Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-18436

[draft] ASAN heap-use-after-free in my_strtod_int

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Duplicate
    • 10.3(EOL), 10.4(EOL)
    • N/A
    • N/A
    • None

    Description

      10.4 923415ffdb4ce2ef66d

      		 
      AddressSanitizer: heap-use-after-free on address 0x60c0002e4030 at pc 0x5600dbcff78e bp 0x7fa314de02e0 sp 0x7fa314de02d0
      		 
      READ of size 1 at 0x60c0002e4030 thread T36
      		 
          #0 0x5600dbcff78d in my_strtod_int /10.4/strings/dtoa.c:1378
      		 
          #1 0x5600dbcfc2ac in my_strtod /10.4/strings/dtoa.c:469
      		 
          #2 0x5600dbc949bc in my_strntod_8bit /10.4/strings/ctype-simple.c:788
      		 
          #3 0x5600da1c48bc in Value_source::Converter_strntod::Converter_strntod(charset_info_st const*, char const*, unsigned long) /10.4/sql/field.h:168
      		 
          #4 0x5600da1c4bf3 in Value_source::Converter_strntod_with_warn::Converter_strntod_with_warn(THD*, Value_source::Warn_filter, charset_info_st const*, char const*, unsigned long) /10.4/sql/field.h:239
      		 
          #5 0x5600daaedc17 in Field_blob::val_real() /10.4/sql/field.cc:8307
      		 
          #6 0x5600dab8e38e in Item_field::val_real() /10.4/sql/item.cc:3149
      		 
          #7 0x5600dabb6d9e in Item_direct_ref::val_real() /10.4/sql/item.cc:8339
      		 
          #8 0x5600dabcfc60 in Item_direct_view_ref::val_real() /10.4/sql/item.h:5670
      		 
          #9 0x5600dabe2c73 in Arg_comparator::compare_real() /10.4/sql/item_cmpfunc.cc:826
      		 
          #10 0x5600dac1f346 in Arg_comparator::compare() /10.4/sql/item_cmpfunc.h:104
      		 
          #11 0x5600dabedd1d in Item_func_ge::val_int() /10.4/sql/item_cmpfunc.cc:1780
      		 
          #12 0x5600da886ef3 in Type_handler_int_result::Item_val_bool(Item*) const /10.4/sql/sql_type.cc:4375
      		 
          #13 0x5600da1aa26d in Item::val_bool() /10.4/sql/item.h:1448
      		 
          #14 0x5600dac0ce30 in Item_cond_and::val_int() /10.4/sql/item_cmpfunc.cc:5258
      		 
          #15 0x5600da672932 in SQL_SELECT::skip_record(THD*) /10.4/sql/opt_range.h:1658
      		 
          #16 0x5600dab2a6d2 in find_all_keys /10.4/sql/filesort.cc:807
      		 
          #17 0x5600dab26cc9 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /10.4/sql/filesort.cc:272
      		 
          #18 0x5600da52fd02 in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /10.4/sql/sql_select.cc:22552
      		 
          #19 0x5600da520c00 in st_join_table::sort_table() /10.4/sql/sql_select.cc:20365
      		 
          #20 0x5600da520145 in join_init_read_record(st_join_table*) /10.4/sql/sql_select.cc:20306
      		 
          #21 0x5600da519f6c in sub_select(JOIN*, st_join_table*, bool) /10.4/sql/sql_select.cc:19387
      		 
          #22 0x5600da5185c4 in do_select /10.4/sql/sql_select.cc:18930
      		 
          #23 0x5600da4b6fb8 in JOIN::exec_inner() /10.4/sql/sql_select.cc:4094
      		 
          #24 0x5600da4b4c5d in JOIN::exec() /10.4/sql/sql_select.cc:3888
      		 
          #25 0x5600da4b808c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/sql/sql_select.cc:4293
      		 
          #26 0x5600da492327 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/sql/sql_select.cc:385
      		 
          #27 0x5600da41792f in execute_sqlcom_select /10.4/sql/sql_parse.cc:6564
      		 
          #28 0x5600da404711 in mysql_execute_command(THD*) /10.4/sql/sql_parse.cc:3801
      		 
          #29 0x5600da41fe57 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/sql/sql_parse.cc:8117
      		 
          #30 0x5600da3f8aec in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/sql/sql_parse.cc:1803
      		 
          #31 0x5600da3f5ccc in do_command(THD*) /10.4/sql/sql_parse.cc:1356
      		 
          #32 0x5600da753320 in do_handle_one_connection(CONNECT*) /10.4/sql/sql_connect.cc:1398
      		 
