#0 0x7fae663e8675 in memcmp (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x77675)

    #1 0x557be63069d8 in my_strnncoll_binary /10.4/strings/ctype-bin.c:85

    #2 0x557be6306a5b in my_strnncollsp_binary /10.4/strings/ctype-bin.c:124

    #3 0x557be5196a20 in Field_blob::cmp(unsigned char const*, unsigned int, unsigned char const*, unsigned int) /10.4/sql/field.cc:8385

    #4 0x557be5196cc8 in Field_blob::cmp_max(unsigned char const*, unsigned char const*, unsigned int) /10.4/sql/field.cc:8398

    #5 0x557be51bd091 in Field_blob::cmp(unsigned char const*, unsigned char const*) /10.4/sql/field.h:3855

    #6 0x557be54224bc in group_concat_key_cmp_with_order /10.4/sql/item_sum.cc:3516

    #7 0x557be62b4dec in tree_insert /10.4/mysys/tree.c:250

    #8 0x557be54261ca in Item_func_group_concat::add() /10.4/sql/item_sum.cc:3871

    #9 0x557be542a667 in Aggregator_simple::add() /10.4/sql/item_sum.h:715

    #10 0x557be4bd7fcb in Item_sum::aggregator_add() /10.4/sql/item_sum.h:558

    #11 0x557be4bbaffc in update_sum_func /10.4/sql/sql_select.cc:24658

    #12 0x557be4ba37a6 in end_send_group(JOIN*, st_join_table*, bool) /10.4/sql/sql_select.cc:21096

    #13 0x557be4b9a2b3 in evaluate_join_record /10.4/sql/sql_select.cc:19919

    #14 0x557be4bd1fee in AGGR_OP::end_send() /10.4/sql/sql_select.cc:27900

    #15 0x557be4b98088 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /10.4/sql/sql_select.cc:19415

    #16 0x557be4b987e4 in sub_select(JOIN*, st_join_table*, bool) /10.4/sql/sql_select.cc:19650

    #17 0x557be4b98348 in sub_select_cache(JOIN*, st_join_table*, bool) /10.4/sql/sql_select.cc:19482

    #18 0x557be4b987e4 in sub_select(JOIN*, st_join_table*, bool) /10.4/sql/sql_select.cc:19650

    #19 0x557be4b97458 in do_select /10.4/sql/sql_select.cc:19241

    #20 0x557be4b33fe1 in JOIN::exec_inner() /10.4/sql/sql_select.cc:4169

    #21 0x557be4b3195b in JOIN::exec() /10.4/sql/sql_select.cc:3951

    #22 0x557be4b3539d in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/sql/sql_select.cc:4383

    #23 0x557be4b0e8a9 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/sql/sql_select.cc:424

    #24 0x557be4a93820 in execute_sqlcom_select /10.4/sql/sql_parse.cc:6576

    #25 0x557be4a80617 in mysql_execute_command(THD*) /10.4/sql/sql_parse.cc:3813

    #26 0x557be4a9bd01 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/sql/sql_parse.cc:8129

    #27 0x557be4a748d2 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/sql/sql_parse.cc:1808

    #28 0x557be4a71a60 in do_command(THD*) /10.4/sql/sql_parse.cc:1358

    #29 0x557be4dd752b in do_handle_one_connection(CONNECT*) /10.4/sql/sql_connect.cc:1399

    #30 0x557be4dd6ef5 in handle_one_connection /10.4/sql/sql_connect.cc:1302

    #31 0x7fae651936b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

    #32 0x7fae6442441c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)

CREATE TABLE t1 (f TEXT COMPRESSED);

INSERT INTO t1 VALUES ('foo'),(REPEAT('a',55000));

SELECT GROUP_CONCAT(f ORDER BY 1) FROM t1;

# Cleanup

DROP TABLE t1;

==2920715==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c00000ca70 at pc 0x5568ad2aa05a bp 0x7fbe5811d790 sp 0x7fbe5811d780

READ of size 1 at 0x60c00000ca70 thread T5

    #0 0x5568ad2aa059 in my_strnncollsp_simple /data/src/10.3/strings/ctype-simple.c:182

    #1 0x5568abd9b7ce in Field_blob::cmp(unsigned char const*, unsigned int, unsigned char const*, unsigned int) /data/src/10.3/sql/field.cc:8523

    #2 0x5568abd9bad7 in Field_blob::cmp(unsigned char const*, unsigned char const*) /data/src/10.3/sql/field.cc:8534

    #3 0x5568ac05d242 in group_concat_key_cmp_with_order /data/src/10.3/sql/item_sum.cc:3587

    #4 0x5568ad237714 in tree_insert /data/src/10.3/mysys/tree.c:249

    #5 0x5568ac062265 in Item_func_group_concat::add() /data/src/10.3/sql/item_sum.cc:4021

    #6 0x5568ac066d8b in Aggregator_simple::add() /data/src/10.3/sql/item_sum.h:707

    #7 0x5568ab7ff789 in Item_sum::aggregator_add() (/data/bld/10.3-asan-nightly/bin/mysqld+0x11db789)

    #8 0x5568ab7e1522 in update_sum_func /data/src/10.3/sql/sql_select.cc:24752

    #9 0x5568ab7c6643 in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.3/sql/sql_select.cc:21107

    #10 0x5568ab7bc90f in evaluate_join_record /data/src/10.3/sql/sql_select.cc:19934

    #11 0x5568ab7bb945 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.3/sql/sql_select.cc:19753

    #12 0x5568ab7b9497 in do_select /data/src/10.3/sql/sql_select.cc:19254

    #13 0x5568ab74d216 in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4116

    #14 0x5568ab74ab93 in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3910

    #15 0x5568ab74e5de in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4315

    #16 0x5568ab7253e4 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:370

    #17 0x5568ab698180 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6286

    #18 0x5568ab685b31 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3812

    #19 0x5568ab6a1e2c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7810

    #20 0x5568ab678e98 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1847

    #21 0x5568ab6759ec in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1393

    #22 0x5568aba3b494 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403

    #23 0x5568aba3ad4e in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #24 0x5568ad034578 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869

    #25 0x7fbe62fcf608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477

    #26 0x7fbe62bab292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x60c00000ca70 is located 112 bytes inside of 124-byte region [0x60c00000ca00,0x60c00000ca7c)

freed by thread T5 here:

    #0 0x7fbe631cd7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)

    #1 0x5568ad245de3 in free_memory /data/src/10.3/mysys/safemalloc.c:279

    #2 0x5568ad2453b0 in sf_free /data/src/10.3/mysys/safemalloc.c:197

    #3 0x5568ad213aad in my_free /data/src/10.3/mysys/my_malloc.c:223

    #4 0x5568ab3cab61 in String::free() /data/src/10.3/sql/sql_string.h:351

    #5 0x5568ab8928ee in String::real_alloc(unsigned long) /data/src/10.3/sql/sql_string.cc:43

    #6 0x5568ab3f5e41 in String::alloc(unsigned long) /data/src/10.3/sql/sql_string.h:361

    #7 0x5568abd9ef6e in Field_blob_compressed::store(char const*, unsigned long, charset_info_st const*) /data/src/10.3/sql/field.cc:8872

    #8 0x5568abdce7b0 in do_save_blob /data/src/10.3/sql/field_conv.cc:359

    #9 0x5568abdcd734 in do_copy_null /data/src/10.3/sql/field_conv.cc:246

    #10 0x5568ab7de417 in copy_fields(TMP_TABLE_PARAM*) /data/src/10.3/sql/sql_select.cc:24370

