database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-08 11:22:35 +03:00
Code Activity

MDEV-36565 Assertion `src != ((void *)0)' failed in my_casedn_8bit

Browse Source 
The crash happened when ExtractValue() returning an empty string
as a result was passed to LCASE() or UCASE().

Item_func_xml_extractvalue::val_str() could return a String
{Ptr=0,str_value=0} in some cases, to mean an empty retult.
But virtual my_charset_handler_st functions caseup() and casedn()
do not expect {src=nullptr,srclen=0} as input and:
- raise a DBUG_ASSERT() in debug builds, or
- raise a "applying zero offset to null pointer" warning in UBSAN builds

Fixing Item_func_xml_extractvalue::val_str() to return
a String {Ptr="",str_length=0} instead of {Ptr=0,str_value=0}.

A similar fix was done earlier in Field_set::val_str(). See c69fb1a627.
This commit is contained in:
Alexander Barkov
2025-04-15 19:30:44 +04:00
parent b6391d4e03
commit 7b3e02e1aa
3 changed files with 28 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
mysql-test/main/xml.result
View File

@@ -1320,5 +1320,17 @@ f
foo
<b></b>
#
# Start of 10.5 tests
# End of 10.5 tests
#
# Start of 11.4 tests
#
# MDEV-36565 Assertion `src != ((void *)0)' failed in my_casedn_8bit
#
SET NAMES latin1;
SELECT lcase((extractvalue('a', 'a'))) a FROM (select 1) dt;
a
SELECT ucase((extractvalue('a', 'a'))) a FROM (select 1) dt;
a
# End of 11.4 tests

14
mysql-test/main/xml.test
View File

@@ -822,5 +822,17 @@ DROP TABLE t1;
SELECT 'foo' AS f UNION SELECT BINARY( UpdateXML('<a></a>', '/a', '<b></b>')) AS f;
--echo #
--echo # Start of 10.5 tests
--echo # End of 10.5 tests
--echo #
--echo # Start of 11.4 tests
--echo #
--echo # MDEV-36565 Assertion `src != ((void *)0)' failed in my_casedn_8bit
--echo #
SET NAMES latin1;
SELECT lcase((extractvalue('a', 'a'))) a FROM (select 1) dt;
SELECT ucase((extractvalue('a', 'a'))) a FROM (select 1) dt;
--echo # End of 11.4 tests

4
sql/item_xmlfunc.cc
View File

@@ -176,8 +176,8 @@ public:
}
}
str->length(0);
str->set_charset(collation.collation);
// Make sure we never return {Ptr=nullptr, str_length=0}
str->copy("", 0, collation.collation);
for (uint i=0 ; i < numnodes; i++)
{
if(active[i])