[MDEV-14926] AddressSanitizer: heap-use-after-free in make_date_time on weird combination of functions - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Minor
Resolution: Fixed
Affects Version/s: 10.0(EOL), 10.1(EOL), 10.2(EOL), 10.3(EOL), 10.4(EOL)
Fix Version/s: 10.2.23, 10.1.39, 10.3.14, 10.4.4
Component/s: Server
Labels:
None

Description

SELECT INET_ATON( FROM_UNIXTIME( @@timestamp, ( TRIM( UNHEX(HEX('%m.%d.%Y') ) ) ) ) );

10.0 4b8cd4536a2c ASAN
==5964==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d00000d590 at pc 0xd87a68 bp 0x7ff274465450 sp 0x7ff274465448
READ of size 1 at 0x60d00000d590 thread T5
#0 0xd87a67 in make_date_time /data/src/10.0/sql/item_timefunc.cc:471
#1 0xd87a67 in Item_func_date_format::val_str(String*) /data/src/10.0/sql/item_timefunc.cc:1975
#2 0xb91f5b in Item::val_str_ascii(String*) /data/src/10.0/sql/item.cc:278
#3 0xf7ffe6 in Item_func_inet_aton::val_int() /data/src/10.0/sql/item_inetfunc.cc:43
#4 0xb91822 in Item::send(Protocol, String) /data/src/10.0/sql/item.cc:6651
#5 0x547221 in Protocol::send_result_set_row(List<Item>*) /data/src/10.0/sql/protocol.cc:912
#6 0x64407a in select_send::send_data(List<Item>&) /data/src/10.0/sql/sql_class.cc:2572
#7 0x7d454f in JOIN::exec_inner() /data/src/10.0/sql/sql_select.cc:2465
#8 0x7dd343 in JOIN::exec() /data/src/10.0/sql/sql_select.cc:2379
#9 0x7d24a6 in mysql_select(THD, Item*, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.0/sql/sql_select.cc:3318
#10 0x7d2ad6 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.0/sql/sql_select.cc:373
#11 0x6b566c in execute_sqlcom_select /data/src/10.0/sql/sql_parse.cc:5293
#12 0x6ccea8 in mysql_execute_command(THD*) /data/src/10.0/sql/sql_parse.cc:2553
#13 0x6e19f7 in mysql_parse(THD, char, unsigned int, Parser_state*) /data/src/10.0/sql/sql_parse.cc:6569
#14 0x6e5616 in dispatch_command(enum_server_command, THD, char, unsigned int) /data/src/10.0/sql/sql_parse.cc:1296
#15 0x6e9f0f in do_command(THD*) /data/src/10.0/sql/sql_parse.cc:999
#16 0x975c3b in do_handle_one_connection(THD*) /data/src/10.0/sql/sql_connect.cc:1377
#17 0x975ea2 in handle_one_connection /data/src/10.0/sql/sql_connect.cc:1292
#18 0x11a95d4 in pfs_spawn_thread /data/src/10.0/storage/perfschema/pfs.cc:1861
#19 0x7ff27ea78493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
#20 0x7ff27ce3193e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x60d00000d590 is located 112 bytes inside of 132-byte region [0x60d00000d520,0x60d00000d5a4)
freed by thread T5 here:
#0 0x7ff27ece2527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
#1 0x18e68b3 in free_memory /data/src/10.0/mysys/safemalloc.c:276

previously allocated by thread T5 here:
#0 0x7ff27ece273f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x18e6986 in sf_malloc /data/src/10.0/mysys/safemalloc.c:115
#2 0x19c964a (/data/bld/10.0-asan/bin/mysqld+0x19c964a)

Thread T5 created by T0 here:
#0 0x7ff27ecb1bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
#1 0x11b4e2b in spawn_thread_v1 /data/src/10.0/storage/perfschema/pfs.cc:1911

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.0/sql/item_timefunc.cc:471 make_date_time
Shadow bytes around the buggy address:
0x0c1a7fff9a60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff9a70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff9a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff9a90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff9aa0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c1a7fff9ab0: fd fd[fd]fd fd fa fa fa fa fa fa fa fa fa 00 00
0x0c1a7fff9ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
0x0c1a7fff9ae0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
0x0c1a7fff9af0: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c1a7fff9b00: fd fd fd fd fa fa fa fa fa fa fa fa fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==5964==ABORTING

Attachments

Issue Links

is duplicated by

MDEV-18667 ASAN heap-use-after-free in make_date_time / Arg_comparator::compare_string / Item_func_nullif::compare

Closed

relates to

MDEV-18667 ASAN heap-use-after-free in make_date_time / Arg_comparator::compare_string / Item_func_nullif::compare

Closed

MDEV-19164 Assertion `fixed' failed in Item_func_inet_aton::val_int

Closed

Activity

Ascending order - Click to sort in descending order

Elena Stepanova added a comment - 2019-02-21 23:57

A variation of the failure on a different test case:

CREATE TABLE t1 (d DATE);

INSERT INTO t1 VALUES ('1989-03-10');

SELECT TIME_FORMAT('23:59:43', BINARY d) AS f FROM t1 GROUP BY 'foo';

# Cleanup

DROP TABLE t1;