    #11 0x5568ac0617b1 in Item_func_group_concat::add() /data/src/10.3/sql/item_sum.cc:3977

    #12 0x5568ac066d8b in Aggregator_simple::add() /data/src/10.3/sql/item_sum.h:707

    #13 0x5568ab7ff789 in Item_sum::aggregator_add() (/data/bld/10.3-asan-nightly/bin/mysqld+0x11db789)

    #14 0x5568ab7e1522 in update_sum_func /data/src/10.3/sql/sql_select.cc:24752

    #15 0x5568ab7c6643 in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.3/sql/sql_select.cc:21107

    #16 0x5568ab7bc90f in evaluate_join_record /data/src/10.3/sql/sql_select.cc:19934

    #17 0x5568ab7bb945 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.3/sql/sql_select.cc:19753

    #18 0x5568ab7b9497 in do_select /data/src/10.3/sql/sql_select.cc:19254

    #19 0x5568ab74d216 in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4116

    #20 0x5568ab74ab93 in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3910

    #21 0x5568ab74e5de in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4315

    #22 0x5568ab7253e4 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:370

    #23 0x5568ab698180 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6286

    #24 0x5568ab685b31 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3812

    #25 0x5568ab6a1e2c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7810

    #26 0x5568ab678e98 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1847

    #27 0x5568ab6759ec in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1393

    #28 0x5568aba3b494 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403

    #29 0x5568aba3ad4e in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

previously allocated by thread T5 here:

    #0 0x7fbe631cdbc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)

    #1 0x5568ad244d74 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118

    #2 0x5568ad212fcb in my_malloc /data/src/10.3/mysys/my_malloc.c:101

    #3 0x5568ab89294d in String::real_alloc(unsigned long) /data/src/10.3/sql/sql_string.cc:44

    #4 0x5568ab3f5e41 in String::alloc(unsigned long) /data/src/10.3/sql/sql_string.h:361

    #5 0x5568abd9ef6e in Field_blob_compressed::store(char const*, unsigned long, charset_info_st const*) /data/src/10.3/sql/field.cc:8872

    #6 0x5568abdce7b0 in do_save_blob /data/src/10.3/sql/field_conv.cc:359

    #7 0x5568abdcd734 in do_copy_null /data/src/10.3/sql/field_conv.cc:246

    #8 0x5568ab7de417 in copy_fields(TMP_TABLE_PARAM*) /data/src/10.3/sql/sql_select.cc:24370

    #9 0x5568ac0617b1 in Item_func_group_concat::add() /data/src/10.3/sql/item_sum.cc:3977

    #10 0x5568ac066d8b in Aggregator_simple::add() /data/src/10.3/sql/item_sum.h:707

    #11 0x5568ab7ff789 in Item_sum::aggregator_add() (/data/bld/10.3-asan-nightly/bin/mysqld+0x11db789)

    #12 0x5568ab7ff3ff in Item_sum::reset_and_add() /data/src/10.3/sql/item_sum.h:441

    #13 0x5568ab7e1467 in init_sum_functions /data/src/10.3/sql/sql_select.cc:24734

    #14 0x5568ab7c6463 in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.3/sql/sql_select.cc:21099

    #15 0x5568ab7bc90f in evaluate_join_record /data/src/10.3/sql/sql_select.cc:19934

    #16 0x5568ab7bb2c2 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.3/sql/sql_select.cc:19714

    #17 0x5568ab7b9497 in do_select /data/src/10.3/sql/sql_select.cc:19254

    #18 0x5568ab74d216 in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4116

    #19 0x5568ab74ab93 in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3910

    #20 0x5568ab74e5de in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4315

    #21 0x5568ab7253e4 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:370

    #22 0x5568ab698180 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6286

    #23 0x5568ab685b31 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3812

    #24 0x5568ab6a1e2c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7810

    #25 0x5568ab678e98 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1847

    #26 0x5568ab6759ec in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1393

    #27 0x5568aba3b494 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403

    #28 0x5568aba3ad4e in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #29 0x5568ad034578 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869

Thread T5 created by T0 here:

    #0 0x7fbe630fa805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)

    #1 0x5568ad034969 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919

    #2 0x5568ab3a4252 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275

    #3 0x5568ab3bca32 in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6609

    #4 0x5568ab3bd1c3 in create_new_thread /data/src/10.3/sql/mysqld.cc:6679

    #5 0x5568ab3be34e in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6937

    #6 0x5568ab3bbd44 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6231

    #7 0x5568ab3a2a7c in main /data/src/10.3/sql/main.cc:25

    #8 0x7fbe62ab00b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/strings/ctype-simple.c:182 in my_strnncollsp_simple

Shadow bytes around the buggy address:

  0x0c187fff98f0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c187fff9900: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa

  0x0c187fff9910: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04

  0x0c187fff9920: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c187fff9930: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa

=>0x0c187fff9940: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd

  0x0c187fff9950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c187fff9960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c187fff9970: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c187fff9980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c187fff9990: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==2920715==ABORTING

query 'SELECT GROUP_CONCAT(f ORDER BY 1) FROM t1' failed: 1259: ZLIB: Input data corrupted

CREATE TABLE t1 (f TEXT COMPRESSED) CHARACTER SET utf8mb4 COLLATE utf8mb4_hungarian_ci;

INSERT INTO t1 VALUES ('foo'),(REPEAT('a',55000));

SELECT GROUP_CONCAT(f ORDER BY 1) FROM t1;

# Cleanup

DROP TABLE t1;

==1957001==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000042910 at pc 0x55a829faa476 bp 0x7fd62bb9c310 sp 0x7fd62bb9c300

READ of size 1 at 0x60d000042910 thread T5

    #0 0x55a829faa475 in my_uca_scanner_next_no_contractions_utf8mb4 /data/src/10.4/strings/ctype-uca.ic:60

    #1 0x55a829fab3fa in my_uca_strnncollsp_onelevel_no_contractions_utf8mb4 /data/src/10.4/strings/ctype-uca.ic:306

    #2 0x55a829fab619 in my_uca_strnncollsp_no_contractions_utf8mb4 /data/src/10.4/strings/ctype-uca.ic:352

    #3 0x55a828add708 in Field_blob::cmp(unsigned char const*, unsigned int, unsigned char const*, unsigned int) /data/src/10.4/sql/field.cc:8632

    #4 0x55a828adda11 in Field_blob::cmp(unsigned char const*, unsigned char const*) /data/src/10.4/sql/field.cc:8643

    #5 0x55a828db9d98 in group_concat_key_cmp_with_order /data/src/10.4/sql/item_sum.cc:3599

    #6 0x55a829f109a7 in tree_insert /data/src/10.4/mysys/tree.c:249

    #7 0x55a828dbee48 in Item_func_group_concat::add() /data/src/10.4/sql/item_sum.cc:4034

    #8 0x55a828dc3fe7 in Aggregator_simple::add() /data/src/10.4/sql/item_sum.h:716

    #9 0x55a8284bec4d in Item_sum::aggregator_add() /data/src/10.4/sql/item_sum.h:558

    #10 0x55a82849d3e5 in update_sum_func /data/src/10.4/sql/sql_select.cc:25468

    #11 0x55a828481e5a in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:21807

    #12 0x55a828477f77 in evaluate_join_record /data/src/10.4/sql/sql_select.cc:20625

