DeNADev/HandlerSocket-Plugin-for-MySQL — Issue #78: Mysqld may crash when inserting a row with value length less than fields length
Author: skyinfall
Created: 2012-02-29 06:48:11+00:00
State: open

* table used

CREATE TABLE `test` (
`id` bigint(20) NOT NULL AUTO_INCREMENT,
`t1` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8

* telnet hs to insert:

telnet localhost 9999
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
P 0 test test PRIMARY id,t1
0 1
0 + 1 321
Connection closed by foreign host.
work@backup02:~/local/src/hs$ 120229 14:26:20 mysqld_safe Number of processes running now: 0
120229 14:26:20 mysqld_safe mysqld restarted

modify t1 column to varchar(255) default null, mysqld won't crash, but result is sth like below:

select * from test.test;
+-----+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| id | t1 |
+-----+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| 321 | + 1 321
st PRIMARY id,t1 Y id,t1 |
+-----+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

* ENV:
HS 1.1.0
Mysqld Server version: 5.1.49-log Source distribution
Linux version 2.6.32-5-xen-amd64 (Debian 2.6.32-39) (dannf@debian.org) (gcc version 4.3.5 (Debian 4.3.5-4) ) #1 SMP Thu Nov 3 05:42:31 UTC 2011

* mysql crash Trace:

thd: 0x27feab40
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7fa893ff6ea0 thread_stack 0x30000
/home/work/local/mysql/libexec/mysqld(my_print_stacktrace+0x29) [0x964989]
/home/work/local/mysql/libexec/mysqld(handle_segfault+0x3db) [0x61da0b]
/lib/libpthread.so.0(+0xef60) [0x7fae228ecf60]
/lib/libc.so.6(memcpy+0x3fb) [0x7fae215e6b4b]
/home/work/local/mysql/libexec/mysqld(String::copy(char const*, unsigned int, charset_info_st*)+0xbd) [0x6183ad]
/home/work/local/mysql/libexec/mysqld(make_truncated_value_warning(THD*, MYSQL_ERROR::enum_warning_level, char const*, unsigned int, enum_mysql_timestamp_type, char const*)+0x87) [0x6edd97]
/home/work/local/mysql/libexec/mysqld(Field_timestamp::store(char const*, unsigned int, charset_info_st*)+0xe7) [0x5ff497]
/home/work/local/mysql/lib/mysql/plugin/handlersocket.so(dena::dbcontext::cmd_insert_internal(dena::dbcallback_i&, dena::prep_stmt const&, dena::string_ref const*, unsigned long)+0x102) [0x7fadf8b512f2]
/home/work/local/mysql/lib/mysql/plugin/handlersocket.so(dena::hstcpsvr_worker::do_exec_on_index(char*, char*, char*, char*, dena::hstcpsvr_conn&)+0x735) [0x7fadf8b59695]
/home/work/local/mysql/lib/mysql/plugin/handlersocket.so(dena::hstcpsvr_worker::execute_lines(dena::hstcpsvr_conn&)+0x5c) [0x7fadf8b59d3c]
/home/work/local/mysql/lib/mysql/plugin/handlersocket.so(dena::hstcpsvr_worker::run_one_ep()+0x238) [0x7fadf8b5aca8]
/home/work/local/mysql/lib/mysql/plugin/handlersocket.so(dena::hstcpsvr_worker::run()+0x6e) [0x7fadf8b5bb1e]
/home/work/local/mysql/lib/mysql/plugin/handlersocket.so(dena::thread::thread_main(void*)+0xd) [0x7fadf8b60dfd]
/lib/libpthread.so.0(+0x68ba) [0x7fae228e48ba]
/lib/libc.so.6(clone+0x6d) [0x7fae2163602d]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort...
thd->query at (nil) is an invalid pointer
thd->thread_id=16
thd->killed=NOT_KILLED
The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
information that should help you find out what is causing the crash.