Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-4075

Prepare statement wrong argument overflow using UPPER(LEFT(? )) when linked against libmysqlclient-16 or 18

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Critical
    • Resolution: Incomplete
    • Affects Version/s: 5.5.28a
    • Fix Version/s: None
    • Component/s: None
    • Labels:
    • Environment:
      rehl6

      Description

      When compiling client over libmysqlclient16 and libmysqlclient18 and

      UPPER(LEFT(?))

      inside a where clause, such parameter statement parameter is always set to 0 and cause wrong results for the query . Switching back to libmysqlclient15 fixe the issue . The issue is triggered on MySQL and MariaDB client libraries

        Gliffy Diagrams

          Attachments

            Activity

            Hide
            stephane@skysql.com VAROQUI Stephane added a comment -

            We can provide a very simple C reproducible test case if that an save you time

            Show
            stephane@skysql.com VAROQUI Stephane added a comment - We can provide a very simple C reproducible test case if that an save you time
            Hide
            serg Sergei Golubchik added a comment -

            please, do! You can attach it to the issue.

            Show
            serg Sergei Golubchik added a comment - please, do! You can attach it to the issue.
            Hide
            elenst Elena Stepanova added a comment -

            Hi Stephane,

            Here is what I'm getting with the provided test:

            $ ./mdev-4075
            One:Exec OK
            One:Fetch OK 1

            $ ldd ./mdev-4075
            linux-vdso.so.1 => (0x00007fff795ff000)
            libmysqlclient.so.16 => /usr/lib/libmysqlclient.so.16 (0x00007f923856e000)
            libstdc+.so.6 => /usr/lib/x86_64-linux-gnu/libstdc+.so.6 (0x00007f9238267000)
            libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f9237fe2000)
            libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f9237dcc000)
            libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f9237a29000)
            libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f923780b000)
            libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f92375f3000)
            /lib64/ld-linux-x86-64.so.2 (0x00007f9238989000)

            General log contents:

            7 Prepare SELECT 1 FROM DUAL WHERE UPPER(LEFT('emstoto',3))=UPPER(LEFT(?,3))
            7 Execute SELECT 1 FROM DUAL WHERE UPPER(LEFT('emstoto',3))=UPPER(LEFT('ems',3))

            So, it looks like everything works as expected. Same with libmysqlclient-18.

            Could you please provide the same from your test runs? Test output, ldd, general log.

            Thank you.

            Show
            elenst Elena Stepanova added a comment - Hi Stephane, Here is what I'm getting with the provided test: $ ./mdev-4075 One:Exec OK One:Fetch OK 1 $ ldd ./mdev-4075 linux-vdso.so.1 => (0x00007fff795ff000) libmysqlclient.so.16 => /usr/lib/libmysqlclient.so.16 (0x00007f923856e000) libstdc+ .so.6 => /usr/lib/x86_64-linux-gnu/libstdc +.so.6 (0x00007f9238267000) libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f9237fe2000) libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f9237dcc000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f9237a29000) libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f923780b000) libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f92375f3000) /lib64/ld-linux-x86-64.so.2 (0x00007f9238989000) General log contents: 7 Prepare SELECT 1 FROM DUAL WHERE UPPER(LEFT('emstoto',3))=UPPER(LEFT(?,3)) 7 Execute SELECT 1 FROM DUAL WHERE UPPER(LEFT('emstoto',3))=UPPER(LEFT('ems',3)) So, it looks like everything works as expected. Same with libmysqlclient-18. Could you please provide the same from your test runs? Test output, ldd, general log. Thank you.
            Hide
            elenst Elena Stepanova added a comment -

            Hi Stephane,

            You were going to get more information on this, any luck?

            Show
            elenst Elena Stepanova added a comment - Hi Stephane, You were going to get more information on this, any luck?
            Hide
            elenst Elena Stepanova added a comment -

            Since there is no new information on the issue, I will close it for now. Please re-open (or comment so we could re-open it) if you have any news.
            Thanks.

            Show
            elenst Elena Stepanova added a comment - Since there is no new information on the issue, I will close it for now. Please re-open (or comment so we could re-open it) if you have any news. Thanks.

              People

              • Assignee:
                elenst Elena Stepanova
                Reporter:
                stephane@skysql.com VAROQUI Stephane
              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Due:
                  Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - 2 hours
                  2h
                  Remaining:
                  Remaining Estimate - 2 hours
                  2h
                  Logged:
                  Time Spent - Not Specified
                  Not Specified