    #13 0x55a828476fa3 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:20444

    #14 0x55a828474ae7 in do_select /data/src/10.4/sql/sql_select.cc:19943

    #15 0x55a82840482c in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4486

    #16 0x55a828401e39 in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4268

    #17 0x55a828405fac in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4703

    #18 0x55a8283d7475 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:410

    #19 0x55a828346faa in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6417

    #20 0x55a828334741 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3936

    #21 0x55a828350442 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7958

    #22 0x55a828327033 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1855

    #23 0x55a828323ae2 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1373

    #24 0x55a828715eb1 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412

    #25 0x55a828715755 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316

    #26 0x55a829dcf9bc in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869

    #27 0x7fd635bdc608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477

    #28 0x7fd635445292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x60d000042910 is located 112 bytes inside of 132-byte region [0x60d0000428a0,0x60d000042924)

freed by thread T5 here:

    #0 0x7fd635dd27cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)

    #1 0x55a829f1f176 in free_memory /data/src/10.4/mysys/safemalloc.c:279

    #2 0x55a829f1e732 in sf_free /data/src/10.4/mysys/safemalloc.c:197

    #3 0x55a829eeca1d in my_free /data/src/10.4/mysys/my_malloc.c:222

    #4 0x55a828051933 in Binary_string::free() /data/src/10.4/sql/sql_string.h:610

    #5 0x55a82855b2a2 in Binary_string::real_alloc(unsigned long) /data/src/10.4/sql/sql_string.cc:43

    #6 0x55a828076a2b in Binary_string::alloc(unsigned long) /data/src/10.4/sql/sql_string.h:619

    #7 0x55a828ae0ba1 in Field_blob_compressed::store(char const*, unsigned long, charset_info_st const*) /data/src/10.4/sql/field.cc:9011

    #8 0x55a828b12346 in do_save_blob /data/src/10.4/sql/field_conv.cc:359

    #9 0x55a828b112ca in do_copy_null /data/src/10.4/sql/field_conv.cc:246

    #10 0x55a82849a27b in copy_fields(TMP_TABLE_PARAM*) /data/src/10.4/sql/sql_select.cc:25086

    #11 0x55a828dbe37d in Item_func_group_concat::add() /data/src/10.4/sql/item_sum.cc:3990

    #12 0x55a828dc3fe7 in Aggregator_simple::add() /data/src/10.4/sql/item_sum.h:716

    #13 0x55a8284bec4d in Item_sum::aggregator_add() /data/src/10.4/sql/item_sum.h:558

    #14 0x55a82849d3e5 in update_sum_func /data/src/10.4/sql/sql_select.cc:25468

    #15 0x55a828481e5a in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:21807

    #16 0x55a828477f77 in evaluate_join_record /data/src/10.4/sql/sql_select.cc:20625

    #17 0x55a828476fa3 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:20444

    #18 0x55a828474ae7 in do_select /data/src/10.4/sql/sql_select.cc:19943

    #19 0x55a82840482c in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4486

    #20 0x55a828401e39 in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4268

    #21 0x55a828405fac in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4703

    #22 0x55a8283d7475 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:410

    #23 0x55a828346faa in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6417

    #24 0x55a828334741 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3936

    #25 0x55a828350442 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7958

    #26 0x55a828327033 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1855

    #27 0x55a828323ae2 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1373

    #28 0x55a828715eb1 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412

    #29 0x55a828715755 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316

previously allocated by thread T5 here:

    #0 0x7fd635dd2bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)

    #1 0x55a829f1e0e6 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118

    #2 0x55a829eebf26 in my_malloc /data/src/10.4/mysys/my_malloc.c:101

    #3 0x55a82855b301 in Binary_string::real_alloc(unsigned long) /data/src/10.4/sql/sql_string.cc:44

    #4 0x55a828076a2b in Binary_string::alloc(unsigned long) /data/src/10.4/sql/sql_string.h:619

    #5 0x55a828ae0ba1 in Field_blob_compressed::store(char const*, unsigned long, charset_info_st const*) /data/src/10.4/sql/field.cc:9011

    #6 0x55a828b12346 in do_save_blob /data/src/10.4/sql/field_conv.cc:359

    #7 0x55a828b112ca in do_copy_null /data/src/10.4/sql/field_conv.cc:246

    #8 0x55a82849a27b in copy_fields(TMP_TABLE_PARAM*) /data/src/10.4/sql/sql_select.cc:25086

    #9 0x55a828dbe37d in Item_func_group_concat::add() /data/src/10.4/sql/item_sum.cc:3990

    #10 0x55a828dc3fe7 in Aggregator_simple::add() /data/src/10.4/sql/item_sum.h:716

    #11 0x55a8284bec4d in Item_sum::aggregator_add() /data/src/10.4/sql/item_sum.h:558

    #12 0x55a8284be8c3 in Item_sum::reset_and_add() /data/src/10.4/sql/item_sum.h:443

    #13 0x55a82849d32a in init_sum_functions /data/src/10.4/sql/sql_select.cc:25450

    #14 0x55a828481c7a in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:21799

    #15 0x55a828477f77 in evaluate_join_record /data/src/10.4/sql/sql_select.cc:20625

    #16 0x55a82847693d in sub_select(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:20405

    #17 0x55a828474ae7 in do_select /data/src/10.4/sql/sql_select.cc:19943

    #18 0x55a82840482c in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4486

    #19 0x55a828401e39 in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4268

    #20 0x55a828405fac in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4703

    #21 0x55a8283d7475 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:410

    #22 0x55a828346faa in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6417

    #23 0x55a828334741 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3936

    #24 0x55a828350442 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7958

    #25 0x55a828327033 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1855

    #26 0x55a828323ae2 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1373

    #27 0x55a828715eb1 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412

    #28 0x55a828715755 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316

    #29 0x55a829dcf9bc in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869

Thread T5 created by T0 here:

    #0 0x7fd635cff805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)

    #1 0x55a829dcfdad in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1919

    #2 0x55a82802cc78 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1275

    #3 0x55a828044851 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6259

    #4 0x55a828044fec in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6329

    #5 0x55a8280454d2 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6427

    #6 0x55a82804636b in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6585

    #7 0x55a828043f56 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5917

    #8 0x55a82802abec in main /data/src/10.4/sql/main.cc:25

    #9 0x7fd63534a0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.4/strings/ctype-uca.ic:60 in my_uca_scanner_next_no_contractions_utf8mb4

Shadow bytes around the buggy address:

  0x0c1a800004d0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa

  0x0c1a800004e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c1a800004f0: 00 04 fa fa fa fa fa fa fa fa 00 00 00 00 00 00

  0x0c1a80000500: 00 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa

  0x0c1a80000510: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c1a80000520: fd fd[fd]fd fd fa fa fa fa fa fa fa fa fa fa fa

  0x0c1a80000530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c1a80000540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c1a80000550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c1a80000560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c1a80000570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==1957001==ABORTING

MariaDB [test]> create or replace table t (a text compressed) engine=MyISAM;

Query OK, 0 rows affected (0.027 sec)

MariaDB [test]> insert into t values ("''"),("'coffee'");

Query OK, 2 rows affected (0.000 sec)

Records: 2  Duplicates: 0  Warnings: 0

MariaDB [test]> select group_concat(a order by 1) from t;

+----------------------------+

| group_concat(a order by 1) |

+----------------------------+

| 'c,'coffee'                |

+----------------------------+

1 row in set (0.000 sec)

CREATE TABLE t (c POLYGON);

