Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-18436

[draft] ASAN heap-use-after-free in my_strtod_int

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Duplicate
    • 10.3, 10.4
    • N/A
    • N/A
    • None

    Description

      10.4 923415ffdb4ce2ef66d

      AddressSanitizer: heap-use-after-free on address 0x60c0002e4030 at pc 0x5600dbcff78e bp 0x7fa314de02e0 sp 0x7fa314de02d0
      READ of size 1 at 0x60c0002e4030 thread T36
          #0 0x5600dbcff78d in my_strtod_int /10.4/strings/dtoa.c:1378
          #1 0x5600dbcfc2ac in my_strtod /10.4/strings/dtoa.c:469
          #2 0x5600dbc949bc in my_strntod_8bit /10.4/strings/ctype-simple.c:788
          #3 0x5600da1c48bc in Value_source::Converter_strntod::Converter_strntod(charset_info_st const*, char const*, unsigned long) /10.4/sql/field.h:168
          #4 0x5600da1c4bf3 in Value_source::Converter_strntod_with_warn::Converter_strntod_with_warn(THD*, Value_source::Warn_filter, charset_info_st const*, char const*, unsigned long) /10.4/sql/field.h:239
          #5 0x5600daaedc17 in Field_blob::val_real() /10.4/sql/field.cc:8307
          #6 0x5600dab8e38e in Item_field::val_real() /10.4/sql/item.cc:3149
          #7 0x5600dabb6d9e in Item_direct_ref::val_real() /10.4/sql/item.cc:8339
          #8 0x5600dabcfc60 in Item_direct_view_ref::val_real() /10.4/sql/item.h:5670
          #9 0x5600dabe2c73 in Arg_comparator::compare_real() /10.4/sql/item_cmpfunc.cc:826
          #10 0x5600dac1f346 in Arg_comparator::compare() /10.4/sql/item_cmpfunc.h:104
          #11 0x5600dabedd1d in Item_func_ge::val_int() /10.4/sql/item_cmpfunc.cc:1780
          #12 0x5600da886ef3 in Type_handler_int_result::Item_val_bool(Item*) const /10.4/sql/sql_type.cc:4375
          #13 0x5600da1aa26d in Item::val_bool() /10.4/sql/item.h:1448
          #14 0x5600dac0ce30 in Item_cond_and::val_int() /10.4/sql/item_cmpfunc.cc:5258
          #15 0x5600da672932 in SQL_SELECT::skip_record(THD*) /10.4/sql/opt_range.h:1658
          #16 0x5600dab2a6d2 in find_all_keys /10.4/sql/filesort.cc:807
          #17 0x5600dab26cc9 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /10.4/sql/filesort.cc:272
          #18 0x5600da52fd02 in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /10.4/sql/sql_select.cc:22552
          #19 0x5600da520c00 in st_join_table::sort_table() /10.4/sql/sql_select.cc:20365
          #20 0x5600da520145 in join_init_read_record(st_join_table*) /10.4/sql/sql_select.cc:20306
          #21 0x5600da519f6c in sub_select(JOIN*, st_join_table*, bool) /10.4/sql/sql_select.cc:19387
          #22 0x5600da5185c4 in do_select /10.4/sql/sql_select.cc:18930
          #23 0x5600da4b6fb8 in JOIN::exec_inner() /10.4/sql/sql_select.cc:4094
          #24 0x5600da4b4c5d in JOIN::exec() /10.4/sql/sql_select.cc:3888
          #25 0x5600da4b808c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/sql/sql_select.cc:4293
          #26 0x5600da492327 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/sql/sql_select.cc:385
          #27 0x5600da41792f in execute_sqlcom_select /10.4/sql/sql_parse.cc:6564
          #28 0x5600da404711 in mysql_execute_command(THD*) /10.4/sql/sql_parse.cc:3801
          #29 0x5600da41fe57 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/sql/sql_parse.cc:8117
          #30 0x5600da3f8aec in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/sql/sql_parse.cc:1803
          #31 0x5600da3f5ccc in do_command(THD*) /10.4/sql/sql_parse.cc:1356
          #32 0x5600da753320 in do_handle_one_connection(CONNECT*) /10.4/sql/sql_connect.cc:1398
          #33 0x5600da752cea in handle_one_connection /10.4/sql/sql_connect.cc:1301
          #34 0x7fa3462fc6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
          #35 0x7fa34558d41c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)
       
