drizzle date and time functions corrupt blob data in pbxt engine

So, I'm looking into this, but what I'm wondering is if the bug is in the kernel code, why it doesn't show up with the InnoDB plugin? Any insights?

Jay,

I didnt look into drizzle code. All I can tell is that when we return non-corrupted buffer which can be tested by running the first set of SELECTs multiple times - it will always return the correct value, but once you call a date-time function on the previous field (text_fld) the buffer of blob_fld gets corrupted and the returned value will always be "" (unless it's refreshed in pbxt's internal cache or server is restarted).

OK, thx Vlad! I'll look further into it today (conference taking lots of my time... :) )

-jay

I looked into this before the conference as well. As far as I can tell the problem is that somewhere in Drizzle a zero terminator is being set in order to do the conversion of the 'text_fld' field to a HOUR value.

So the zero terminator overwrites one byte in the buffer. In the case of PBXT this buffer is pointing directly into the PBXT sequential scan buffer cache.

The byte happens to be the size of the second BLOB (blob_fld) which follow directly after text_fld. So the this overwrite set the size of the value in the blob_fld field to zero.

And that is why the error occurs.

I presume InnoDB returns a pointer to a copy of the data, and therefore this overwrite does not affect it.

On 4/20/2010 3:56 PM, Paul McCullagh wrote:
> I looked into this before the conference as well. As far as I can tell
> the problem is that somewhere in Drizzle a zero terminator is being set
> in order to do the conversion of the 'text_fld' field to a HOUR value.
>
> So the zero terminator overwrites one byte in the buffer. In the case of
> PBXT this buffer is pointing directly into the PBXT sequential scan
> buffer cache.
>
> The byte happens to be the size of the second BLOB (blob_fld) which
> follow directly after text_fld. So the this overwrite set the size of
> the value in the blob_fld field to zero.
>
> And that is why the error occurs.
>
> I presume InnoDB returns a pointer to a copy of the data, and therefore
> this overwrite does not affect it.
>

Sigh.

(setting random \0 bytes in the middle of a buffer)--

Blocked by bug 618758.

A bug fix for this problem has been pushed to lp:~paul-mccullagh/drizzle/bug-fix-618758.

Adding a comment to remember where I'm at in debugging:

So initially I thought it was conversion to a string that may be overwriting the record buffer, but it looks like the problem may be within table.cc:

(gdb) c
Continuing.

Breakpoint 3, drizzled::Field_blob::val_str (this=0x2f1cfe8, val_ptr=0x2e4d668)
    at drizzled/field/blob.cc:325
325 memcpy(&blob,ptr+packlength,sizeof(char*));
(gdb) p this->ptr
$13 = (unsigned char *) 0x2e4fcde "\023"
(gdb) x/40xb 0x2e4fcde
0x2e4fcde: 0x13 0x00 0x00 0x00 0x56 0x00 0x13 0x03
0x2e4fce6: 0x00 0x00 0x00 0x00 0x13 0x00 0x00 0x00 <-- 0x13 is the length of blob field
0x2e4fcee: 0x6a 0x00 0x13 0x03 0x00 0x00 0x00 0x00
0x2e4fcf6: 0x00 0x00 0xff 0x00 0x00 0x00 0x00 0x00
0x2e4fcfe: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
(gdb) watch *((int*)0x2e4fcea)
Hardware watchpoint 4: *((int*)0x2e4fcea)
(gdb) c
Continuing.

Breakpoint 2, drizzled::Item_func_hour::val_int (this=0x2e4d748)
    at drizzled/function/time/hour.cc:86
86 if (! temporal_datetime.from_string(res->c_ptr(), res->length()))
(gdb) c
Continuing.
Hardware watchpoint 4: *((int*)0x2e4fcea)