          #33 0x5600da752cea in handle_one_connection /10.4/sql/sql_connect.cc:1301
      		 
          #34 0x7fa3462fc6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
      		 
          #35 0x7fa34558d41c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)
      		 
       
      		 
      0x60c0002e4030 is located 112 bytes inside of 124-byte region [0x60c0002e3fc0,0x60c0002e403c)
      		 
      freed by thread T36 here:
      		 
          #0 0x7fa3475722ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
      		 
          #1 0x5600dbc32e08 in free_memory /10.4/mysys/safemalloc.c:279
      		 
          #2 0x5600dbc32492 in sf_free /10.4/mysys/safemalloc.c:197
      		 
          #3 0x5600dbc04889 in my_free /10.4/mysys/my_malloc.c:221
      		 
          #4 0x5600da186535 in Binary_string::free() /10.4/sql/sql_string.h:604
      		 
          #5 0x5600da1c4107 in Binary_string::set(char const*, unsigned long) /10.4/sql/sql_string.h:462
      		 
          #6 0x5600da1c4154 in String::set(char const*, unsigned long, charset_info_st const*) /10.4/sql/sql_string.h:762
      		 
          #7 0x5600daae9432 in Field_longstr::uncompress(String*, String*, unsigned char const*, unsigned int) /10.4/sql/field.cc:8042
      		 
          #8 0x5600daaf27a4 in Field_blob_compressed::val_str(String*, String*) /10.4/sql/field.cc:8719
      		 
          #9 0x5600da1a5cc9 in Field::val_str(String*) /10.4/sql/field.h:834
      		 
          #10 0x5600dab154b0 in Field_blob::store_field(Field*) /10.4/sql/field.h:3835
      		 
          #11 0x5600dab226dd in field_conv_incompatible /10.4/sql/field_conv.cc:851
      		 
          #12 0x5600dab2277a in field_conv(Field*, Field*) /10.4/sql/field_conv.cc:864
      		 
          #13 0x5600daba615b in save_field_in_field /10.4/sql/item.cc:6352
      		 
          #14 0x5600daba67b8 in Item_field::save_in_field(Field*, bool) /10.4/sql/item.cc:6403
      		 
          #15 0x5600da6be37e in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /10.4/sql/table.cc:7809
      		 
          #16 0x5600dab4ca39 in handler::ha_index_read_map(unsigned char*, unsigned char const*, unsigned long, ha_rkey_function) /10.4/sql/handler.cc:3039
      		 
          #17 0x5600dab5f97b in handler::read_range_first(st_key_range const*, st_key_range const*, bool, bool) /10.4/sql/handler.cc:5817
      		 
          #18 0x5600da7f05c3 in handler::multi_range_read_next(void**) /10.4/sql/multi_range_read.cc:304
      		 
          #19 0x5600da7f08ed in Mrr_simple_index_reader::get_next(void**) /10.4/sql/multi_range_read.cc:336
      		 
          #20 0x5600da7f9652 in DsMrr_impl::dsmrr_next(void**) /10.4/sql/multi_range_read.cc:1406
      		 
          #21 0x5600db256ccf in ha_myisam::multi_range_read_next(void**) /10.4/storage/myisam/ha_myisam.cc:2526
      		 
          #22 0x5600dbb76bbe in ha_partition::handle_ordered_index_scan(unsigned char*, bool) /10.4/sql/ha_partition.cc:7535
      		 
          #23 0x5600dbb6dbb7 in ha_partition::multi_range_read_next(void**) /10.4/sql/ha_partition.cc:6480
      		 
          #24 0x5600daec76df in QUICK_RANGE_SELECT::get_next() /10.4/sql/opt_range.cc:11656
      		 
          #25 0x5600dab2a2f1 in find_all_keys /10.4/sql/filesort.cc:768
      		 
          #26 0x5600dab26cc9 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /10.4/sql/filesort.cc:272
      		 
          #27 0x5600da52fd02 in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /10.4/sql/sql_select.cc:22552
      		 
          #28 0x5600da520c00 in st_join_table::sort_table() /10.4/sql/sql_select.cc:20365
      		 
          #29 0x5600da520145 in join_init_read_record(st_join_table*) /10.4/sql/sql_select.cc:20306
      		 
       
      		 
      previously allocated by thread T36 here:
      		 