INSERT INTO t VALUES

  (POLYGONFromText('POLYGON((1 2,1 2))')),

  (POLYGONFromText('POLYGON((0 0,1 1,0 0))'));

SELECT GROUP_CONCAT(c, c ORDER BY 1,2) FROM t;

# Cleanup

DROP TABLE t;

==909916==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f00001c670 at pc 0x00000066d3d6 bp 0x7f311c315a00 sp 0x7f311c3151a8

READ of size 49 at 0x60f00001c670 thread T5

    #0 0x66d3d5 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) (/mnt8t/bld/10.2-asan/bin/mysqld+0x66d3d5)

    #1 0x66d8ca in memcmp (/mnt8t/bld/10.2-asan/bin/mysqld+0x66d8ca)

    #2 0x2c044ab in my_strnncoll_binary /data/src/10.2/strings/ctype-bin.c:85:12

    #3 0x2c04537 in my_strnncollsp_binary /data/src/10.2/strings/ctype-bin.c:124:10

    #4 0x129f461 in Field_blob::cmp(unsigned char const*, unsigned int, unsigned char const*, unsigned int) /data/src/10.2/sql/field.cc:8422:10

    #5 0x129f744 in Field_blob::cmp(unsigned char const*, unsigned char const*) /data/src/10.2/sql/field.cc:8433:10

    #6 0x15f6549 in group_concat_key_cmp_with_order /data/src/10.2/sql/item_sum.cc:3153:21

    #7 0x2b87fe4 in tree_insert /data/src/10.2/mysys/tree.c:211:9

    #8 0x15fcf15 in Item_func_group_concat::add() /data/src/10.2/sql/item_sum.cc:3575:9

    #9 0x160470e in Aggregator_simple::add() /data/src/10.2/sql/item_sum.h:708:33

    #10 0xc71d0e in Item_sum::aggregator_add() /data/src/10.2/sql/item_sum.h:553:47

    #11 0xc14c8e in update_sum_func(Item_sum**) /data/src/10.2/sql/sql_select.cc:23957:15

    #12 0xc088d1 in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:20301:7

    #13 0xc0d5ba in evaluate_join_record(JOIN*, st_join_table*, int) /data/src/10.2/sql/sql_select.cc:19137:11

    #14 0xc0b38d in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18949:9

    #15 0xbbffd3 in do_select(JOIN*, Procedure*) /data/src/10.2/sql/sql_select.cc:18453:14

    #16 0xbbc56e in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3651:10

    #17 0xbb91fe in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3446:3

    #18 0xb3b6fd in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3849:9

    #19 0xb3a384 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361:10

    #20 0xa7d979 in execute_sqlcom_select(THD*, TABLE_LIST*) /data/src/10.2/sql/sql_parse.cc:6271:12

    #21 0xa5ea5c in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3582:12

    #22 0xa5207c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793:18

    #23 0xa447e9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827:7

    #24 0xa4d4ea in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381:17

    #25 0xf3b236 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336:11

    #26 0xf3a903 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241:3

    #27 0x2a09c61 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869:3

    #28 0x7f31274eeea6 in start_thread nptl/pthread_create.c:477:8

    #29 0x7f3126bf9dee in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x60f00001c670 is located 112 bytes inside of 172-byte region [0x60f00001c600,0x60f00001c6ac)

freed by thread T5 here:

    #0 0x6d05ed in free (/mnt8t/bld/10.2-asan/bin/mysqld+0x6d05ed)

    #1 0x2ba1bad in free_memory /data/src/10.2/mysys/safemalloc.c:279:3

    #2 0x2ba1bfd in sf_free /data/src/10.2/mysys/safemalloc.c:197:3

    #3 0x2b54b9f in my_free /data/src/10.2/mysys/my_malloc.c:218:5

    #4 0x73a47e in String::free() /data/src/10.2/sql/sql_string.h:351:7

    #5 0xd161a2 in String::real_alloc(unsigned long) /data/src/10.2/sql/sql_string.cc:44:5

    #6 0x774218 in String::alloc(unsigned long) /data/src/10.2/sql/sql_string.h:361:12

    #7 0xd17c17 in String::copy(char const*, unsigned long, charset_info_st const*) /data/src/10.2/sql/sql_string.cc:188:7

    #8 0x12a4b28 in Field_geom::store(char const*, unsigned int, charset_info_st const*) /data/src/10.2/sql/field.cc:8941:13

    #9 0x12d6364 in do_save_blob(Copy_field*) /data/src/10.2/sql/field_conv.cc:358:36

    #10 0x12d51a4 in do_copy_null(Copy_field*) /data/src/10.2/sql/field_conv.cc:245:5

    #11 0xc149dc in copy_fields(TMP_TABLE_PARAM*) /data/src/10.2/sql/sql_select.cc:23584:5

    #12 0x15fbfb5 in Item_func_group_concat::add() /data/src/10.2/sql/item_sum.cc:3531:3

    #13 0x160470e in Aggregator_simple::add() /data/src/10.2/sql/item_sum.h:708:33

    #14 0xc71d0e in Item_sum::aggregator_add() /data/src/10.2/sql/item_sum.h:553:47

    #15 0xc14c8e in update_sum_func(Item_sum**) /data/src/10.2/sql/sql_select.cc:23957:15

    #16 0xc088d1 in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:20301:7

    #17 0xc0d5ba in evaluate_join_record(JOIN*, st_join_table*, int) /data/src/10.2/sql/sql_select.cc:19137:11

    #18 0xc0b38d in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18949:9

    #19 0xbbffd3 in do_select(JOIN*, Procedure*) /data/src/10.2/sql/sql_select.cc:18453:14

    #20 0xbbc56e in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3651:10

    #21 0xbb91fe in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3446:3

    #22 0xb3b6fd in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3849:9

    #23 0xb3a384 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361:10

    #24 0xa7d979 in execute_sqlcom_select(THD*, TABLE_LIST*) /data/src/10.2/sql/sql_parse.cc:6271:12

    #25 0xa5ea5c in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3582:12

    #26 0xa5207c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793:18

    #27 0xa447e9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827:7

    #28 0xa4d4ea in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381:17

    #29 0xf3b236 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336:11

previously allocated by thread T5 here:

    #0 0x6d086d in malloc (/mnt8t/bld/10.2-asan/bin/mysqld+0x6d086d)

    #1 0x2ba0b30 in sf_malloc /data/src/10.2/mysys/safemalloc.c:118:28

    #2 0x2b545ef in my_malloc /data/src/10.2/mysys/my_malloc.c:101:10

    #3 0xd16212 in String::real_alloc(unsigned long) /data/src/10.2/sql/sql_string.cc:45:23

    #4 0x774218 in String::alloc(unsigned long) /data/src/10.2/sql/sql_string.h:361:12

    #5 0xd17c17 in String::copy(char const*, unsigned long, charset_info_st const*) /data/src/10.2/sql/sql_string.cc:188:7

    #6 0x12a4b28 in Field_geom::store(char const*, unsigned int, charset_info_st const*) /data/src/10.2/sql/field.cc:8941:13

    #7 0x12d6364 in do_save_blob(Copy_field*) /data/src/10.2/sql/field_conv.cc:358:36

    #8 0x12d51a4 in do_copy_null(Copy_field*) /data/src/10.2/sql/field_conv.cc:245:5

    #9 0xc149dc in copy_fields(TMP_TABLE_PARAM*) /data/src/10.2/sql/sql_select.cc:23584:5