10.1 ASAN d9f7b6be
==16500==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000032440 at pc 0x55cdddeb4586 bp 0x7fcf11089c00 sp 0x7fcf11089bf8
READ of size 1 at 0x60d000032440 thread T6
#0 0x55cdddeb4585 in make_date_time /data/src/10.1/sql/item_timefunc.cc:475
#1 0x55cdddeb4585 in Item_func_date_format::val_str(String*) /data/src/10.1/sql/item_timefunc.cc:1986
#2 0x55cdddcb3641 in Item_copy_string::copy() /data/src/10.1/sql/item.cc:4063
#3 0x55cddd83efdb in copy_fields(TMP_TABLE_PARAM*) /data/src/10.1/sql/sql_select.cc:23163
#4 0x55cddd84d115 in end_send_group(JOIN, st_join_table, bool) /data/src/10.1/sql/sql_select.cc:19816
#5 0x55cddd83755d in do_select /data/src/10.1/sql/sql_select.cc:18091
#6 0x55cddd87c54e in JOIN::exec_inner() /data/src/10.1/sql/sql_select.cc:3275
#7 0x55cddd87d836 in JOIN::exec() /data/src/10.1/sql/sql_select.cc:2562
#8 0x55cddd872089 in mysql_select(THD, Item*, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.1/sql/sql_select.cc:3499
#9 0x55cddd872877 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.1/sql/sql_select.cc:388
#10 0x55cddd741a59 in execute_sqlcom_select /data/src/10.1/sql/sql_parse.cc:5950
#11 0x55cddd75bc69 in mysql_execute_command(THD*) /data/src/10.1/sql/sql_parse.cc:2995
#12 0x55cddd773e7a in mysql_parse(THD, char, unsigned int, Parser_state*) /data/src/10.1/sql/sql_parse.cc:7468
#13 0x55cddd77ac5e in dispatch_command(enum_server_command, THD, char, unsigned int) /data/src/10.1/sql/sql_parse.cc:1496
#14 0x55cddd7813ea in do_command(THD*) /data/src/10.1/sql/sql_parse.cc:1124
#15 0x55cddda298bf in do_handle_one_connection(THD*) /data/src/10.1/sql/sql_connect.cc:1330
#16 0x55cddda29dd0 in handle_one_connection /data/src/10.1/sql/sql_connect.cc:1242
#17 0x55cdde2f8ccc in pfs_spawn_thread /data/src/10.1/storage/perfschema/pfs.cc:1861
#18 0x7fcf1d7bb493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
#19 0x7fcf1bb7493e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x60d000032440 is located 112 bytes inside of 132-byte region [0x60d0000323d0,0x60d000032454)
freed by thread T6 here:
#0 0x7fcf1da25527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
#1 0x55cddeac4b57 in free_memory /data/src/10.1/mysys/safemalloc.c:276

previously allocated by thread T6 here:
#0 0x7fcf1da2573f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x55cddeac4c28 in sf_malloc /data/src/10.1/mysys/safemalloc.c:115
#2 0x55cddebbd69a (/data/bld/10.1-asan/bin/mysqld+0x1d9e69a)

Thread T6 created by T0 here:
#0 0x7fcf1d9f4bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
#1 0x55cdde304523 in spawn_thread_v1 /data/src/10.1/storage/perfschema/pfs.cc:1911

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.1/sql/item_timefunc.cc:475 make_date_time
Shadow bytes around the buggy address:
0x0c1a7fffe430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fffe440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fffe450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fffe460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fffe470: fa fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
=>0x0c1a7fffe480: fd fd fd fd fd fd fd fd[fd]fd fd fa fa fa fa fa
0x0c1a7fffe490: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1a7fffe4a0: 00 00 00 00 00 04 fa fa fa fa fa fa fa fa 00 00
0x0c1a7fffe4b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa
0x0c1a7fffe4c0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c1a7fffe4d0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==16500==ABORTING

