[Bug]: CRASH ERROR in `oceanbase::sql::ObSqlPlan::format_plan_to_json()`

Describe the bug
build master branch with sanity, client lost connection after executing a SQL.

Environment

• OS Version and CPU Arch(uname -a):

Linux c0c380f80f1a 6.5.0-44-generic #44~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Jun 18 14:36:16 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

• OB Version(LD_LIBRARY_PATH=../lib:$LD_LIBRARY_PATH ./observer -V):

observer (OceanBase_CE 4.3.3.0)

REVISION: 1-77368f00e6612c47702fddfb6217f0cf864fb0a8
BUILD_BRANCH: master
BUILD_TIME: Sep 18 2024 12:38:51
BUILD_FLAGS: RelWithDebInfo|Sanity
BUILD_INFO: 

Copyright (c) 2011-present OceanBase Inc.

Fast Reproduce Steps(Required)

1. Execute init.sql.txt
   init.sql.txt

2. Execute error.sql.txt
   error.sql.txt

Expected behavior
no crash

Actual Behavior

CRASH ERROR!!! IP=7f265d46d9fc, RBP=46e01, sig=6, sig_code=-6, sig_addr=0x46b50, RLIMIT_CORE=unlimited, timestamp=1726889888309438, tid=290305, tname=T1002_L0_G0, trace_id=Y27110A000A0B-00062298E61F8EBD-0-0, extra_info=(), lbt=0x3de4e858 0x3ddb8177 0x7f265d41951f 0x7f265d46d9fc 0x7f265d419475 0x7f265d3ff7f2 0xa0956de 0x1e1375b5 0x1e119093 0x1e11884b 0x195327ac 0x19ad7bc8 0x19bc397a 0x1d721967 0x1c06db2a 0x1c0655f2 0x1c0588cf 0x1c042c53 0x1c009e0c 0x101d101e 0x101c9665 0x3fb24c79 0xf7e0314 0xf7dd77c 0xf7db7ba 0xf7d93ef 0xf7dc516 0x3dddc9be 0x3ddda942 0x7f265d46bac2 0x7f265d4fca03, SQL_ID=5C795455BF8E71DAA76DC1000020CFA4, SQL_STRING=explain format=json select ...

symbolized output:

safe_backtrace at ./build_sanity/deps/oblib/src/lib/./deps/oblib/src/lib/signal/ob_libunwind.c:30
oceanbase::common::coredump_cb(int, int, void*, void*) at ./build_sanity/deps/oblib/src/lib/./deps/oblib/src/lib/signal/ob_signal_handlers.cpp:210
memory_sanity_abort at ./build_sanity/deps/oblib/src/lib/./deps/oblib/src/lib/alloc/memory_sanity.cpp:0
oceanbase::sql::ObSqlPlan::format_plan_to_json(oceanbase::common::ObIArray<oceanbase::sql::ObSqlPlanItem*>&, oceanbase::sql::PlanText&) at ./build_sanity/src/sql/./src/sql/monitor/ob_sql_plan.cpp:0
oceanbase::sql::ObSqlPlan::format_sql_plan(oceanbase::common::ObIArray<oceanbase::sql::ObSqlPlanItem*>&, oceanbase::sql::ExplainType, oceanbase::sql::ObExplainDisplayOpt const&, oceanbase::sql::PlanText&, bool) at ./build_sanity/src/sql/./src/sql/monitor/ob_sql_plan.cpp:1129
oceanbase::sql::ObSqlPlan::store_sql_plan_for_explain(oceanbase::sql::ObExecContext*, oceanbase::sql::ObLogPlan*, oceanbase::sql::ExplainType, oceanbase::common::ObString const&, oceanbase::common::ObString const&, oceanbase::sql::ObExplainDisplayOpt const&, oceanbase::common::ObIArray<oceanbase::common::ObString>&) at ./build_sanity/src/sql/./src/sql/monitor/ob_sql_plan.cpp:136
oceanbase::sql::ObExplainLogPlan::generate_normal_raw_plan() at ./build_sanity/src/sql/./src/sql/optimizer/ob_explain_log_plan.cpp:78 (discriminator 28)
oceanbase::sql::ObLogPlan::generate_raw_plan() at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:10443 (discriminator 54)
oceanbase::sql::ObLogPlan::generate_plan() at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:10401 (discriminator 2)
oceanbase::sql::ObOptimizer::optimize(oceanbase::sql::ObDMLStmt&, oceanbase::sql::ObLogPlan*&) at ./build_sanity/src/sql/./src/sql/optimizer/ob_optimizer.cpp:63 (discriminator 54)
oceanbase::sql::ObSql::optimize_stmt(oceanbase::sql::ObOptimizer&, oceanbase::sql::ObSQLSessionInfo const&, oceanbase::sql::ObDMLStmt&, oceanbase::sql::ObLogPlan*&) at ./build_sanity/src/sql/./src/sql/ob_sql.cpp:3832 (discriminator 52)
oceanbase::sql::ObSql::generate_plan(ParseResult&, oceanbase::sql::ObPlanCacheCtx*, oceanbase::sql::ObSqlCtx&, oceanbase::sql::ObResultSet&, oceanbase::sql::PlanCacheMode, oceanbase::sql::ObStmt*, oceanbase::share::schema::ObStmtNeedPrivs&, oceanbase::share::schema::ObStmtOraNeedPrivs&) at ./build_sanity/src/sql/./src/sql/ob_sql.cpp:3466 (discriminator 28)
oceanbase::sql::ObSql::generate_physical_plan(ParseResult&, oceanbase::sql::ObPlanCacheCtx*, oceanbase::sql::ObSqlCtx&, oceanbase::sql::ObResultSet&, bool, oceanbase::sql::PlanCacheMode, ParseResult*) at ./build_sanity/src/sql/./src/sql/ob_sql.cpp:3248
oceanbase::sql::ObSql::handle_physical_plan(oceanbase::common::ObString const&, oceanbase::sql::ObSqlCtx&, oceanbase::sql::ObResultSet&, oceanbase::sql::ObPlanCacheCtx&, int) at ./build_sanity/src/sql/./src/sql/ob_sql.cpp:5085 (discriminator 4)
oceanbase::sql::ObSql::handle_text_query(oceanbase::common::ObString const&, oceanbase::sql::ObSqlCtx&, oceanbase::sql::ObResultSet&) at ./build_sanity/src/sql/./src/sql/ob_sql.cpp:2807
oceanbase::observer::ObMPQuery::do_process(oceanbase::sql::ObSQLSessionInfo&, bool, bool, bool&, bool&) at ./build_sanity/src/observer/./src/observer/mysql/obmp_query.cpp:752 (discriminator 234)
oceanbase::observer::ObMPQuery::process() at ./build_sanity/src/observer/./src/observer/mysql/obmp_query.cpp:326 (discriminator 4)
oceanbase::rpc::frame::ObSqlProcessor::run() at ./build_sanity/deps/oblib/src/rpc/./deps/oblib/src/rpc/frame/ob_sql_processor.cpp:41 (discriminator 52)
oceanbase::omt::ObWorkerProcessor::process_one(oceanbase::rpc::ObRequest&) at ./build_sanity/src/observer/./src/observer/omt/ob_worker_processor.cpp:88 (discriminator 52)
oceanbase::omt::ObWorkerProcessor::process(oceanbase::rpc::ObRequest&) at ./build_sanity/src/observer/./src/observer/omt/ob_worker_processor.cpp:156
oceanbase::omt::ObThWorker::process_request(oceanbase::rpc::ObRequest&) at ./build_sanity/src/observer/./src/observer/omt/ob_th_worker.cpp:249
oceanbase::omt::ObThWorker::worker(long&, long&, int&) at ./build_sanity/src/observer/./src/observer/omt/ob_th_worker.cpp:393
oceanbase::omt::ObThWorker::run(long) at ./build_sanity/src/observer/./src/observer/omt/ob_th_worker.cpp:431
oceanbase::lib::Thread::run() at ./build_sanity/deps/oblib/src/lib/./deps/oblib/src/lib/thread/thread.cpp:174 (discriminator 232)
oceanbase::lib::Thread::__th_start(void*) at ./build_sanity/deps/oblib/src/lib/./deps/oblib/src/lib/thread/thread.cpp:332

