Hi, Alexander, I don't know, this looks like a strange place to fix this. I'd say that either Item_func_xml_extractvalue shouldn't return {0, 0} or, if we'll treat it as a valid String, caseup() and casedn() should be able to handle it. But in a similarly-looking bug MDEV-35945 Assertion `src != ((void *)0)' failed in my_caseup_8bit you fixed it to use { "", 0 } for an empty string. It's commit c69fb1a6273. Then I'd suggest to do the same here. Let's avoid {0, 0} ? On Apr 16, Alexander Barkov wrote:

revision-id: 6d4479d0e32 (mariadb-11.4.5-25-g6d4479d0e32) parent(s): d3c9a2ee212 author: Alexander Barkov committer: Alexander Barkov timestamp: 2025-04-15 19:30:44 +0400 message:

MDEV-36565 Assertion `src != ((void *)0)' failed in my_casedn_8bit

diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc index 2e3c33059d3..5df25c7f237 100644 --- a/sql/item_strfunc.cc +++ b/sql/item_strfunc.cc @@ -1998,7 +1998,16 @@ String *Item_str_conv::val_str(String *str) goto err;

null_value= false; - len= converter(collation.collation, (char*) res->ptr(), res->length(), + /* + Avoid passing nullptr as the second parameter to converter(): + - val_str() of some Items (e.g. Item_func_xml_extractvalue) can return + Strings with {Ptr=0,str_length=0} meaning an empty string. + - But my_charset_handler_st virtual function caseup() and casedn() + (which "converter" point to) do not expect {src=nullptr,srclen=0} input. + */ + DBUG_ASSERT(res->ptr() != nullptr || res->length() == 0); + len= !res->ptr() ? 0/*Avoid passing nullptr*/ : + converter(collation.collation, (char*) res->ptr(), res->length(), (char*) str->ptr(), alloced_length); DBUG_ASSERT(len <= alloced_length); str->set_charset(collation.collation);

Regards, Sergei Chief Architect, MariaDB Server and security@mariadb.org