Bug #89543 stack-overflow on gis.geojson_functions / json.json_functions_innodb

Submitted: 6 Feb 2018 4:08 Modified: 21 Mar 2018 8:57
Reporter: Laurynas Biveinis (OCA) Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server: JSON Severity:S3 (Non-critical)
Version:8.0.4 OS:Any
Assigned to: CPU Architecture:Any
Tags: asan, json

[6 Feb 2018 4:08] Laurynas Biveinis 
Description:
On a debug build with ASan and UBSan enabled:

gis.geojson_functions                    [ fail ]
        Test ended at 2018-02-06 06:05:24

CURRENT_TEST: gis.geojson_functions
mysqltest: At line 3854: query 'SELECT ST_GeomFromGeoJSON(REPEAT('[', 1000))' failed with wrong errno 2013: 'Lost connection to MySQL server during query', instead of 3157...
...
ASAN:DEADLYSIGNAL
=================================================================
==1455==ERROR: AddressSanitizer: stack-overflow on address 0x7f7b427bac98 (pc 0x7f7b637afad0 bp 0x7f7b427bb4e0 sp 0x7f7b427bac80 T30)
    #0 0x7f7b637afacf in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeacf)
    #1 0x55dba229e940 in my_raw_malloc /home/laurynas/mysql-8.0.4/mysys/my_malloc.cc:219
    #2 0x55dba229e940 in my_malloc /home/laurynas/mysql-8.0.4/mysys/my_malloc.cc:84
    #3 0x55db9c367a66 in Malloc_allocator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > >::allocate(unsigned long, std::unique_ptr<Json_dom, std::default_delete<Json_dom> > const*) /home/laurynas/mysql-8.0.4/sql/malloc_allocator.h:105
    #4 0x55db9c367a66 in std::allocator_traits<Malloc_allocator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > > >::allocate(Malloc_allocator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > >&, unsigned long) /usr/include/c++/7/bits/alloc_traits.h:301
    #5 0x55db9c367a66 in std::_Vector_base<std::unique_ptr<Json_dom, std::default_delete<Json_dom> >, Malloc_allocator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > > >::_M_allocate(unsigned long) /usr/include/c++/7/bits/stl_vector.h:172
    #6 0x55db9c367a66 in void std::vector<std::unique_ptr<Json_dom, std::default_delete<Json_dom> >, Malloc_allocator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > > >::_M_realloc_insert<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > >(__gnu_cxx::__normal_iterator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> >*, std::vector<std::unique_ptr<Json_dom, std::default_delete<Json_dom> >, Malloc_allocator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > > > >, std::unique_ptr<Json_dom, std::default_delete<Json_dom> >&&) /usr/include/c++/7/bits/vector.tcc:406
    #7 0x55db9c310a89 in std::vector<std::unique_ptr<Json_dom, std::default_delete<Json_dom> >, Malloc_allocator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > > >::_M_insert_rval(__gnu_cxx::__normal_iterator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > const*, std::vector<std::unique_ptr<Json_dom, std::default_delete<Json_dom> >, Malloc_allocator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > > > >, std::unique_ptr<Json_dom, std::default_delete<Json_dom> >&&) /usr/include/c++/7/bits/vector.tcc:327
    #8 0x55db9c310a89 in std::vector<std::unique_ptr<Json_dom, std::default_delete<Json_dom> >, Malloc_allocator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > > >::_M_emplace_aux(__gnu_cxx::__normal_iterator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > const*, std::vector<std::unique_ptr<Json_dom, std::default_delete<Json_dom> >, Malloc_allocator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > > > >, std::unique_ptr<Json_dom, std::default_delete<Json_dom> >&&) /usr/include/c++/7/bits/stl_vector.h:1492
    #9 0x55db9c310a89 in __gnu_cxx::__normal_iterator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> >*, std::vector<std::unique_ptr<Json_dom, std::default_delete<Json_dom> >, Malloc_allocator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > > > > std::vector<std::unique_ptr<Json_dom, std::default_delete<Json_dom> >, Malloc_allocator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > > >::emplace<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > >(__gnu_cxx::__normal_iterator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > const*, std::vector<std::unique_ptr<Json_dom, std::default_delete<Json_dom> >, Malloc_allocator<std::unique_ptr<Json_dom, std::default_delete<Json_dom> > > > >, std::unique_ptr<Json_dom, std::default_delete<Json_dom> >&&) /usr/include/c++/7/bits/stl_vector.h:998
    #10 0x55db9c310a89 in Json_array::insert_alias(unsigned long, std::unique_ptr<Json_dom, std::default_delete<Json_dom> >) /home/laurynas/mysql-8.0.4/sql/json_dom.cc:1285
    #11 0x55db9c312478 in Json_array::append_alias(std::unique_ptr<Json_dom, std::default_delete<Json_dom> >) /home/laurynas/mysql-8.0.4/sql/json_dom.h:584
    #12 0x55db9c312478 in seeing_value /home/laurynas/mysql-8.0.4/sql/json_dom.cc:515
    #13 0x55db9c34c18d in StartArray /home/laurynas/mysql-8.0.4/sql/json_dom.cc:623
    #14 0x55db9c34c18d in ParseArray<0, rapidjson::MemoryStream, (anonymous namespace)::Rapid_json_handler> /home/laurynas/mysql-8.0.4/extra/rapidjson/include/rapidjson/reader.h:661
...
    #172 0x55db9c354c64 in ParseArray<0, rapidjson::MemoryStream, (anonymous namespace)::Rapid_json_handler> /home/laurynas/mysql-8.0.4/extra/rapidjson/include/rapidjson/reader.h:674
    #173 0x55db9c354c64 in ParseValue<0, rapidjson::MemoryStream, (anonymous namespace)::Rapid_json_handler> /home/laurynas/mysql-8.0.4/extra/rapidjson/include/rapidjson/reader.h:1399
    #174 0x55db9c357bbf in Parse<0, rapidjson::MemoryStream, (anonymous namespace)::Rapid_json_handler> /home/laurynas/mysql-8.0.4/extra/rapidjson/include/rapidjson/reader.h:501
    #175 0x55db9c357bbf in Json_dom::parse(char const*, unsigned long, char const**, unsigned long*) /home/laurynas/mysql-8.0.4/sql/json_dom.cc:679
    #176 0x55db9bdaa7fd in parse_json(String const&, unsigned int, char const*, std::unique_ptr<Json_dom, std::default_delete<Json_dom> >*, bool, bool*) /home/laurynas/mysql-8.0.4/sql/item_json_func.cc:153
    #177 0x55db9bdb5973 in json_is_valid /home/laurynas/mysql-8.0.4/sql/item_json_func.cc:315
    #178 0x55db9bdb6a11 in get_json_wrapper(Item**, unsigned int, String*, char const*, Json_wrapper*) /home/laurynas/mysql-8.0.4/sql/item_json_func.cc:1009
    #179 0x55db9cff7d9a in Item_func_geomfromgeojson::val_str(String*) /home/laurynas/mysql-8.0.4/sql/item_geofunc.cc:1033
    #180 0x55db9b776fad in Item::send(Protocol*, String*) /home/laurynas/mysql-8.0.4/sql/item.cc:7540
    #181 0x55db988f3243 in THD::send_result_set_row(List<Item>*) /home/laurynas/mysql-8.0.4/sql/sql_class.cc:2883
    #182 0x55db9c611fb1 in Query_result_send::send_data(List<Item>&) /home/laurynas/mysql-8.0.4/sql/query_result.cc:103
    #183 0x55db98a0a8fc in JOIN::exec() /home/laurynas/mysql-8.0.4/sql/sql_executor.cc:263
    #184 0x55db98e49ae9 in Sql_cmd_dml::execute_inner(THD*) /home/laurynas/mysql-8.0.4/sql/sql_select.cc:736
    #185 0x55db98eabd2e in Sql_cmd_dml::execute(THD*) /home/laurynas/mysql-8.0.4/sql/sql_select.cc:616
    #186 0x55db98c3905d in mysql_execute_command(THD*, bool) /home/laurynas/mysql-8.0.4/sql/sql_parse.cc:4644
    #187 0x55db98c416fa in mysql_parse(THD*, Parser_state*) /home/laurynas/mysql-8.0.4/sql/sql_parse.cc:5440
    #188 0x55db98c50be9 in dispatch_command(THD*, COM_DATA const*, enum_server_command) /home/laurynas/mysql-8.0.4/sql/sql_parse.cc:1730
    #189 0x55db98c62de6 in do_command(THD*) /home/laurynas/mysql-8.0.4/sql/sql_parse.cc:1310
    #190 0x55db9ac0dbcb in handle_connection /home/laurynas/mysql-8.0.4/sql/conn_handler/connection_handler_per_thread.cc:335
    #191 0x55dba41c7a28 in pfs_spawn_thread /home/laurynas/mysql-8.0.4/storage/perfschema/pfs.cc:2994
    #192 0x7f7b634b97fb in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x77fb)
    #193 0x7f7b60af8b5e in clone (/lib/x86_64-linux-gnu/libc.so.6+0x114b5e)