Old value = 19
New value = 0
memcpy () at ../sysdeps/x86_64/memcpy.S:120
120 ../sysdeps/x86_64/memcpy.S: No such file or directory.
 in ../sysdeps/x86_64/memcpy.S
(gdb) list
115 in ../sysdeps/x86_64/memcpy.S
(gdb) bt
#0 memcpy () at ../sysdeps/x86_64/memcpy.S:120
#1 0x000000000081c89f in drizzled::Table::restoreRecordAsDefault (
    this=0x2f1ac00) at drizzled/table.cc:1864
#2 0x000000000081c8c0 in drizzled::Table::emptyRecord (this=0x2f1ac00)
    at drizzled/table.cc:1873
#3 0x0000000000773fe6 in drizzled::ReadRecord::init_read_record (
    this=0x2e2ba98, session_arg=0x2e4c1d0, table_arg=0x2f1ac00,
    select_arg=0x2e2bcb0, use_record_cache=1, print_error_arg=true)
    at drizzled/records.cc:89
#4 0x00000000007c5c83 in drizzled::join_init_read_record (tab=0x2e2ba10)
    at drizzled/sql_select.cc:3967
#5 0x00000000007c4ac0 in drizzled::sub_select (join=0x2e4da30,
    join_tab=0x2e2ba10, end_of_records=false) at drizzled/sql_select.cc:3563
#6 0x00000000007c46bf in drizzled::do_select (join=0x2e4da30,
    fields=0x2e4cf40, table=0x0) at drizzled/sql_select.cc:3333
#7 0x00000000006f2d0f in drizzled::Join::exec (this=0x2e4da30)
    at drizzled/join.cc:1695
#8 0x00000000007bd91b in drizzled::mysql_select (session=0x2e4c1d0,
    rref_pointer_array=0x2e4d000, tables=0x2e4d860, wild_num=0, fields=...,
    conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0,
    select_options=2147500032, result=0x2e4da10, unit=0x2e4cc48,
    select_lex=0x2e4ce48) at drizzled/sql_select.cc:427
#9 0x00000000007bd1f1 in drizzled::handle_select (session=0x2e4c1d0,
    lex=0x2e4cc28, result=0x2e4da10, setup_tables_done_option=0)
    at drizzled/sql_select.cc:146
#10 0x00000000007b98d8 in drizzled::execute_sqlcom_select (session=0x2e4c1d0,
    all_tables=0x2e4d860) at drizzled/sql_parse.cc:544
#11 0x0000000000812e7f in drizzled::statement::Select::execute (this=0x2e50080)
    at drizzled/statement/select.cc:32
#12 0x00000000007b9463 in mysql_execute_command (session=0x2e4c1d0)
    at drizzled/sql_parse.cc:479
#13 0x00000000007ba1b2 in drizzled::mysql_parse (sess...

Forget that last comment... supposed to happen.

Fix for hour.cc:

=== modified file 'drizzled/function/time/hour.cc'
--- drizzled/function/time/hour.cc 2010-02-04 08:14:46 +0000
+++ drizzled/function/time/hour.cc 2010-09-09 17:38:41 +0000
@@ -57,7 +57,13 @@
   char time_buff[DRIZZLE_MAX_LENGTH_DATETIME_AS_STRING];
   String tmp_time(time_buff,sizeof(time_buff), &my_charset_utf8_bin);
   String *time_res= args[0]->val_str(&tmp_time);
- if (! temporal_time.from_string(time_res->c_ptr(), time_res->length()))
+ if (time_res && time_res != &tmp_time)
+ {
+ tmp_time.copy(*time_res);
+ }
+
+
+ if (! temporal_time.from_string(tmp_time.c_ptr(), tmp_time.length()))
   {
     /*
      * OK, we failed to match the first argument as a string
@@ -83,7 +89,12 @@
           char buff[DRIZZLE_MAX_LENGTH_DATETIME_AS_STRING];
           String tmp(buff,sizeof(buff), &my_charset_utf8_bin);
           String *res= args[0]->val_str(&tmp);
- if (! temporal_datetime.from_string(res->c_ptr(), res->length()))
+ if (res && res != &tmp)
+ {
+ tmp.copy(*res);
+ }
+
+ if (! temporal_datetime.from_string(tmp.c_ptr(), tmp.length()))
           {
             /*
             * Could not interpret the function argument as a temporal value,
@@ -111,7 +122,12 @@

           res= args[0]->val_str(&tmp);

- my_error(ER_INVALID_DATETIME_VALUE, MYF(0), res->c_ptr());
+ if (res && res != &tmp)
+ {
+ tmp.copy(*res);
+ }
+
+ my_error(ER_INVALID_DATETIME_VALUE, MYF(0), tmp.c_ptr());
           return 0;
         }
     }