Additional context
when using MySQL shell, if failed to reproduce, execute this before error.sql:

set collation_connection='latin1_bin';

tenant config

CREATE RESOURCE UNIT 4c7g MAX_CPU 4, MIN_CPU 4, MEMORY_SIZE '7G';
create resource pool pool_test unit='4c7g', unit_num=1, zone_list=('zone1' ,'zone2', 'zone3');
create tenant test resource_pool_list=('pool_test'), primary_zone='RANDOM',comment 'test tenant', charset='utf8' set ob_tcp_invited_nodes='%', recyclebin=OFF;

deploy config

user:
  username: root
  key_file: private_key
oceanbase-ce:
  servers:
    - name: server1
      ip: 10.0.10.11
    - name: server2
      ip: 10.0.10.12
    - name: server3
      ip: 10.0.10.13
  server1:
    mysql_port: 10000
    rpc_port: 10001
    home_path: /root/data/observer1
    zone: zone1
  server2:
    mysql_port: 10000
    rpc_port: 10001
    home_path: /root/data/observer2
    zone: zone2
  server3:
    mysql_port: 10000
    rpc_port: 10001
    home_path: /root/data/observer3
    zone: zone3
  tag: latest
  include: obd/observer.include.yaml
  global: 
    # for default system config used by farm, please see tools/deploy/obd/observer.include.yaml
    # You can also specify the configuration directly below (stored locally, switching the working directory and redeploying will still take effect)
    production_mode: false
    devname: eth0
    syslog_level: 'WARN'
    syslog_io_bandwidth_limit: '30M'
    log_disk_size: '40G'
    # diag_syslog_per_error_limit: '4'
    max_syslog_file_count: '4'
    cpu_count: '6'
    datafile_size: '10G'
    datafile_next: '5G'
    datafile_maxsize: '30G'
    root_password: ''
    memory_limit: '9G'
    system_memory: '1G'
obproxy-ce:
  servers:
    - 10.0.10.8
  global:
    listen_port: 10004
    prometheus_listen_port: 10005
    syslog_level: 'WARN'
    home_path: /root/data/obproxy
    root_password: ''
  include: obd/obproxy.include.yaml
  depends:
    - oceanbase-ce

about us

We are the BASS team from the School of Cyber Science and Technology at Beihang University. Our main focus is on system software security, operating systems, and program analysis research, as well as the development of automated program testing frameworks for detecting software defects. Using our self-developed database vulnerability testing tool, we have identified the potential vulnerabilities.

Start with src/sql/monitor/ob_sql_plan.cpp, especially ObSqlPlan::format_plan_to_json(), using the symbolized stack and the init.sql.txt and error.sql.txt reproduction files. Build the master branch with sanity, run the supplied SQL sequence, and verify that the EXPLAIN FORMAT=json query completes without crashing.