      0x60c0002e4030 is located 112 bytes inside of 124-byte region [0x60c0002e3fc0,0x60c0002e403c)
      freed by thread T36 here:
          #0 0x7fa3475722ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
          #1 0x5600dbc32e08 in free_memory /10.4/mysys/safemalloc.c:279
          #2 0x5600dbc32492 in sf_free /10.4/mysys/safemalloc.c:197
          #3 0x5600dbc04889 in my_free /10.4/mysys/my_malloc.c:221
          #4 0x5600da186535 in Binary_string::free() /10.4/sql/sql_string.h:604
          #5 0x5600da1c4107 in Binary_string::set(char const*, unsigned long) /10.4/sql/sql_string.h:462
          #6 0x5600da1c4154 in String::set(char const*, unsigned long, charset_info_st const*) /10.4/sql/sql_string.h:762
          #7 0x5600daae9432 in Field_longstr::uncompress(String*, String*, unsigned char const*, unsigned int) /10.4/sql/field.cc:8042
          #8 0x5600daaf27a4 in Field_blob_compressed::val_str(String*, String*) /10.4/sql/field.cc:8719
          #9 0x5600da1a5cc9 in Field::val_str(String*) /10.4/sql/field.h:834
          #10 0x5600dab154b0 in Field_blob::store_field(Field*) /10.4/sql/field.h:3835
          #11 0x5600dab226dd in field_conv_incompatible /10.4/sql/field_conv.cc:851
          #12 0x5600dab2277a in field_conv(Field*, Field*) /10.4/sql/field_conv.cc:864
          #13 0x5600daba615b in save_field_in_field /10.4/sql/item.cc:6352
          #14 0x5600daba67b8 in Item_field::save_in_field(Field*, bool) /10.4/sql/item.cc:6403
          #15 0x5600da6be37e in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /10.4/sql/table.cc:7809
          #16 0x5600dab4ca39 in handler::ha_index_read_map(unsigned char*, unsigned char const*, unsigned long, ha_rkey_function) /10.4/sql/handler.cc:3039
          #17 0x5600dab5f97b in handler::read_range_first(st_key_range const*, st_key_range const*, bool, bool) /10.4/sql/handler.cc:5817
          #18 0x5600da7f05c3 in handler::multi_range_read_next(void**) /10.4/sql/multi_range_read.cc:304
          #19 0x5600da7f08ed in Mrr_simple_index_reader::get_next(void**) /10.4/sql/multi_range_read.cc:336
          #20 0x5600da7f9652 in DsMrr_impl::dsmrr_next(void**) /10.4/sql/multi_range_read.cc:1406
          #21 0x5600db256ccf in ha_myisam::multi_range_read_next(void**) /10.4/storage/myisam/ha_myisam.cc:2526
          #22 0x5600dbb76bbe in ha_partition::handle_ordered_index_scan(unsigned char*, bool) /10.4/sql/ha_partition.cc:7535
          #23 0x5600dbb6dbb7 in ha_partition::multi_range_read_next(void**) /10.4/sql/ha_partition.cc:6480
          #24 0x5600daec76df in QUICK_RANGE_SELECT::get_next() /10.4/sql/opt_range.cc:11656
          #25 0x5600dab2a2f1 in find_all_keys /10.4/sql/filesort.cc:768
          #26 0x5600dab26cc9 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /10.4/sql/filesort.cc:272
          #27 0x5600da52fd02 in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /10.4/sql/sql_select.cc:22552
          #28 0x5600da520c00 in st_join_table::sort_table() /10.4/sql/sql_select.cc:20365
          #29 0x5600da520145 in join_init_read_record(st_join_table*) /10.4/sql/sql_select.cc:20306
       