    #10 0x15fbfb5 in Item_func_group_concat::add() /data/src/10.2/sql/item_sum.cc:3531:3

    #11 0x160470e in Aggregator_simple::add() /data/src/10.2/sql/item_sum.h:708:33

    #12 0xc71d0e in Item_sum::aggregator_add() /data/src/10.2/sql/item_sum.h:553:47

    #13 0xc71c64 in Item_sum::reset_and_add() /data/src/10.2/sql/item_sum.h:440:12

    #14 0xc14b5e in init_sum_functions(Item_sum**, Item_sum**) /data/src/10.2/sql/sql_select.cc:23939:22

    #15 0xc085fd in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:20293:11

    #16 0xc0d5ba in evaluate_join_record(JOIN*, st_join_table*, int) /data/src/10.2/sql/sql_select.cc:19137:11

    #17 0xc0aa76 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18910:9

    #18 0xbbffd3 in do_select(JOIN*, Procedure*) /data/src/10.2/sql/sql_select.cc:18453:14

    #19 0xbbc56e in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3651:10

    #20 0xbb91fe in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3446:3

    #21 0xb3b6fd in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3849:9

    #22 0xb3a384 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361:10

    #23 0xa7d979 in execute_sqlcom_select(THD*, TABLE_LIST*) /data/src/10.2/sql/sql_parse.cc:6271:12

    #24 0xa5ea5c in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3582:12

    #25 0xa5207c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793:18

    #26 0xa447e9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827:7

    #27 0xa4d4ea in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381:17

    #28 0xf3b236 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336:11

    #29 0xf3a903 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241:3

Thread T5 created by T0 here:

    #0 0x6bb29a in pthread_create (/mnt8t/bld/10.2-asan/bin/mysqld+0x6bb29a)

    #1 0x2a0f119 in spawn_thread_v1(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.2/storage/perfschema/pfs.cc:1919:15

    #2 0x70b8ba in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.2/include/mysql/psi/mysql_thread.h:1246:11

    #3 0x71cb43 in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6580:15

    #4 0x71e33a in create_new_thread(CONNECT*) /data/src/10.2/sql/mysqld.cc:6650:3

    #5 0x71c0bd in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6908:9

    #6 0x70efb7 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6199:3

    #7 0x702e11 in main /data/src/10.2/sql/main.cc:25:10

    #8 0x7f3126b22d09 in __libc_start_main csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free (/mnt8t/bld/10.2-asan/bin/mysqld+0x66d3d5) in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)

Shadow bytes around the buggy address:

  0x0c1e7fffb870: 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa

  0x0c1e7fffb880: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c1e7fffb890: 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa

  0x0c1e7fffb8a0: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c1e7fffb8b0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa

=>0x0c1e7fffb8c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd

  0x0c1e7fffb8d0: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fd fd

  0x0c1e7fffb8e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c1e7fffb8f0: fd fd fd fd fa fa fa fa fa fa fa fa fd fd fd fd

  0x0c1e7fffb900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c1e7fffb910: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==909916==ABORTING

==910076==ERROR: AddressSanitizer: heap-use-after-free on address 0x60600000a048 at pc 0x7fa3454a7039 bp 0x7fa33a345450 sp 0x7fa33a344c00

READ of size 49 at 0x60600000a048 thread T5

    #0 0x7fa3454a7038 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:839

    #1 0x7fa3454a7648 in __interceptor_memcmp ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:871

    #2 0x7fa3454a7648 in __interceptor_memcmp ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:866

    #3 0x55d8ee5633a4 in my_strnncoll_binary /data/src/10.2/strings/ctype-bin.c:85

    #4 0x55d8ee5633a4 in my_strnncollsp_binary /data/src/10.2/strings/ctype-bin.c:124

    #5 0x55d8ed801937 in group_concat_key_cmp_with_order /data/src/10.2/sql/item_sum.cc:3153

    #6 0x55d8ee534788 in tree_insert /data/src/10.2/mysys/tree.c:211

    #7 0x55d8ed820605 in Item_func_group_concat::add() /data/src/10.2/sql/item_sum.cc:3575

    #8 0x55d8ed04d44b in Aggregator_simple::add() /data/src/10.2/sql/item_sum.h:708

    #9 0x55d8ed04d44b in Item_sum::aggregator_add() /data/src/10.2/sql/item_sum.h:553

    #10 0x55d8ed04d44b in update_sum_func /data/src/10.2/sql/sql_select.cc:23957

    #11 0x55d8ed0e2ace in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:20301

    #12 0x55d8ed0618ef in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19137

    #13 0x55d8ed0806b9 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18949

    #14 0x55d8ed10bd84 in do_select /data/src/10.2/sql/sql_select.cc:18453

    #15 0x55d8ed10bd84 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3651

    #16 0x55d8ed10d179 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3446

    #17 0x55d8ed10d573 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3849

    #18 0x55d8ed10ff7a in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361

    #19 0x55d8ecfb5ec7 in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6271

    #20 0x55d8ecfdc401 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3582

    #21 0x55d8ecfe4c67 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793

    #22 0x55d8ecfeb0ae in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827

    #23 0x55d8ecfeef4d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381

    #24 0x55d8ed2d1f66 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336

    #25 0x55d8ed2d269a in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241

    #26 0x55d8ee463874 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869

    #27 0x7fa344f4eea6 in start_thread nptl/pthread_create.c:477

    #28 0x7fa344b53dee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfddee)

0x60600000a048 is located 8 bytes inside of 64-byte region [0x60600000a040,0x60600000a080)

freed by thread T5 here:

    #0 0x7fa3454c5b6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123

    #1 0x55d8ed1873ce in String::free() /data/src/10.2/sql/sql_string.h:351

    #2 0x55d8ed1873ce in String::real_alloc(unsigned long) /data/src/10.2/sql/sql_string.cc:44

    #3 0x55d8ed187c1a in String::alloc(unsigned long) /data/src/10.2/sql/sql_string.h:361

    #4 0x55d8ed187c1a in String::copy(char const*, unsigned long, charset_info_st const*) /data/src/10.2/sql/sql_string.cc:188

    #5 0x55d8ed5046d4 in Field_geom::store(char const*, unsigned int, charset_info_st const*) /data/src/10.2/sql/field.cc:8941

    #6 0x55d8ed530f98 in do_save_blob /data/src/10.2/sql/field_conv.cc:358

    #7 0x55d8ed0cbeb6 in copy_fields(TMP_TABLE_PARAM*) /data/src/10.2/sql/sql_select.cc:23584

    #8 0x55d8ed81fe1f in Item_func_group_concat::add() /data/src/10.2/sql/item_sum.cc:3531

    #9 0x55d8ed04d44b in Aggregator_simple::add() /data/src/10.2/sql/item_sum.h:708

    #10 0x55d8ed04d44b in Item_sum::aggregator_add() /data/src/10.2/sql/item_sum.h:553

    #11 0x55d8ed04d44b in update_sum_func /data/src/10.2/sql/sql_select.cc:23957

    #12 0x55d8ed0e2ace in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:20301

    #13 0x55d8ed0618ef in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19137

    #14 0x55d8ed0806b9 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18949

    #15 0x55d8ed10bd84 in do_select /data/src/10.2/sql/sql_select.cc:18453

    #16 0x55d8ed10bd84 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3651

    #17 0x55d8ed10d179 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3446

    #18 0x55d8ed10d573 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3849

    #19 0x55d8ed10ff7a in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361

    #20 0x55d8ecfb5ec7 in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6271

    #21 0x55d8ecfdc401 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3582

    #22 0x55d8ecfe4c67 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793

    #23 0x55d8ecfeb0ae in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827

    #24 0x55d8ecfeef4d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381

    #25 0x55d8ed2d1f66 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336

    #26 0x55d8ed2d269a in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241

    #27 0x55d8ee463874 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869

    #28 0x7fa344f4eea6 in start_thread nptl/pthread_create.c:477

previously allocated by thread T5 here:

    #0 0x7fa3454c5e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145

    #1 0x55d8ee51bef2 in my_malloc /data/src/10.2/mysys/my_malloc.c:101

    #2 0x55d8ed187323 in String::real_alloc(unsigned long) /data/src/10.2/sql/sql_string.cc:45

    #3 0x55d8ed187c1a in String::alloc(unsigned long) /data/src/10.2/sql/sql_string.h:361

    #4 0x55d8ed187c1a in String::copy(char const*, unsigned long, charset_info_st const*) /data/src/10.2/sql/sql_string.cc:188

    #5 0x55d8ed5046d4 in Field_geom::store(char const*, unsigned int, charset_info_st const*) /data/src/10.2/sql/field.cc:8941

    #6 0x55d8ed530f98 in do_save_blob /data/src/10.2/sql/field_conv.cc:358

    #7 0x55d8ed0cbeb6 in copy_fields(TMP_TABLE_PARAM*) /data/src/10.2/sql/sql_select.cc:23584

    #8 0x55d8ed81fe1f in Item_func_group_concat::add() /data/src/10.2/sql/item_sum.cc:3531

    #9 0x55d8ed04d642 in Aggregator_simple::add() /data/src/10.2/sql/item_sum.h:708

    #10 0x55d8ed04d642 in Item_sum::aggregator_add() /data/src/10.2/sql/item_sum.h:553

    #11 0x55d8ed04d642 in Item_sum::reset_and_add() /data/src/10.2/sql/item_sum.h:440

    #12 0x55d8ed04d642 in init_sum_functions /data/src/10.2/sql/sql_select.cc:23939

    #13 0x55d8ed0e2f5f in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:20293

    #14 0x55d8ed0618ef in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19137

    #15 0x55d8ed08063d in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18910

    #16 0x55d8ed10bd84 in do_select /data/src/10.2/sql/sql_select.cc:18453

    #17 0x55d8ed10bd84 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3651

    #18 0x55d8ed10d179 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3446

    #19 0x55d8ed10d573 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3849

    #20 0x55d8ed10ff7a in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361

    #21 0x55d8ecfb5ec7 in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6271

    #22 0x55d8ecfdc401 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3582

    #23 0x55d8ecfe4c67 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793

    #24 0x55d8ecfeb0ae in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827

    #25 0x55d8ecfeef4d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381

    #26 0x55d8ed2d1f66 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336

    #27 0x55d8ed2d269a in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241

    #28 0x55d8ee463874 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869

    #29 0x7fa344f4eea6 in start_thread nptl/pthread_create.c:477

Thread T5 created by T0 here:

    #0 0x7fa3454712a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214

    #1 0x55d8ee468afa in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919

    #2 0x55d8ecddfeaf in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246

    #3 0x55d8ecddfeaf in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6580

    #4 0x55d8ecdf024c in create_new_thread /data/src/10.2/sql/mysqld.cc:6650

    #5 0x55d8ecdf024c in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6908

    #6 0x55d8ecdf277f in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6199

    #7 0x7fa344a7cd09 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:839 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)

Shadow bytes around the buggy address:

  0x0c0c7fff93b0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa

  0x0c0c7fff93c0: fd fd fd fd fd fd fd fd fa fa fa fa 00 00 00 00

  0x0c0c7fff93d0: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00

  0x0c0c7fff93e0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa

  0x0c0c7fff93f0: 00 00 00 00 00 00 00 fa fa fa fa fa fd fd fd fd

=>0x0c0c7fff9400: fd fd fd fd fa fa fa fa fd[fd]fd fd fd fd fd fd

  0x0c0c7fff9410: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa

  0x0c0c7fff9420: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa

  0x0c0c7fff9430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c0c7fff9440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c0c7fff9450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==910076==ABORTING

CREATE TABLE t (s MULTILINESTRING, c VARBINARY(1) NOT NULL DEFAULT '');

INSERT INTO t VALUES

(MULTILINESTRINGFromText('MULTILINESTRING((0.05 0.91,0.86 0.99),(0.43 0.94,0.55 0.78),(0.20 0.77,0.97 0.71),(0.67 0.12,0.40 0.43))'),'n'),

(MULTILINESTRINGFromText('MULTILINESTRING((0.04 0.67,0.29 0.57,0.22 0.91,0.59 0.44,0.45 0.70,0.98 0.30,0.45 0.74),(0.25 0.74,0.80 0.27,0.37 0.54))'),'f');

SELECT GROUP_CONCAT(c,s ORDER BY 1,2) FROM t;

# Cleanup

DROP TABLE t;

==3768654==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100002c798 at pc 0x7f1b635b5983 bp 0x7f1b598c78d0 sp 0x7f1b598c7080

READ of size 177 at 0x61100002c798 thread T5

    #0 0x7f1b635b5982 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:806

    #1 0x55b67981e69b in Static_binary_string::q_append(char const*, unsigned long) /data/src/10.5/sql/sql_string.h:322

    #2 0x55b6798a8897 in Binary_string::append(char const*, unsigned long) /data/src/10.5/sql/sql_string.h:558

    #3 0x55b6798a88df in Binary_string::append(Binary_string const&) /data/src/10.5/sql/sql_string.h:567

    #4 0x55b6798a89ee in String::append(String const&) /data/src/10.5/sql/sql_string.h:889

    #5 0x55b67a561f78 in dump_leaf_key /data/src/10.5/sql/item_sum.cc:3844

    #6 0x55b67b7729a8 in tree_walk_left_root_right /data/src/10.5/mysys/tree.c:590

    #7 0x55b67b77281d in tree_walk /data/src/10.5/mysys/tree.c:576

    #8 0x55b67a56948c in Item_func_group_concat::val_str(String*) /data/src/10.5/sql/item_sum.cc:4443

    #9 0x55b67a09c6d7 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /data/src/10.5/sql/sql_type.cc:7443

    #10 0x55b679ecb113 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /data/src/10.5/sql/sql_type.h:5451

    #11 0x55b679826c65 in Item::send(Protocol*, st_value*) /data/src/10.5/sql/item.h:1066

    #12 0x55b67981816d in Protocol::send_result_set_row(List<Item>*) /data/src/10.5/sql/protocol.cc:1087

    #13 0x55b6799c23ad in select_send::send_data(List<Item>&) /data/src/10.5/sql/sql_class.cc:3128

    #14 0x55b679c7b5a8 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /data/src/10.5/sql/sql_class.h:5399

    #15 0x55b679c392cd in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.5/sql/sql_select.cc:22327

    #16 0x55b679c2de77 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.5/sql/sql_select.cc:20911

    #17 0x55b679c2c755 in do_select /data/src/10.5/sql/sql_select.cc:20500

    #18 0x55b679bb967f in JOIN::exec_inner() /data/src/10.5/sql/sql_select.cc:4560

    #19 0x55b679bb6ca0 in JOIN::exec() /data/src/10.5/sql/sql_select.cc:4340

    #20 0x55b679bbaf93 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.5/sql/sql_select.cc:4817