Elena Stepanova added a comment - 2019-02-21 23:57 A variation of the failure on a different test case: CREATE TABLE t1 (d DATE ); INSERT INTO t1 VALUES ( '1989-03-10' ); SELECT TIME_FORMAT( '23:59:43' , BINARY d) AS f FROM t1 GROUP BY 'foo' ; # Cleanup DROP TABLE t1; 10.1 ASAN d9f7b6be ==16500==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000032440 at pc 0x55cdddeb4586 bp 0x7fcf11089c00 sp 0x7fcf11089bf8 READ of size 1 at 0x60d000032440 thread T6 #0 0x55cdddeb4585 in make_date_time /data/src/10.1/sql/item_timefunc.cc:475 #1 0x55cdddeb4585 in Item_func_date_format::val_str(String*) /data/src/10.1/sql/item_timefunc.cc:1986 #2 0x55cdddcb3641 in Item_copy_string::copy() /data/src/10.1/sql/item.cc:4063 #3 0x55cddd83efdb in copy_fields(TMP_TABLE_PARAM*) /data/src/10.1/sql/sql_select.cc:23163 #4 0x55cddd84d115 in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.1/sql/sql_select.cc:19816 #5 0x55cddd83755d in do_select /data/src/10.1/sql/sql_select.cc:18091 #6 0x55cddd87c54e in JOIN::exec_inner() /data/src/10.1/sql/sql_select.cc:3275 #7 0x55cddd87d836 in JOIN::exec() /data/src/10.1/sql/sql_select.cc:2562 #8 0x55cddd872089 in mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.1/sql/sql_select.cc:3499 #9 0x55cddd872877 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.1/sql/sql_select.cc:388 #10 0x55cddd741a59 in execute_sqlcom_select /data/src/10.1/sql/sql_parse.cc:5950 #11 0x55cddd75bc69 in mysql_execute_command(THD*) /data/src/10.1/sql/sql_parse.cc:2995 #12 0x55cddd773e7a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.1/sql/sql_parse.cc:7468 #13 0x55cddd77ac5e in dispatch_command(enum_server_command, THD*, char*, unsigned int) /data/src/10.1/sql/sql_parse.cc:1496 #14 0x55cddd7813ea in do_command(THD*) /data/src/10.1/sql/sql_parse.cc:1124 #15 0x55cddda298bf in do_handle_one_connection(THD*) /data/src/10.1/sql/sql_connect.cc:1330 #16 0x55cddda29dd0 in handle_one_connection /data/src/10.1/sql/sql_connect.cc:1242 #17 0x55cdde2f8ccc in pfs_spawn_thread /data/src/10.1/storage/perfschema/pfs.cc:1861 #18 0x7fcf1d7bb493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493) #19 0x7fcf1bb7493e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e) 0x60d000032440 is located 112 bytes inside of 132-byte region [0x60d0000323d0,0x60d000032454) freed by thread T6 here: #0 0x7fcf1da25527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527) #1 0x55cddeac4b57 in free_memory /data/src/10.1/mysys/safemalloc.c:276 previously allocated by thread T6 here: #0 0x7fcf1da2573f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f) #1 0x55cddeac4c28 in sf_malloc /data/src/10.1/mysys/safemalloc.c:115 #2 0x55cddebbd69a (/data/bld/10.1-asan/bin/mysqld+0x1d9e69a) Thread T6 created by T0 here: #0 0x7fcf1d9f4bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba) #1 0x55cdde304523 in spawn_thread_v1 /data/src/10.1/storage/perfschema/pfs.cc:1911 SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.1/sql/item_timefunc.cc:475 make_date_time Shadow bytes around the buggy address: 0x0c1a7fffe430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1a7fffe440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1a7fffe450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1a7fffe460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1a7fffe470: fa fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd =>0x0c1a7fffe480: fd fd fd fd fd fd fd fd[fd]fd fd fa fa fa fa fa 0x0c1a7fffe490: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 0x0c1a7fffe4a0: 00 00 00 00 00 04 fa fa fa fa fa fa fa fa 00 00 0x0c1a7fffe4b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa 0x0c1a7fffe4c0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c1a7fffe4d0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==16500==ABORTING

Elena Stepanova added a comment - 2019-02-22 17:33

More variations, more stack traces.

--source include/have_innodb.inc

CREATE TABLE t1 (d DATE) ENGINE=InnoDB;

INSERT INTO t1 VALUES ('1900-01-01');

SELECT LENGTH( DATE_FORMAT( d, BINARY DATABASE() ) ) AS f FROM t1 GROUP BY d;

# Cleanup

DROP TABLE t1;

10.4 ASAN 5b4d6595
==19984==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000452f0 at pc 0x563d32e6f726 bp 0x7f5d3e1e0a50 sp 0x7f5d3e1e0a48
READ of size 1 at 0x60c0000452f0 thread T27
#0 0x563d32e6f725 in make_date_time /data/src/10.4/sql/item_timefunc.cc:498
#1 0x563d32e7dfa0 in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1913
#2 0x563d32d5dbe8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760
#3 0x563d32c8146c in Item::save_int_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6492
#4 0x563d3293eed7 in Type_handler_int_result::Item_save_in_field(Item, Field, bool) const /data/src/10.4/sql/sql_type.cc:3587
#5 0x563d32c8164e in Item::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6502
#6 0x563d3233d08b in Item_result_field::save_in_result_field(bool) /data/src/10.4/sql/item.h:3167
#7 0x563d325c907a in copy_funcs(Item*, THD const) /data/src/10.4/sql/sql_select.cc:24998
#8 0x563d325b1073 in end_write /data/src/10.4/sql/sql_select.cc:21419
#9 0x563d325e056d in AGGR_OP::put_record(bool) /data/src/10.4/sql/sql_select.cc:28133
#10 0x563d325ed85a in AGGR_OP::put_record() (/data/bld/10.4-asan/bin/mysqld+0x115b85a)
#11 0x563d325a4d41 in sub_select_postjoin_aggr(JOIN, st_join_table, bool) /data/src/10.4/sql/sql_select.cc:19719
#12 0x563d325a6f58 in evaluate_join_record /data/src/10.4/sql/sql_select.cc:20219
#13 0x563d325a5b32 in sub_select(JOIN, st_join_table, bool) /data/src/10.4/sql/sql_select.cc:19999
#14 0x563d325a3e3d in do_select /data/src/10.4/sql/sql_select.cc:19537
#15 0x563d3253d254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360
#16 0x563d3253ab4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142
#17 0x563d3253e62c in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.4/sql/sql_select.cc:4574
#18 0x563d32514d0e in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423
#19 0x563d32495a49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604
#20 0x563d324825d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841
#21 0x563d3249e33c in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157
#22 0x563d32476545 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
#23 0x563d32473346 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358
#24 0x563d328022e9 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399
#25 0x563d32801ce2 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302
#26 0x563d333ca714 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
#27 0x7f5d49b8c493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
#28 0x7f5d47f7293e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x60c0000452f0 is located 112 bytes inside of 124-byte region [0x60c000045280,0x60c0000452fc)
freed by thread T27 here:
#0 0x7f5d49df6527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
#1 0x563d33d7b371 in free_memory /data/src/10.4/mysys/safemalloc.c:279
#2 0x563d33d7a977 in sf_free /data/src/10.4/mysys/safemalloc.c:197
#3 0x563d33d4b3c0 in my_free /data/src/10.4/mysys/my_malloc.c:222
#4 0x563d321e56e5 in Binary_string::free() /data/src/10.4/sql/sql_string.h:604
#5 0x563d32679124 in Binary_string::real_alloc(unsigned long) /data/src/10.4/sql/sql_string.cc:43
#6 0x563d32204ce9 in Binary_string::alloc(unsigned long) /data/src/10.4/sql/sql_string.h:613
#7 0x563d32e7de9e in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1901
#8 0x563d32d5dbe8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760
#9 0x563d32c8146c in Item::save_int_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6492
#10 0x563d3293eed7 in Type_handler_int_result::Item_save_in_field(Item, Field, bool) const /data/src/10.4/sql/sql_type.cc:3587
#11 0x563d32c8164e in Item::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6502
#12 0x563d3233d08b in Item_result_field::save_in_result_field(bool) /data/src/10.4/sql/item.h:3167
#13 0x563d325c907a in copy_funcs(Item*, THD const) /data/src/10.4/sql/sql_select.cc:24998
#14 0x563d325b1073 in end_write /data/src/10.4/sql/sql_select.cc:21419
#15 0x563d325e056d in AGGR_OP::put_record(bool) /data/src/10.4/sql/sql_select.cc:28133
#16 0x563d325ed85a in AGGR_OP::put_record() (/data/bld/10.4-asan/bin/mysqld+0x115b85a)
#17 0x563d325a4d41 in sub_select_postjoin_aggr(JOIN, st_join_table, bool) /data/src/10.4/sql/sql_select.cc:19719
#18 0x563d325a6f58 in evaluate_join_record /data/src/10.4/sql/sql_select.cc:20219
#19 0x563d325a5b32 in sub_select(JOIN, st_join_table, bool) /data/src/10.4/sql/sql_select.cc:19999
#20 0x563d325a3e3d in do_select /data/src/10.4/sql/sql_select.cc:19537
#21 0x563d3253d254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360
#22 0x563d3253ab4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142
#23 0x563d3253e62c in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.4/sql/sql_select.cc:4574
#24 0x563d32514d0e in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423
#25 0x563d32495a49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604
#26 0x563d324825d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841
#27 0x563d3249e33c in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157
#28 0x563d32476545 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
#29 0x563d32473346 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358