      previously allocated by thread T36 here:
          #0 0x7fa347572602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
          #1 0x5600dbc31e63 in sf_malloc /10.4/mysys/safemalloc.c:118
          #2 0x5600dbc04006 in my_malloc /10.4/mysys/my_malloc.c:101
          #3 0x5600da5de861 in Binary_string::realloc_raw(unsigned long) /10.4/sql/sql_string.cc:101
          #4 0x5600da1865fa in Binary_string::realloc(unsigned long) /10.4/sql/sql_string.h:619
          #5 0x5600da5df551 in Binary_string::copy() /10.4/sql/sql_string.cc:209
          #6 0x5600dab087ab in String::copy() /10.4/sql/sql_string.h:811
          #7 0x5600dab155b9 in Field_blob::store_field(Field*) /10.4/sql/field.h:3838
          #8 0x5600dab226dd in field_conv_incompatible /10.4/sql/field_conv.cc:851
          #9 0x5600dab2277a in field_conv(Field*, Field*) /10.4/sql/field_conv.cc:864
          #10 0x5600daba615b in save_field_in_field /10.4/sql/item.cc:6352
          #11 0x5600daba67b8 in Item_field::save_in_field(Field*, bool) /10.4/sql/item.cc:6403
          #12 0x5600da6be37e in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /10.4/sql/table.cc:7809
          #13 0x5600dab4ca39 in handler::ha_index_read_map(unsigned char*, unsigned char const*, unsigned long, ha_rkey_function) /10.4/sql/handler.cc:3039
          #14 0x5600dab5f97b in handler::read_range_first(st_key_range const*, st_key_range const*, bool, bool) /10.4/sql/handler.cc:5817
          #15 0x5600da7f05c3 in handler::multi_range_read_next(void**) /10.4/sql/multi_range_read.cc:304
          #16 0x5600da7f08ed in Mrr_simple_index_reader::get_next(void**) /10.4/sql/multi_range_read.cc:336
          #17 0x5600da7f9652 in DsMrr_impl::dsmrr_next(void**) /10.4/sql/multi_range_read.cc:1406
          #18 0x5600db256ccf in ha_myisam::multi_range_read_next(void**) /10.4/storage/myisam/ha_myisam.cc:2526
          #19 0x5600dbb76bbe in ha_partition::handle_ordered_index_scan(unsigned char*, bool) /10.4/sql/ha_partition.cc:7535
          #20 0x5600dbb6dbb7 in ha_partition::multi_range_read_next(void**) /10.4/sql/ha_partition.cc:6480
          #21 0x5600daec76df in QUICK_RANGE_SELECT::get_next() /10.4/sql/opt_range.cc:11656
          #22 0x5600dab2a2f1 in find_all_keys /10.4/sql/filesort.cc:768
          #23 0x5600dab26cc9 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /10.4/sql/filesort.cc:272
          #24 0x5600da52fd02 in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /10.4/sql/sql_select.cc:22552
          #25 0x5600da520c00 in st_join_table::sort_table() /10.4/sql/sql_select.cc:20365
          #26 0x5600da520145 in join_init_read_record(st_join_table*) /10.4/sql/sql_select.cc:20306
          #27 0x5600da519f6c in sub_select(JOIN*, st_join_table*, bool) /10.4/sql/sql_select.cc:19387
          #28 0x5600da5185c4 in do_select /10.4/sql/sql_select.cc:18930
          #29 0x5600da4b6fb8 in JOIN::exec_inner() /10.4/sql/sql_select.cc:4094
       
      Thread T36 created by T0 here:
          #0 0x7fa347510253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
          #1 0x5600dbc5d575 in spawn_thread_noop /10.4/mysys/psi_noop.c:187
          #2 0x5600da164c36 in inline_mysql_thread_create /10.4/include/mysql/psi/mysql_thread.h:1268
          #3 0x5600da17970d in create_thread_to_handle_connection(CONNECT*) /10.4/sql/mysqld.cc:6195
          #4 0x5600da179e0d in create_new_thread(CONNECT*) /10.4/sql/mysqld.cc:6265
          #5 0x5600da17a198 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.4/sql/mysqld.cc:6363
          #6 0x5600da17ae15 in handle_connections_sockets() /10.4/sql/mysqld.cc:6521
          #7 0x5600da178f35 in mysqld_main(int, char**) /10.4/sql/mysqld.cc:5853
          #8 0x5600da162b2f in main /10.4/sql/main.cc:25
          #9 0x7fa3454a682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
       
      SUMMARY: AddressSanitizer: heap-use-after-free /10.4/strings/dtoa.c:1378 my_strtod_int
      Shadow bytes around the buggy address:
        0x0c18800547b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
        0x0c18800547c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
        0x0c18800547d0: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
        0x0c18800547e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c18800547f0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
      =>0x0c1880054800: fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa fa fa
        0x0c1880054810: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c1880054820: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
        0x0c1880054830: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
        0x0c1880054840: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
        0x0c1880054850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
      ==27244==ABORTING
      

       perl ./runall-new.pl --grammar=conf/runtime/information_schema.yy --gendata-advanced --skip-gendata --no-mask --queries=100M --duration=400 --threads=6 --seed=1548935188 --views --vcols --reporters=Backtrace,ErrorLog,Deadlock --validators=TransformerNoComparator --transformers=ExecuteAsCTE,ExecuteAsDeleteReturning,ExecuteAsExcept,ExecuteAsExecuteImmediate,ExecuteAsInsertSelect,ExecuteAsIntersect,ExecuteAsUnion,ExecuteAsUpdateDelete,ExecuteAsView,ExecuteAsPreparedTwice,ExecuteAsSPTwice --redefine=conf/mariadb/general-workarounds.yy --redefine=conf/mariadb/alter_table.yy --redefine=conf/mariadb/bulk_insert.yy --redefine=conf/mariadb/event.yy --redefine=conf/mariadb/instant_add.yy --redefine=conf/mariadb/sequences.yy --redefine=conf/mariadb/sp.yy --redefine=conf/mariadb/versioning.yy --mysqld=--log_output=FILE --mysqld=--log-bin --mysqld=--log_bin_trust_function_creators=1 --mysqld=--join-cache-level=4 --engine=MyISAM --mysqld=--default-storage-engine=MyISAM --basedir=/home/alice/git/10.4 --vardir1=/1
      

      Attachments

        Issue Links

          Activity

            People

              alice Alice Sherepa
              alice Alice Sherepa
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.