    #21 0x55b679b8c65e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.5/sql/sql_select.cc:444

    #22 0x55b679af843c in execute_sqlcom_select /data/src/10.5/sql/sql_parse.cc:6315

    #23 0x55b679ae7436 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4006

    #24 0x55b679b03201 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8087

    #25 0x55b679ad98cb in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891

    #26 0x55b679ad62e8 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375

    #27 0x55b679f11dcc in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1416

    #28 0x55b679f11769 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1318

    #29 0x55b67ab3662d in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201

    #30 0x7f1b63090ea6 in start_thread nptl/pthread_create.c:477

    #31 0x7f1b62c7daee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfcaee)

0x61100002c798 is located 24 bytes inside of 208-byte region [0x61100002c780,0x61100002c850)

freed by thread T5 here:

    #0 0x7f1b63625b6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123

    #1 0x55b67b74d821 in my_free /data/src/10.5/mysys/my_malloc.c:211

    #2 0x55b6797f937f in Binary_string::free() /data/src/10.5/sql/sql_string.h:641

    #3 0x55b679d3c1c8 in Binary_string::real_alloc(unsigned long) /data/src/10.5/sql/sql_string.cc:43

    #4 0x55b67981f04d in Binary_string::alloc(unsigned long) /data/src/10.5/sql/sql_string.h:650

    #5 0x55b679d3d81b in Binary_string::copy(char const*, unsigned long) /data/src/10.5/sql/sql_string.cc:260

    #6 0x55b6797f952f in String::copy(char const*, unsigned long, charset_info_st const*) /data/src/10.5/sql/sql_string.h:844

    #7 0x55b67a0d8dad in Field_geom::store(char const*, unsigned long, charset_info_st const*) /data/src/10.5/sql/sql_type_geom.cc:889

    #8 0x55b67a2aa515 in do_save_blob /data/src/10.5/sql/field_conv.cc:359

    #9 0x55b67a2a94cf in do_copy_null /data/src/10.5/sql/field_conv.cc:246

    #10 0x55b679c5187c in copy_fields(TMP_TABLE_PARAM*) /data/src/10.5/sql/sql_select.cc:25690

    #11 0x55b67a56589f in Item_func_group_concat::add(bool) /data/src/10.5/sql/item_sum.cc:4142

    #12 0x55b67a5706fe in Item_func_group_concat::add() /data/src/10.5/sql/item_sum.h:1976

    #13 0x55b67a56b693 in Aggregator_simple::add() /data/src/10.5/sql/item_sum.h:718

    #14 0x55b679c77865 in Item_sum::aggregator_add() (/mnt8t/bld/10.5-asan-nightly/bin/mariadbd+0x1c0d865)

    #15 0x55b679c54706 in update_sum_func /data/src/10.5/sql/sql_select.cc:26071

    #16 0x55b679c39b50 in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.5/sql/sql_select.cc:22394

    #17 0x55b679c2fd9f in evaluate_join_record /data/src/10.5/sql/sql_select.cc:21196

    #18 0x55b679c2ed04 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.5/sql/sql_select.cc:21005

    #19 0x55b679c2c64f in do_select /data/src/10.5/sql/sql_select.cc:20498

    #20 0x55b679bb967f in JOIN::exec_inner() /data/src/10.5/sql/sql_select.cc:4560

    #21 0x55b679bb6ca0 in JOIN::exec() /data/src/10.5/sql/sql_select.cc:4340

    #22 0x55b679bbaf93 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.5/sql/sql_select.cc:4817

    #23 0x55b679b8c65e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.5/sql/sql_select.cc:444

    #24 0x55b679af843c in execute_sqlcom_select /data/src/10.5/sql/sql_parse.cc:6315

    #25 0x55b679ae7436 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4006

    #26 0x55b679b03201 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8087

    #27 0x55b679ad98cb in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891

    #28 0x55b679ad62e8 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375

    #29 0x55b679f11dcc in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1416

previously allocated by thread T5 here:

    #0 0x7f1b63625e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145

    #1 0x55b67b74ca46 in my_malloc /data/src/10.5/mysys/my_malloc.c:90

    #2 0x55b679d3c229 in Binary_string::real_alloc(unsigned long) /data/src/10.5/sql/sql_string.cc:44

    #3 0x55b67981f04d in Binary_string::alloc(unsigned long) /data/src/10.5/sql/sql_string.h:650

    #4 0x55b679d3d81b in Binary_string::copy(char const*, unsigned long) /data/src/10.5/sql/sql_string.cc:260

    #5 0x55b6797f952f in String::copy(char const*, unsigned long, charset_info_st const*) /data/src/10.5/sql/sql_string.h:844

    #6 0x55b67a0d8dad in Field_geom::store(char const*, unsigned long, charset_info_st const*) /data/src/10.5/sql/sql_type_geom.cc:889

    #7 0x55b67a2aa515 in do_save_blob /data/src/10.5/sql/field_conv.cc:359

    #8 0x55b67a2a94cf in do_copy_null /data/src/10.5/sql/field_conv.cc:246

    #9 0x55b679c5187c in copy_fields(TMP_TABLE_PARAM*) /data/src/10.5/sql/sql_select.cc:25690

    #10 0x55b67a56589f in Item_func_group_concat::add(bool) /data/src/10.5/sql/item_sum.cc:4142

    #11 0x55b67a5706fe in Item_func_group_concat::add() /data/src/10.5/sql/item_sum.h:1976

    #12 0x55b67a56b693 in Aggregator_simple::add() /data/src/10.5/sql/item_sum.h:718

    #13 0x55b679c77865 in Item_sum::aggregator_add() (/mnt8t/bld/10.5-asan-nightly/bin/mariadbd+0x1c0d865)

    #14 0x55b679c774f3 in Item_sum::reset_and_add() /data/src/10.5/sql/item_sum.h:445

    #15 0x55b679c5464f in init_sum_functions /data/src/10.5/sql/sql_select.cc:26053

    #16 0x55b679c3997c in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.5/sql/sql_select.cc:22386

    #17 0x55b679c2fd9f in evaluate_join_record /data/src/10.5/sql/sql_select.cc:21196

    #18 0x55b679c2e694 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.5/sql/sql_select.cc:20966

    #19 0x55b679c2c64f in do_select /data/src/10.5/sql/sql_select.cc:20498

    #20 0x55b679bb967f in JOIN::exec_inner() /data/src/10.5/sql/sql_select.cc:4560

    #21 0x55b679bb6ca0 in JOIN::exec() /data/src/10.5/sql/sql_select.cc:4340

    #22 0x55b679bbaf93 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.5/sql/sql_select.cc:4817

    #23 0x55b679b8c65e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.5/sql/sql_select.cc:444

    #24 0x55b679af843c in execute_sqlcom_select /data/src/10.5/sql/sql_parse.cc:6315

    #25 0x55b679ae7436 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4006

    #26 0x55b679b03201 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8087

    #27 0x55b679ad98cb in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891

    #28 0x55b679ad62e8 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375

    #29 0x55b679f11dcc in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1416

Thread T5 created by T0 here:

    #0 0x7f1b635d12a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214

    #1 0x55b67ab3238e in my_thread_create /data/src/10.5/storage/perfschema/my_thread.h:52

    #2 0x55b67ab36a1c in pfs_spawn_thread_v1 /data/src/10.5/storage/perfschema/pfs.cc:2252

    #3 0x55b6797d6d54 in inline_mysql_thread_create /data/src/10.5/include/mysql/psi/mysql_thread.h:1323