previously allocated by thread T27 here:
#0 0x7f5d49df673f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x563d33d7a0e7 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118
#2 0x563d33d4a9e2 in my_malloc /data/src/10.4/mysys/my_malloc.c:101
#3 0x563d32679183 in Binary_string::real_alloc(unsigned long) /data/src/10.4/sql/sql_string.cc:46
#4 0x563d32204ce9 in Binary_string::alloc(unsigned long) /data/src/10.4/sql/sql_string.h:613
#5 0x563d3267a62b in Binary_string::copy(char const*, unsigned long) /data/src/10.4/sql/sql_string.cc:238
#6 0x563d321e5899 in String::copy(char const, unsigned long, charset_info_st const) /data/src/10.4/sql/sql_string.h:821
#7 0x563d32dd1c80 in Item_func_database::val_str(String*) /data/src/10.4/sql/item_strfunc.cc:2333
#8 0x563d32e828b6 in Item_char_typecast::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:2338
#9 0x563d32e7dc22 in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1885
#10 0x563d32d5dbe8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760
#11 0x563d32c8146c in Item::save_int_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6492
#12 0x563d3293eed7 in Type_handler_int_result::Item_save_in_field(Item, Field, bool) const /data/src/10.4/sql/sql_type.cc:3587
#13 0x563d32c8164e in Item::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6502
#14 0x563d3233d08b in Item_result_field::save_in_result_field(bool) /data/src/10.4/sql/item.h:3167
#15 0x563d325c907a in copy_funcs(Item*, THD const) /data/src/10.4/sql/sql_select.cc:24998
#16 0x563d325b1073 in end_write /data/src/10.4/sql/sql_select.cc:21419
#17 0x563d325e056d in AGGR_OP::put_record(bool) /data/src/10.4/sql/sql_select.cc:28133
#18 0x563d325ed85a in AGGR_OP::put_record() (/data/bld/10.4-asan/bin/mysqld+0x115b85a)
#19 0x563d325a4d41 in sub_select_postjoin_aggr(JOIN, st_join_table, bool) /data/src/10.4/sql/sql_select.cc:19719
#20 0x563d325a6f58 in evaluate_join_record /data/src/10.4/sql/sql_select.cc:20219
#21 0x563d325a5b32 in sub_select(JOIN, st_join_table, bool) /data/src/10.4/sql/sql_select.cc:19999
#22 0x563d325a3e3d in do_select /data/src/10.4/sql/sql_select.cc:19537
#23 0x563d3253d254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360
#24 0x563d3253ab4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142
#25 0x563d3253e62c in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.4/sql/sql_select.cc:4574
#26 0x563d32514d0e in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423
#27 0x563d32495a49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604
#28 0x563d324825d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841
#29 0x563d3249e33c in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157

Thread T27 created by T0 here:
#0 0x7f5d49dc5bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
#1 0x563d333cacdc in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912
#2 0x563d321c2866 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268
#3 0x563d321d8090 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6194
#4 0x563d321d8795 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6264
#5 0x563d321d8b25 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6362
#6 0x563d321d9771 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6520
#7 0x563d321d78cb in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5852
#8 0x563d321c06ef in main /data/src/10.4/sql/main.cc:25
#9 0x7f5d47eaa2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.4/sql/item_timefunc.cc:498 make_date_time
Shadow bytes around the buggy address:
0x0c1880000a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1880000a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1880000a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1880000a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1880000a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c1880000a50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
0x0c1880000a60: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c1880000a70: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
0x0c1880000a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
0x0c1880000a90: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c1880000aa0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==19984==ABORTING

