OK

#####################################
1 of (1/1): test_basic_cursors  
#####################################
Segmentation fault (core dumped)
[22 Sep 2016 21:28] Miguel Solorzano
[miguel@tikal 5.6]$ bin/mysql_client_test_embedded --server-arg=--datadir=/tmp/testdb test_basic_cursors
2016-09-22 18:13:00 7fc45cb13740 InnoDB: !!!!!!!! UNIV_DEBUG switched on !!!!!!!!!
2016-09-22 18:13:00 7fc45cb13740 InnoDB: !!!!!!!! UNIV_SYNC_DEBUG switched on !!!!!!!!!

#####################################
client_connect
#####################################

 Establishing a connection to '' ...OK
Connected to MySQL server version: 5.6.34-embedded-debug (50634)

 Creating a test database 'client_test_db' ...OK

#####################################
1 of (1/1): test_basic_cursors
#####################################
Segmentation fault (core dumped)
[miguel@tikal 5.6]$
[22 Sep 2016 21:56] Miguel Solorzano
Thank you for the bug report.
[25 Sep 2016 15:34] Daniel Beer
Changing severity, this actually affects all use of prepared statements using the embedded server. There is no workaround that I can see.