Alice Sherepa added a comment - 2018-09-07 10:29 - edited Thanks for the report! Reproducible on 10.2, 10.3, not on 10.1 180907 12:24:13 [ERROR] mysqld got signal 6 ; Server version: 10.3.9-MariaDB   /lib/x86_64-linux-gnu/libpthread.so.0(+0x11390)[0x7f8204158390] linux/raise.c:54(__GI_raise)[0x7f8202ee1428] stdlib/abort.c:91(__GI_abort)[0x7f8202ee302a] posix/libc_fatal.c:175(__fsetlocking)[0x7f8202f237ea] malloc/malloc.c:4105(_int_free)[0x7f8202f2c37a] malloc/malloc.c:2969(__GI___libc_free)[0x7f8202f3053c] mysys/mf_iocache.c:1997(end_io_cache)[0x55cab852e6c5] myisam/mi_check.c:2432(mi_repair_by_sort)[0x55cab84d6707] myisam/ha_myisam.cc:1270(ha_myisam::repair(THD*, st_handler_check_param&, bool))[0x55cab84cd81f] myisam/ha_myisam.cc:1122(ha_myisam::repair(THD*, st_ha_check_opt*))[0x55cab84cdd95] sql/handler.cc:4212(handler::ha_repair(THD*, st_ha_check_opt*))[0x55cab8035d31] sql/sql_admin.cc:803(mysql_admin_table(THD*, TABLE_LIST*, st_ha_check_opt*, char const*, thr_lock_type, bool, bool, unsigned int, int (*)(THD*, TABLE_LIST*, st_ha_check_opt*), int (handler::*)(THD*, st_ha_check_opt*), int (*)(THD*, TABLE_LIST*, st_ha_check_opt*)))[0x55cab7f4e621] sql/sql_admin.cc:1409(Sql_cmd_repair_table::execute(THD*))[0x55cab7f4f7ad] sql/sql_parse.cc:6284(mysql_execute_command(THD*))[0x55cab7e74cc9] sql/sql_class.h:1809(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55cab7e7bfc9] sql/sql_parse.cc:1850(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55cab7e7e04a] sql/sql_parse.cc:1397(do_command(THD*))[0x55cab7e7e7ce] sql/sql_connect.cc:1402(do_handle_one_connection(CONNECT*))[0x55cab7f44daf] sql/sql_connect.cc:1310(handle_one_connection)[0x55cab7f44ed4] /lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7f820414e6ba] x86_64/clone.S:111(clone)[0x7f8202fb341d]   Query (0x7f819c0115f0): repair table t_produit use_frm Version: '10.2.18-MariaDB-debug' ================================================================= ==32218==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61c00003afc4 at pc 0x7f2f5a180904 bp 0x7f2f29368510 sp 0x7f2f29367cb8 WRITE of size 1744 at 0x61c00003afc4 thread T31 #0 0x7f2f5a180903 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8c903) #1 0x564b6f6d016d in _mi_read_cache /10.2/src/storage/myisam/mi_cache.c:67 #2 0x564b6f5f167b in sort_get_next_record /10.2/src/storage/myisam/mi_check.c:3527 #3 0x564b6f5ee92a in sort_key_read /10.2/src/storage/myisam/mi_check.c:3121 #4 0x564b6f6b7b66 in find_all_keys /10.2/src/storage/myisam/sort.c:312 #5 0x564b6f6b70e5 in _create_index_by_sort /10.2/src/storage/myisam/sort.c:228 #6 0x564b6f5e8c56 in mi_repair_by_sort /10.2/src/storage/myisam/mi_check.c:2401 #7 0x564b6f5c8c87 in ha_myisam::repair(THD*, st_handler_check_param&, bool) /10.2/src/storage/myisam/ha_myisam.cc:1268 #8 0x564b6f5c7437 in ha_myisam::repair(THD*, st_ha_check_opt*) /10.2/src/storage/myisam/ha_myisam.cc:1120 #9 0x564b6ef13907 in handler::ha_repair(THD*, st_ha_check_opt*) /10.2/src/sql/handler.cc:4022 #10 0x564b6ec8b8bc in mysql_admin_table /10.2/src/sql/sql_admin.cc:798 #11 0x564b6ec9101a in Sql_cmd_repair_table::execute(THD*) /10.2/src/sql/sql_admin.cc:1402 #12 0x564b6e95ba65 in mysql_execute_command(THD*) /10.2/src/sql/sql_parse.cc:6225 #13 0x564b6e9661fe in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.2/src/sql/sql_parse.cc:8009 #14 0x564b6e94189c in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.2/src/sql/sql_parse.cc:1824 #15 0x564b6e93ea50 in do_command(THD*) /10.2/src/sql/sql_parse.cc:1378 #16 0x564b6ec625ce in do_handle_one_connection(CONNECT*) /10.2/src/sql/sql_connect.cc:1335 #17 0x564b6ec61fd6 in handle_one_connection /10.2/src/sql/sql_connect.cc:1241 #18 0x7f2f58d886b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9) #19 0x7f2f5821d41c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)   0x61c00003afc4 is located 0 bytes to the right of 1860-byte region [0x61c00003a880,0x61c00003afc4) allocated by thread T31 here: #0 0x7f2f5a18c602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602) #1 0x564b6ff1e51b in sf_malloc /10.2/src/mysys/safemalloc.c:118 #2 0x564b6feeee05 in my_malloc /10.2/src/mysys/my_malloc.c:101 #3 0x564b6feef1e4 in my_realloc /10.2/src/mysys/my_malloc.c:155 #4 0x564b6f63a062 in mi_alloc_rec_buff /10.2/src/storage/myisam/mi_open.c:762 #5 0x564b6f5e783a in mi_repair_by_sort /10.2/src/storage/myisam/mi_check.c:2237 #6 0x564b6f5c8c87 in ha_myisam::repair(THD*, st_handler_check_param&, bool) /10.2/src/storage/myisam/ha_myisam.cc:1268 #7 0x564b6f5c7437 in ha_myisam::repair(THD*, st_ha_check_opt*) /10.2/src/storage/myisam/ha_myisam.cc:1120 #8 0x564b6ef13907 in handler::ha_repair(THD*, st_ha_check_opt*) /10.2/src/sql/handler.cc:4022 #9 0x564b6ec8b8bc in mysql_admin_table /10.2/src/sql/sql_admin.cc:798 #10 0x564b6ec9101a in Sql_cmd_repair_table::execute(THD*) /10.2/src/sql/sql_admin.cc:1402 #11 0x564b6e95ba65 in mysql_execute_command(THD*) /10.2/src/sql/sql_parse.cc:6225 #12 0x564b6e9661fe in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.2/src/sql/sql_parse.cc:8009 #13 0x564b6e94189c in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.2/src/sql/sql_parse.cc:1824 #14 0x564b6e93ea50 in do_command(THD*) /10.2/src/sql/sql_parse.cc:1378 #15 0x564b6ec625ce in do_handle_one_connection(CONNECT*) /10.2/src/sql/sql_connect.cc:1335 #16 0x564b6ec61fd6 in handle_one_connection /10.2/src/sql/sql_connect.cc:1241 #17 0x7f2f58d886b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)   Thread T31 created by T0 here: #0 0x7f2f5a12a253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253) #1 0x564b6ff471d8 in spawn_thread_noop /10.2/src/mysys/psi_noop.c:187 #2 0x564b6e74eb36 in inline_mysql_thread_create /10.2/src/include/mysql/psi/mysql_thread.h:1239 #3 0x564b6e762d97 in create_thread_to_handle_connection(CONNECT*) /10.2/src/sql/mysqld.cc:6456 #4 0x564b6e763497 in create_new_thread /10.2/src/sql/mysqld.cc:6526 #5 0x564b6e7644da in handle_connections_sockets() /10.2/src/sql/mysqld.cc:6801 #6 0x564b6e7622e7 in mysqld_main(int, char**) /10.2/src/sql/mysqld.cc:6075 #7 0x564b6e74d4cf in main /10.2/src/sql/main.cc:25 #8 0x7f2f5813682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)   SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memcpy Shadow bytes around the buggy address: 0x0c387ffff5a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c387ffff5b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c387ffff5c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c387ffff5d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c387ffff5e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c387ffff5f0: 00 00 00 00 00 00 00 00[04]fa fa fa fa fa fa fa 0x0c387ffff600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c387ffff610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c387ffff620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c387ffff630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c387ffff640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe ==32218==ABORTING