CREATE TABLE t1 (d DATE) ENGINE=MyISAM;

INSERT INTO t1 VALUES ('1900-01-01');

SELECT LENGTH( DATE_FORMAT( d, BINARY DATABASE() ) ) AS f FROM t1 GROUP BY d;

# Cleanup

DROP TABLE t1;

==20270==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000028af0 at pc 0x56474ee05726 bp 0x7f1aebdcad40 sp 0x7f1aebdcad38

READ of size 1 at 0x60c000028af0 thread T5

    #0 0x56474ee05725 in make_date_time /data/src/10.4/sql/item_timefunc.cc:498

    #1 0x56474ee13fa0 in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1913

    #2 0x56474ecf3be8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760

    #3 0x56474ecdabfb in Item_int_func::val_str(String*) /data/src/10.4/sql/item_func.cc:753

    #4 0x56474ec0ab0a in Item_copy_string::copy() /data/src/10.4/sql/item.cc:4789

    #5 0x56474e55c54d in copy_fields(TMP_TABLE_PARAM*) /data/src/10.4/sql/sql_select.cc:24592

    #6 0x56474e546b0b in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:21391

    #7 0x56474e5397eb in do_select /data/src/10.4/sql/sql_select.cc:19494

    #8 0x56474e4d3254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360

    #9 0x56474e4d0b4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142

    #10 0x56474e4d462c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4574

    #11 0x56474e4aad0e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423

    #12 0x56474e42ba49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604

    #13 0x56474e4185d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841

    #14 0x56474e43433c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157

    #15 0x56474e40c545 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829

    #16 0x56474e409346 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358

    #17 0x56474e7982e9 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399

    #18 0x56474e797ce2 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302

    #19 0x56474f360714 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862

    #20 0x7f1af714c493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

    #21 0x7f1af553293e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x60c000028af0 is located 112 bytes inside of 124-byte region [0x60c000028a80,0x60c000028afc)

freed by thread T5 here:

    #0 0x7f1af73b6527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)

    #1 0x56474fd11371 in free_memory /data/src/10.4/mysys/safemalloc.c:279

    #2 0x56474fd10977 in sf_free /data/src/10.4/mysys/safemalloc.c:197

    #3 0x56474fce13c0 in my_free /data/src/10.4/mysys/my_malloc.c:222

    #4 0x56474e17b6e5 in Binary_string::free() /data/src/10.4/sql/sql_string.h:604

    #5 0x56474e60f124 in Binary_string::real_alloc(unsigned long) /data/src/10.4/sql/sql_string.cc:43

    #6 0x56474e19ace9 in Binary_string::alloc(unsigned long) /data/src/10.4/sql/sql_string.h:613

    #7 0x56474ee13e9e in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1901

    #8 0x56474ecf3be8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760

    #9 0x56474ecdabfb in Item_int_func::val_str(String*) /data/src/10.4/sql/item_func.cc:753

    #10 0x56474ec0ab0a in Item_copy_string::copy() /data/src/10.4/sql/item.cc:4789

    #11 0x56474e55c54d in copy_fields(TMP_TABLE_PARAM*) /data/src/10.4/sql/sql_select.cc:24592

    #12 0x56474e546b0b in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:21391

    #13 0x56474e5397eb in do_select /data/src/10.4/sql/sql_select.cc:19494

    #14 0x56474e4d3254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360

    #15 0x56474e4d0b4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142

    #16 0x56474e4d462c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4574

    #17 0x56474e4aad0e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423

    #18 0x56474e42ba49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604

    #19 0x56474e4185d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841

    #20 0x56474e43433c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157

    #21 0x56474e40c545 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829

    #22 0x56474e409346 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358

    #23 0x56474e7982e9 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399

    #24 0x56474e797ce2 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302

    #25 0x56474f360714 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862

    #26 0x7f1af714c493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

previously allocated by thread T5 here:

    #0 0x7f1af73b673f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)

    #1 0x56474fd100e7 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118

    #2 0x56474fce09e2 in my_malloc /data/src/10.4/mysys/my_malloc.c:101

    #3 0x56474e60f183 in Binary_string::real_alloc(unsigned long) /data/src/10.4/sql/sql_string.cc:46

    #4 0x56474e19ace9 in Binary_string::alloc(unsigned long) /data/src/10.4/sql/sql_string.h:613

    #5 0x56474e61062b in Binary_string::copy(char const*, unsigned long) /data/src/10.4/sql/sql_string.cc:238

    #6 0x56474e17b899 in String::copy(char const*, unsigned long, charset_info_st const*) /data/src/10.4/sql/sql_string.h:821

    #7 0x56474ed67c80 in Item_func_database::val_str(String*) /data/src/10.4/sql/item_strfunc.cc:2333

    #8 0x56474ee188b6 in Item_char_typecast::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:2338

    #9 0x56474ee13c22 in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1885

    #10 0x56474ecf3be8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760

    #11 0x56474ecdabfb in Item_int_func::val_str(String*) /data/src/10.4/sql/item_func.cc:753

    #12 0x56474ec0ab0a in Item_copy_string::copy() /data/src/10.4/sql/item.cc:4789

    #13 0x56474e55c54d in copy_fields(TMP_TABLE_PARAM*) /data/src/10.4/sql/sql_select.cc:24592