    #4 0x55b6797ec965 in create_thread_to_handle_connection(CONNECT*) /data/src/10.5/sql/mysqld.cc:6058

    #5 0x55b6797ecfae in create_new_thread(CONNECT*) /data/src/10.5/sql/mysqld.cc:6117

    #6 0x55b6797ed2e0 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.5/sql/mysqld.cc:6182

    #7 0x55b6797edeb5 in handle_connections_sockets() /data/src/10.5/sql/mysqld.cc:6309

    #8 0x55b6797ec1d4 in mysqld_main(int, char**) /data/src/10.5/sql/mysqld.cc:5704

    #9 0x55b6797d58f4 in main /data/src/10.5/sql/main.cc:25

    #10 0x7f1b62ba4d09 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:806 in __interceptor_memcpy

Shadow bytes around the buggy address:

  0x0c227fffd8a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c227fffd8b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa

  0x0c227fffd8c0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c227fffd8d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c227fffd8e0: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa

=>0x0c227fffd8f0: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c227fffd900: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa

  0x0c227fffd910: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00

  0x0c227fffd920: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c227fffd930: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c227fffd940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==3768654==ABORTING

221008 15:34:41 [ERROR] mysqld got signal 6 ;

This could be because you hit a bug. It is also possible that this binary

or one of the libraries it was linked against is corrupt, improperly built,

or misconfigured. This error can also be caused by malfunctioning hardware.

To report this bug, see https://mariadb.com/kb/en/reporting-bugs

We will try our best to scrape up some info that will hopefully help

diagnose the problem, but since we have already crashed, 

something is definitely wrong and this may fail.

Server version: 10.5.18-MariaDB-debug-log

key_buffer_size=1048576

read_buffer_size=131072

max_used_connections=1

max_threads=153

thread_count=1

It is possible that mysqld could use up to 

key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63761 K  bytes of memory

Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x62b000069218

Attempting backtrace. You can use the following information to find out

where mysqld died. If you see no messages after this, something went

terribly wrong...

stack_bottom = 0x7f1b598cac70 thread_stack 0x100000

sanitizer_common/sanitizer_common_interceptors.inc:4101(__interceptor_backtrace.part.0)[0x7f1b635bfdf1]

mysys/stacktrace.c:212(my_print_stacktrace)[0x55b67b75c6c8]

sql/signal_handler.cc:235(handle_fatal_signal)[0x55b67a2cce22]

sigaction.c:0(__restore_rt)[0x7f1b6309c140]

linux/raise.c:51(__GI_raise)[0x7f1b62bb9ce1]

stdlib/abort.c:81(__GI_abort)[0x7f1b62ba3537]

sanitizer_common/sanitizer_posix_libcdep.cpp:149(__sanitizer::Abort())[0x7f1b6364111b]

sanitizer_common/sanitizer_termination.cpp:59(__sanitizer::Die())[0x7f1b6364bce8]

asan/asan_report.cpp:186(__asan::ScopedInErrorReport::~ScopedInErrorReport())[0x7f1b6362e44c]

asan/asan_report.cpp:474(__asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool))[0x7f1b6362dd47]

sanitizer_common/sanitizer_common_interceptors.inc:806(memcpy)[0x7f1b635b59a5]

sql/sql_string.h:323(Static_binary_string::q_append(char const*, unsigned long))[0x55b67981e69c]

sql/sql_string.h:559(Binary_string::append(char const*, unsigned long))[0x55b6798a8898]

sql/sql_string.h:568(Binary_string::append(Binary_string const&))[0x55b6798a88e0]

sql/sql_string.h:890(String::append(String const&))[0x55b6798a89ef]

sql/item_sum.cc:3816(dump_leaf_key)[0x55b67a561f79]

mysys/tree.c:590(tree_walk_left_root_right)[0x55b67b7729a9]

mysys/tree.c:576(tree_walk)[0x55b67b77281e]

sql/item_sum.cc:4443(Item_func_group_concat::val_str(String*))[0x55b67a56948d]

sql/sql_type.cc:7443(Type_handler::Item_send_str(Item*, Protocol*, st_value*) const)[0x55b67a09c6d8]

sql/sql_type.h:5452(Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const)[0x55b679ecb114]

sql/item.h:1067(Item::send(Protocol*, st_value*))[0x55b679826c66]

sql/protocol.cc:1087(Protocol::send_result_set_row(List<Item>*))[0x55b67981816e]

sql/sql_class.cc:3128(select_send::send_data(List<Item>&))[0x55b6799c23ae]

sql/sql_class.h:5399(select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long))[0x55b679c7b5a9]

sql/sql_select.cc:22327(end_send_group(JOIN*, st_join_table*, bool))[0x55b679c392ce]

sql/sql_select.cc:20911(sub_select(JOIN*, st_join_table*, bool))[0x55b679c2de78]

sql/sql_select.cc:20500(do_select(JOIN*, Procedure*))[0x55b679c2c756]

sql/sql_select.cc:4560(JOIN::exec_inner())[0x55b679bb9680]

sql/sql_select.cc:4341(JOIN::exec())[0x55b679bb6ca1]

sql/sql_select.cc:4819(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55b679bbaf94]

sql/sql_select.cc:444(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55b679b8c65f]

sql/sql_parse.cc:6315(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55b679af843d]

sql/sql_parse.cc:4006(mysql_execute_command(THD*))[0x55b679ae7437]

sql/sql_parse.cc:8087(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55b679b03202]

sql/sql_parse.cc:1894(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55b679ad98cc]

sql/sql_parse.cc:1375(do_command(THD*))[0x55b679ad62e9]

sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x55b679f11dcd]

sql/sql_connect.cc:1320(handle_one_connection)[0x55b679f1176a]

perfschema/pfs.cc:2203(pfs_spawn_thread)[0x55b67ab3662e]

nptl/pthread_create.c:478(start_thread)[0x7f1b63090ea7]

x86_64/clone.S:97(__GI___clone)[0x7f1b62c7daef]

Trying to get some variables.

Some pointers may be invalid and cause the dump to abort.

Query (0x62b000038238): SELECT GROUP_CONCAT(c,s ORDER BY 1,2) FROM t

Connection ID (thread ID): 4

Status: NOT_KILLED

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off

The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mysqld/ contains

information that should help you find out what is causing the crash.

Writing a core file...

Working directory at /dev/shm/var_auto_Fkm8/mysqld.1/data

Resource Limits:

Limit                     Soft Limit           Hard Limit           Units     

Max cpu time              unlimited            unlimited            seconds   

Max file size             unlimited            unlimited            bytes     

Max data size             unlimited            unlimited            bytes     

Max stack size            8388608              unlimited            bytes     

Max core file size        unlimited            unlimited            bytes     

Max resident set          unlimited            unlimited            bytes     

Max processes             385880               385880               processes 

Max open files            1024                 1024                 files     

Max locked memory         12659543552          12659543552          bytes     

Max address space         unlimited            unlimited            bytes     

Max file locks            unlimited            unlimited            locks     

Max pending signals       385880               385880               signals   

Max msgqueue size         819200               819200               bytes     

Max nice priority         0                    0                    

Max realtime priority     0                    0                    

Max realtime timeout      unlimited            unlimited            us        

Core pattern: core

Kernel version: Linux version 5.10.0-18-amd64 (debian-kernel@lists.debian.org) (gcc-10 (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2) #1 SMP Debian 5.10.140-1 (2022-09-02)