Bug #88162 Conditional jump or move depends on uninitialised value (item_inetfunc.cc:403)
Submitted: 20 Oct 2017 4:47 Modified: 6 Nov 2017 12:22
Reporter: yghmgl yang Email Updates:
Status: Duplicate Impact on me:
None 
Category:MySQL Server Severity:S3 (Non-critical)
Version:5.6.37 OS:CentOS
Assigned to: CPU Architecture:Any
Tags: debug valgrind-build

[20 Oct 2017 4:47] yghmgl yang
Description:
==16529== Conditional jump or move depends on uninitialised value(s)
==16529==    at 0x7157DB: str_to_ipv6(char const*, int, in6_addr*) (item_inetfunc.cc:403)
==16529==    by 0x715FD3: Item_func_inet6_aton::calc_value(String*, String*) (item_inetfunc.cc:701)
==16529==    by 0x7150EB: Item_func_inet_str_base::val_str_ascii(String*) (item_inetfunc.cc:194)
==16529==    by 0x6DC8C3: Item_str_func::val_str_from_val_str_ascii(String*, String*) (item_strfunc.cc:78)
==16529==    by 0x6A8D71: Item_str_ascii_func::val_str(String*) (item_strfunc.h:81)
==16529==    by 0x714F83: Item_func_inet_bool_base::val_int() (item_inetfunc.cc:159)
==16529==    by 0x9B6305: mysql_do(THD*, List<Item>&) (sql_do.cc:34)
==16529==    by 0x7EB779: mysql_execute_command(THD*) (sql_parse.cc:2718)
==16529==    by 0x7F592F: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:6489)
==16529==    by 0x7E86A9: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1377)
==16529==    by 0x7E76DB: do_command(THD*) (sql_parse.cc:1040)
==16529==    by 0x20973B67: threadpool_process_request(THD*) (threadpool_common.cc:321)
==16529==    by 0x20976A37: handle_event(connection_t*) (threadpool_unix.cc:1611)
==16529==    by 0x20976C94: worker_main(void*) (threadpool_unix.cc:1664)
==16529==    by 0xB9A680: pfs_spawn_thread (pfs.cc:1860)
==16529==    by 0x5043DC4: start_thread (in /usr/lib64/libpthread-2.17.so)
==16529==    by 0x61AC21C: clone (in /usr/lib64/libc-2.17.so)
==16529==  Uninitialised value was created by a heap allocation
==16529==    at 0x4C29C23: malloc (vg_replace_malloc.c:299)
==16529==    by 0xAD15A9: my_malloc (my_malloc.c:38)
==16529==    by 0x84B28D: String::real_alloc(unsigned int) (sql_string.cc:46)
==16529==    by 0x677718: String::alloc(unsigned int) (sql_string.h:322)
==16529==    by 0x84BB0F: String::copy(char const*, unsigned int, charset_info_st const*, charset_info_st const*, unsigned int*) (sql_string.cc:372)
==16529==    by 0x6E8647: Item_func_conv_charset::val_str(String*) (item_strfunc.cc:3566)
==16529==    by 0x7150B0: Item_func_inet_str_base::val_str_ascii(String*) (item_inetfunc.cc:187)
==16529==    by 0x6DC8C3: Item_str_func::val_str_from_val_str_ascii(String*, String*) (item_strfunc.cc:78)
==16529==    by 0x6A8D71: Item_str_ascii_func::val_str(String*) (item_strfunc.h:81)
==16529==    by 0x714F83: Item_func_inet_bool_base::val_int() (item_inetfunc.cc:159)
==16529==    by 0x9B6305: mysql_do(THD*, List<Item>&) (sql_do.cc:34)
==16529==    by 0x7EB779: mysql_execute_command(THD*) (sql_parse.cc:2718)
==16529==    by 0x7F592F: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:6489)
==16529==    by 0x7E86A9: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1377)
==16529==    by 0x7E76DB: do_command(THD*) (sql_parse.cc:1040)
==16529==    by 0x20973B67: threadpool_process_request(THD*) (threadpool_common.cc:321)
==16529==    by 0x20976A37: handle_event(connection_t*) (threadpool_unix.cc:1611)
==16529==    by 0x20976C94: worker_main(void*) (threadpool_unix.cc:1664)
==16529==    by 0xB9A680: pfs_spawn_thread (pfs.cc:1860)
==16529==    by 0x5043DC4: start_thread (in /usr/lib64/libpthread-2.17.so)
==16529==    by 0x61AC21C: clone (in /usr/lib64/libc-2.17.so)
==16529==
==16529==
==16529==
==16529== HEAP SUMMARY:
==16529==     in use at exit: 422,974,967 bytes in 13,907 blocks
==16529==   total heap usage: 260,316 allocs, 246,409 frees, 900,839,777 bytes allocated
==16529==
==16529== LEAK SUMMARY:
==16529==    definitely lost: 0 bytes in 0 blocks
==16529==    indirectly lost: 0 bytes in 0 blocks
==16529==      possibly lost: 0 bytes in 0 blocks
==16529==    still reachable: 135 bytes in 1 blocks
==16529==         suppressed: 422,974,832 bytes in 13,906 blocks
==16529== Rerun with --leak-check=full to see details of leaked memory
==16529==
==16529== For counts of detected and suppressed errors, rerun with: -v
==16529== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

How to repeat:
pquery is random execute sql statement, so it hard to find which statement cause this issue,

Suggested fix:
It seems to be a problem with #88135
[6 Nov 2017 12:22] MySQL Verification Team
Hi!

Thank you for your bug report. This is, however, a duplicate bug of one already filed, but strictly private bug.

We shall try to prioritise this bug.