    #14 0x56474e546b0b in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:21391

    #15 0x56474e5397eb in do_select /data/src/10.4/sql/sql_select.cc:19494

    #16 0x56474e4d3254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360

    #17 0x56474e4d0b4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142

    #18 0x56474e4d462c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4574

    #19 0x56474e4aad0e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423

    #20 0x56474e42ba49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604

    #21 0x56474e4185d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841

    #22 0x56474e43433c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157

    #23 0x56474e40c545 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829

    #24 0x56474e409346 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358

    #25 0x56474e7982e9 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399

    #26 0x56474e797ce2 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302

    #27 0x56474f360714 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862

    #28 0x7f1af714c493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

Thread T5 created by T0 here:

    #0 0x7f1af7385bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)

    #1 0x56474f360cdc in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912

    #2 0x56474e158866 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268

    #3 0x56474e16e090 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6194

    #4 0x56474e16e795 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6264

    #5 0x56474e16eb25 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6362

    #6 0x56474e16f771 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6520

    #7 0x56474e16d8cb in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5852

    #8 0x56474e1566ef in main /data/src/10.4/sql/main.cc:25

    #9 0x7f1af546a2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.4/sql/item_timefunc.cc:498 make_date_time

Shadow bytes around the buggy address:

  0x0c187fffd100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c187fffd110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c187fffd120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c187fffd130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c187fffd140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

=>0x0c187fffd150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd

  0x0c187fffd160: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00

  0x0c187fffd170: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa

  0x0c187fffd180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c187fffd190: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c187fffd1a0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Contiguous container OOB:fc