How to repeat:
-DWITH_DEBUG=ON -DWITH_ASAN=ON -DWITH_UBSAN=ON
./mtr geojson_functions
 I have not tried checking whether the last CMake option for UBSan is required.
[6 Feb 2018 4:19] Laurynas Biveinis 
Same seen on json.json_functions_innodb
[6 Feb 2018 5:17] MySQL Verification Team 
Hello Laurynas,

Thank you for the report and feedback.

Thanks,
Umesh
[6 Feb 2018 5:21] MySQL Verification Team 
test results

Attachment: 89543.results (application/octet-stream, text), 99.06 KiB.
[7 Feb 2018 9:06] Knut Anders Hatlen 
I wasn't able to reproduce this with GCC 6.3. I was however able to reproduce it with GCC 7.3, but only when combining WITH_ASAN=ON and WITH_UBSAN=ON. I couldn't reproduce it with WITH_ASAN=ON alone. So it seems like UBSAN adds extra stack usage which makes parsing of some deeply nested JSON documents run out of stack space.
[21 Mar 2018 8:57] Knut Anders Hatlen 
The two tests pass after the fix for bug#89961.

Portions of this website are copyright © 2001, 2002 The PHP Group

Page generated in 0.042 sec. using MySQL 8.4.7-u6-cloud

Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the respective copyright holders.
It is not reviewed in advance by Oracle and does not necessarily represent the opinion of Oracle or any other party.