Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-16552

[10.0] ASAN global-buffer-overflow in is_stat_table / statistics_for_tables_is_needed

    XMLWordPrintable

Details

    Description

      SET use_stat_tables = PREFERABLY;
      SELECT CONVERT_TZ( '1991-09-20 10:11:02', '+00:00', 'GMT' );
      

      10.0 6c08ff3eb711

      ==5647==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000001a77180 at pc 0x849ded bp 0x7f7eeb2a26f0 sp 0x7f7eeb2a26e8
      READ of size 11 at 0x000001a77180 thread T5
          #0 0x849dec in is_stat_table(char const*, char const*) /data/src/10.0/sql/sql_statistics.cc:3865
          #1 0x84a2fa in statistics_for_tables_is_needed /data/src/10.0/sql/sql_statistics.cc:2960
          #2 0x84a2fa in read_statistics_for_tables_if_needed(THD*, TABLE_LIST*) /data/src/10.0/sql/sql_statistics.cc:3085
          #3 0x606585 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.0/sql/sql_base.cc:5255
          #4 0x60767d in open_and_lock_tables /data/src/10.0/sql/sql_base.h:496
          #5 0x60767d in open_system_tables_for_read(THD*, TABLE_LIST*, Open_tables_backup*) /data/src/10.0/sql/sql_base.cc:9261
          #6 0x908fa6 in my_tz_find(THD*, String const*) /data/src/10.0/sql/tztime.cc:2345
          #7 0xd8935c in Item_func_convert_tz::get_date(st_mysql_time*, unsigned long long) /data/src/10.0/sql/item_timefunc.cc:2039
          #8 0xb993f1 in Item::send(Protocol*, String*) /data/src/10.0/sql/item.cc:6681
          #9 0x547841 in Protocol::send_result_set_row(List<Item>*) /data/src/10.0/sql/protocol.cc:912
          #10 0x64479a in select_send::send_data(List<Item>&) /data/src/10.0/sql/sql_class.cc:2486
          #11 0x7d8147 in JOIN::exec_inner() /data/src/10.0/sql/sql_select.cc:2488
          #12 0x7e0f3b in JOIN::exec() /data/src/10.0/sql/sql_select.cc:2402
          #13 0x7d609e in mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.0/sql/sql_select.cc:3341
          #14 0x7d66ce in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.0/sql/sql_select.cc:377
          #15 0x6b650d in execute_sqlcom_select /data/src/10.0/sql/sql_parse.cc:5298
          #16 0x6ce3ae in mysql_execute_command(THD*) /data/src/10.0/sql/sql_parse.cc:2554
          #17 0x6e440c in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.0/sql/sql_parse.cc:6634
          #18 0x6e802b in dispatch_command(enum_server_command, THD*, char*, unsigned int) /data/src/10.0/sql/sql_parse.cc:1297
          #19 0x6ec924 in do_command(THD*) /data/src/10.0/sql/sql_parse.cc:1000
          #20 0x97b62f in do_handle_one_connection(THD*) /data/src/10.0/sql/sql_connect.cc:1377
          #21 0x97b896 in handle_one_connection /data/src/10.0/sql/sql_connect.cc:1292
          #22 0x11b76f4 in pfs_spawn_thread /data/src/10.0/storage/perfschema/pfs.cc:1861
          #23 0x7f7ef58c9493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
          #24 0x7f7ef3c8293e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
       
      0x000001a7718a is located 0 bytes to the right of global variable '*.LC61' from '/data/src/10.0/sql/tztime.cc' (0x1a77180) of size 10
        '*.LC61' is ascii string 'time_zone'
      SUMMARY: AddressSanitizer: global-buffer-overflow /data/src/10.0/sql/sql_statistics.cc:3865 is_stat_table(char const*, char const*)
      Shadow bytes around the buggy address:
        0x000080346de0: 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 f9
        0x000080346df0: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
        0x000080346e00: 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 06 f9
        0x000080346e10: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
        0x000080346e20: 00 00 01 f9 f9 f9 f9 f9 00 07 f9 f9 f9 f9 f9 f9
      =>0x000080346e30:[00]02 f9 f9 f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9
        0x000080346e40: 00 00 05 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
        0x000080346e50: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
        0x000080346e60: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
        0x000080346e70: 00 f9 f9 f9 f9 f9 f9 f9 03 f9 f9 f9 f9 f9 f9 f9
        0x000080346e80: 05 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 02 f9 f9 f9
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Contiguous container OOB:fc
        ASan internal:           fe
      Thread T5 created by T0 here:
          #0 0x7f7ef5b02bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
          #1 0x11c2f4b in spawn_thread_v1 /data/src/10.0/storage/perfschema/pfs.cc:1911
      

      The problem appeared in 10.0 tree after this commit:

      commit 10f6b7001bd7b683c013ae407c2c48793caa3633
      Author: Varun Gupta <varunraiko1803@gmail.com>
      Date:   Mon Apr 2 13:14:30 2018 +0300
       
          MDEV-9744: session optimizer_use_condition_selectivity=5 causing SQL Error (1918):
                     Encountered illegal value '' when converting to DECIMAL
      

      Reproducible on 10.0 and 10.1. On some reason, couldn't reproduce on 10.2 and 10.3.

      Attachments

        Activity

          People

            varun Varun Gupta (Inactive)
            elenst Elena Stepanova
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.