  ASan internal:           fe

==20270==ABORTING

Elena Stepanova added a comment - 2019-02-22 17:33 More variations, more stack traces. --source include/have_innodb.inc CREATE TABLE t1 (d DATE ) ENGINE=InnoDB; INSERT INTO t1 VALUES ( '1900-01-01' ); SELECT LENGTH( DATE_FORMAT( d, BINARY DATABASE () ) ) AS f FROM t1 GROUP BY d; # Cleanup DROP TABLE t1; 10.4 ASAN 5b4d6595 ==19984==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000452f0 at pc 0x563d32e6f726 bp 0x7f5d3e1e0a50 sp 0x7f5d3e1e0a48 READ of size 1 at 0x60c0000452f0 thread T27 #0 0x563d32e6f725 in make_date_time /data/src/10.4/sql/item_timefunc.cc:498 #1 0x563d32e7dfa0 in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1913 #2 0x563d32d5dbe8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760 #3 0x563d32c8146c in Item::save_int_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6492 #4 0x563d3293eed7 in Type_handler_int_result::Item_save_in_field(Item*, Field*, bool) const /data/src/10.4/sql/sql_type.cc:3587 #5 0x563d32c8164e in Item::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6502 #6 0x563d3233d08b in Item_result_field::save_in_result_field(bool) /data/src/10.4/sql/item.h:3167 #7 0x563d325c907a in copy_funcs(Item**, THD const*) /data/src/10.4/sql/sql_select.cc:24998 #8 0x563d325b1073 in end_write /data/src/10.4/sql/sql_select.cc:21419 #9 0x563d325e056d in AGGR_OP::put_record(bool) /data/src/10.4/sql/sql_select.cc:28133 #10 0x563d325ed85a in AGGR_OP::put_record() (/data/bld/10.4-asan/bin/mysqld+0x115b85a) #11 0x563d325a4d41 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:19719 #12 0x563d325a6f58 in evaluate_join_record /data/src/10.4/sql/sql_select.cc:20219 #13 0x563d325a5b32 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:19999 #14 0x563d325a3e3d in do_select /data/src/10.4/sql/sql_select.cc:19537 #15 0x563d3253d254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360 #16 0x563d3253ab4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142 #17 0x563d3253e62c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4574 #18 0x563d32514d0e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423 #19 0x563d32495a49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604 #20 0x563d324825d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841 #21 0x563d3249e33c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157 #22 0x563d32476545 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829 #23 0x563d32473346 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358 #24 0x563d328022e9 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399 #25 0x563d32801ce2 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302 #26 0x563d333ca714 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862 #27 0x7f5d49b8c493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493) #28 0x7f5d47f7293e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e) 0x60c0000452f0 is located 112 bytes inside of 124-byte region [0x60c000045280,0x60c0000452fc) freed by thread T27 here: #0 0x7f5d49df6527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527) #1 0x563d33d7b371 in free_memory /data/src/10.4/mysys/safemalloc.c:279 #2 0x563d33d7a977 in sf_free /data/src/10.4/mysys/safemalloc.c:197 #3 0x563d33d4b3c0 in my_free /data/src/10.4/mysys/my_malloc.c:222 #4 0x563d321e56e5 in Binary_string::free() /data/src/10.4/sql/sql_string.h:604 #5 0x563d32679124 in Binary_string::real_alloc(unsigned long) /data/src/10.4/sql/sql_string.cc:43 #6 0x563d32204ce9 in Binary_string::alloc(unsigned long) /data/src/10.4/sql/sql_string.h:613 #7 0x563d32e7de9e in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1901 #8 0x563d32d5dbe8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760 #9 0x563d32c8146c in Item::save_int_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6492 #10 0x563d3293eed7 in Type_handler_int_result::Item_save_in_field(Item*, Field*, bool) const /data/src/10.4/sql/sql_type.cc:3587 #11 0x563d32c8164e in Item::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6502 #12 0x563d3233d08b in Item_result_field::save_in_result_field(bool) /data/src/10.4/sql/item.h:3167 #13 0x563d325c907a in copy_funcs(Item**, THD const*) /data/src/10.4/sql/sql_select.cc:24998 #14 0x563d325b1073 in end_write /data/src/10.4/sql/sql_select.cc:21419 #15 0x563d325e056d in AGGR_OP::put_record(bool) /data/src/10.4/sql/sql_select.cc:28133 #16 0x563d325ed85a in AGGR_OP::put_record() (/data/bld/10.4-asan/bin/mysqld+0x115b85a) #17 0x563d325a4d41 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:19719 #18 0x563d325a6f58 in evaluate_join_record /data/src/10.4/sql/sql_select.cc:20219 #19 0x563d325a5b32 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:19999 #20 0x563d325a3e3d in do_select /data/src/10.4/sql/sql_select.cc:19537 #21 0x563d3253d254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360 #22 0x563d3253ab4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142 #23 0x563d3253e62c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4574 #24 0x563d32514d0e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423 #25 0x563d32495a49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604 #26 0x563d324825d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841 #27 0x563d3249e33c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157 #28 0x563d32476545 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829 #29 0x563d32473346 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358 previously allocated by thread T27 here: #0 0x7f5d49df673f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f) #1 0x563d33d7a0e7 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118 #2 0x563d33d4a9e2 in my_malloc /data/src/10.4/mysys/my_malloc.c:101 #3 0x563d32679183 in Binary_string::real_alloc(unsigned long) /data/src/10.4/sql/sql_string.cc:46 #4 0x563d32204ce9 in Binary_string::alloc(unsigned long) /data/src/10.4/sql/sql_string.h:613 #5 0x563d3267a62b in Binary_string::copy(char const*, unsigned long) /data/src/10.4/sql/sql_string.cc:238 #6 0x563d321e5899 in String::copy(char const*, unsigned long, charset_info_st const*) /data/src/10.4/sql/sql_string.h:821 #7 0x563d32dd1c80 in Item_func_database::val_str(String*) /data/src/10.4/sql/item_strfunc.cc:2333 #8 0x563d32e828b6 in Item_char_typecast::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:2338 #9 0x563d32e7dc22 in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1885 #10 0x563d32d5dbe8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760 #11 0x563d32c8146c in Item::save_int_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6492 #12 0x563d3293eed7 in Type_handler_int_result::Item_save_in_field(Item*, Field*, bool) const /data/src/10.4/sql/sql_type.cc:3587 #13 0x563d32c8164e in Item::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6502 #14 0x563d3233d08b in Item_result_field::save_in_result_field(bool) /data/src/10.4/sql/item.h:3167 #15 0x563d325c907a in copy_funcs(Item**, THD const*) /data/src/10.4/sql/sql_select.cc:24998 #16 0x563d325b1073 in end_write /data/src/10.4/sql/sql_select.cc:21419 #17 0x563d325e056d in AGGR_OP::put_record(bool) /data/src/10.4/sql/sql_select.cc:28133 #18 0x563d325ed85a in AGGR_OP::put_record() (/data/bld/10.4-asan/bin/mysqld+0x115b85a) #19 0x563d325a4d41 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:19719 #20 0x563d325a6f58 in evaluate_join_record /data/src/10.4/sql/sql_select.cc:20219 #21 0x563d325a5b32 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:19999 #22 0x563d325a3e3d in do_select /data/src/10.4/sql/sql_select.cc:19537 #23 0x563d3253d254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360 #24 0x563d3253ab4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142 #25 0x563d3253e62c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4574 #26 0x563d32514d0e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423 #27 0x563d32495a49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604 #28 0x563d324825d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841 #29 0x563d3249e33c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157 Thread T27 created by T0 here: #0 0x7f5d49dc5bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba) #1 0x563d333cacdc in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912 #2 0x563d321c2866 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268 #3 0x563d321d8090 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6194 #4 0x563d321d8795 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6264 #5 0x563d321d8b25 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6362 #6 0x563d321d9771 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6520 #7 0x563d321d78cb in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5852 #8 0x563d321c06ef in main /data/src/10.4/sql/main.cc:25 #9 0x7f5d47eaa2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0) SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.4/sql/item_timefunc.cc:498 make_date_time Shadow bytes around the buggy address: 0x0c1880000a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1880000a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1880000a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1880000a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1880000a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c1880000a50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd 0x0c1880000a60: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c1880000a70: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa 0x0c1880000a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 0x0c1880000a90: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c1880000aa0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==19984==ABORTING CREATE TABLE t1 (d DATE ) ENGINE=MyISAM; INSERT INTO t1 VALUES ( '1900-01-01' ); SELECT LENGTH( DATE_FORMAT( d, BINARY DATABASE () ) ) AS f FROM t1 GROUP BY d; # Cleanup DROP TABLE t1; ==20270==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000028af0 at pc 0x56474ee05726 bp 0x7f1aebdcad40 sp 0x7f1aebdcad38 READ of size 1 at 0x60c000028af0 thread T5 #0 0x56474ee05725 in make_date_time /data/src/10.4/sql/item_timefunc.cc:498 #1 0x56474ee13fa0 in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1913 #2 0x56474ecf3be8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760 #3 0x56474ecdabfb in Item_int_func::val_str(String*) /data/src/10.4/sql/item_func.cc:753 #4 0x56474ec0ab0a in Item_copy_string::copy() /data/src/10.4/sql/item.cc:4789 #5 0x56474e55c54d in copy_fields(TMP_TABLE_PARAM*) /data/src/10.4/sql/sql_select.cc:24592 #6 0x56474e546b0b in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:21391 #7 0x56474e5397eb in do_select /data/src/10.4/sql/sql_select.cc:19494 #8 0x56474e4d3254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360 #9 0x56474e4d0b4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142 #10 0x56474e4d462c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4574 #11 0x56474e4aad0e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423 #12 0x56474e42ba49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604 #13 0x56474e4185d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841 #14 0x56474e43433c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157 #15 0x56474e40c545 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829 #16 0x56474e409346 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358 #17 0x56474e7982e9 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399 #18 0x56474e797ce2 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302 #19 0x56474f360714 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862 #20 0x7f1af714c493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493) #21 0x7f1af553293e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e) 0x60c000028af0 is located 112 bytes inside of 124-byte region [0x60c000028a80,0x60c000028afc) freed by thread T5 here: #0 0x7f1af73b6527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527) #1 0x56474fd11371 in free_memory /data/src/10.4/mysys/safemalloc.c:279 #2 0x56474fd10977 in sf_free /data/src/10.4/mysys/safemalloc.c:197 #3 0x56474fce13c0 in my_free /data/src/10.4/mysys/my_malloc.c:222 #4 0x56474e17b6e5 in Binary_string::free() /data/src/10.4/sql/sql_string.h:604 #5 0x56474e60f124 in Binary_string::real_alloc(unsigned long) /data/src/10.4/sql/sql_string.cc:43 #6 0x56474e19ace9 in Binary_string::alloc(unsigned long) /data/src/10.4/sql/sql_string.h:613 #7 0x56474ee13e9e in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1901 #8 0x56474ecf3be8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760 #9 0x56474ecdabfb in Item_int_func::val_str(String*) /data/src/10.4/sql/item_func.cc:753 #10 0x56474ec0ab0a in Item_copy_string::copy() /data/src/10.4/sql/item.cc:4789 #11 0x56474e55c54d in copy_fields(TMP_TABLE_PARAM*) /data/src/10.4/sql/sql_select.cc:24592 #12 0x56474e546b0b in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:21391 #13 0x56474e5397eb in do_select /data/src/10.4/sql/sql_select.cc:19494 #14 0x56474e4d3254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360 #15 0x56474e4d0b4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142 #16 0x56474e4d462c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4574 #17 0x56474e4aad0e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423 #18 0x56474e42ba49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604 #19 0x56474e4185d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841 #20 0x56474e43433c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157 #21 0x56474e40c545 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829 #22 0x56474e409346 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358 #23 0x56474e7982e9 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399 #24 0x56474e797ce2 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302 #25 0x56474f360714 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862 #26 0x7f1af714c493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493) previously allocated by thread T5 here: #0 0x7f1af73b673f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f) #1 0x56474fd100e7 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118 #2 0x56474fce09e2 in my_malloc /data/src/10.4/mysys/my_malloc.c:101 #3 0x56474e60f183 in Binary_string::real_alloc(unsigned long) /data/src/10.4/sql/sql_string.cc:46 #4 0x56474e19ace9 in Binary_string::alloc(unsigned long) /data/src/10.4/sql/sql_string.h:613 #5 0x56474e61062b in Binary_string::copy(char const*, unsigned long) /data/src/10.4/sql/sql_string.cc:238 #6 0x56474e17b899 in String::copy(char const*, unsigned long, charset_info_st const*) /data/src/10.4/sql/sql_string.h:821 #7 0x56474ed67c80 in Item_func_database::val_str(String*) /data/src/10.4/sql/item_strfunc.cc:2333 #8 0x56474ee188b6 in Item_char_typecast::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:2338 #9 0x56474ee13c22 in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1885 #10 0x56474ecf3be8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760 #11 0x56474ecdabfb in Item_int_func::val_str(String*) /data/src/10.4/sql/item_func.cc:753 #12 0x56474ec0ab0a in Item_copy_string::copy() /data/src/10.4/sql/item.cc:4789 #13 0x56474e55c54d in copy_fields(TMP_TABLE_PARAM*) /data/src/10.4/sql/sql_select.cc:24592 #14 0x56474e546b0b in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:21391 #15 0x56474e5397eb in do_select /data/src/10.4/sql/sql_select.cc:19494 #16 0x56474e4d3254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360 #17 0x56474e4d0b4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142 #18 0x56474e4d462c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4574 #19 0x56474e4aad0e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423 #20 0x56474e42ba49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604 #21 0x56474e4185d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841 #22 0x56474e43433c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157 #23 0x56474e40c545 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829 #24 0x56474e409346 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358 #25 0x56474e7982e9 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399 #26 0x56474e797ce2 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302 #27 0x56474f360714 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862 #28 0x7f1af714c493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493) Thread T5 created by T0 here: #0 0x7f1af7385bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba) #1 0x56474f360cdc in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912 #2 0x56474e158866 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268 #3 0x56474e16e090 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6194 #4 0x56474e16e795 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6264 #5 0x56474e16eb25 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6362 #6 0x56474e16f771 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6520 #7 0x56474e16d8cb in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5852 #8 0x56474e1566ef in main /data/src/10.4/sql/main.cc:25 #9 0x7f1af546a2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0) SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.4/sql/item_timefunc.cc:498 make_date_time Shadow bytes around the buggy address: 0x0c187fffd100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c187fffd110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c187fffd120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c187fffd130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c187fffd140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c187fffd150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd 0x0c187fffd160: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c187fffd170: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa 0x0c187fffd180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c187fffd190: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c187fffd1a0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==20270==ABORTING

People

Assignee:: Alexander Barkov

Reporter:: Elena Stepanova

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2018-01-11 17:47

Updated:: 2019-04-03 19:01

Resolved:: 2019-03-14 06:09

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server