          #0 0x7fa347572602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
      		 
          #1 0x5600dbc31e63 in sf_malloc /10.4/mysys/safemalloc.c:118
      		 
          #2 0x5600dbc04006 in my_malloc /10.4/mysys/my_malloc.c:101
      		 
          #3 0x5600da5de861 in Binary_string::realloc_raw(unsigned long) /10.4/sql/sql_string.cc:101
      		 
          #4 0x5600da1865fa in Binary_string::realloc(unsigned long) /10.4/sql/sql_string.h:619
      		 
          #5 0x5600da5df551 in Binary_string::copy() /10.4/sql/sql_string.cc:209
      		 
          #6 0x5600dab087ab in String::copy() /10.4/sql/sql_string.h:811
      		 
          #7 0x5600dab155b9 in Field_blob::store_field(Field*) /10.4/sql/field.h:3838
      		 
          #8 0x5600dab226dd in field_conv_incompatible /10.4/sql/field_conv.cc:851
      		 
          #9 0x5600dab2277a in field_conv(Field*, Field*) /10.4/sql/field_conv.cc:864
      		 
          #10 0x5600daba615b in save_field_in_field /10.4/sql/item.cc:6352
      		 
          #11 0x5600daba67b8 in Item_field::save_in_field(Field*, bool) /10.4/sql/item.cc:6403
      		 
          #12 0x5600da6be37e in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /10.4/sql/table.cc:7809
      		 
          #13 0x5600dab4ca39 in handler::ha_index_read_map(unsigned char*, unsigned char const*, unsigned long, ha_rkey_function) /10.4/sql/handler.cc:3039
      		 
          #14 0x5600dab5f97b in handler::read_range_first(st_key_range const*, st_key_range const*, bool, bool) /10.4/sql/handler.cc:5817
      		 
          #15 0x5600da7f05c3 in handler::multi_range_read_next(void**) /10.4/sql/multi_range_read.cc:304
      		 
          #16 0x5600da7f08ed in Mrr_simple_index_reader::get_next(void**) /10.4/sql/multi_range_read.cc:336
      		 
          #17 0x5600da7f9652 in DsMrr_impl::dsmrr_next(void**) /10.4/sql/multi_range_read.cc:1406
      		 
          #18 0x5600db256ccf in ha_myisam::multi_range_read_next(void**) /10.4/storage/myisam/ha_myisam.cc:2526
      		 
          #19 0x5600dbb76bbe in ha_partition::handle_ordered_index_scan(unsigned char*, bool) /10.4/sql/ha_partition.cc:7535
      		 
          #20 0x5600dbb6dbb7 in ha_partition::multi_range_read_next(void**) /10.4/sql/ha_partition.cc:6480
      		 
          #21 0x5600daec76df in QUICK_RANGE_SELECT::get_next() /10.4/sql/opt_range.cc:11656
      		 
          #22 0x5600dab2a2f1 in find_all_keys /10.4/sql/filesort.cc:768
      		 
          #23 0x5600dab26cc9 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /10.4/sql/filesort.cc:272
      		 
          #24 0x5600da52fd02 in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /10.4/sql/sql_select.cc:22552
      		 
          #25 0x5600da520c00 in st_join_table::sort_table() /10.4/sql/sql_select.cc:20365
      		 
          #26 0x5600da520145 in join_init_read_record(st_join_table*) /10.4/sql/sql_select.cc:20306
      		 
          #27 0x5600da519f6c in sub_select(JOIN*, st_join_table*, bool) /10.4/sql/sql_select.cc:19387
      		 
          #28 0x5600da5185c4 in do_select /10.4/sql/sql_select.cc:18930
      		 
          #29 0x5600da4b6fb8 in JOIN::exec_inner() /10.4/sql/sql_select.cc:4094
      		 
       
      		 
      Thread T36 created by T0 here:
      		 
          #0 0x7fa347510253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
      		 
          #1 0x5600dbc5d575 in spawn_thread_noop /10.4/mysys/psi_noop.c:187
      		 
          #2 0x5600da164c36 in inline_mysql_thread_create /10.4/include/mysql/psi/mysql_thread.h:1268
      		 
          #3 0x5600da17970d in create_thread_to_handle_connection(CONNECT*) /10.4/sql/mysqld.cc:6195
      		 
          #4 0x5600da179e0d in create_new_thread(CONNECT*) /10.4/sql/mysqld.cc:6265
      		 
          #5 0x5600da17a198 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.4/sql/mysqld.cc:6363
      		 
          #6 0x5600da17ae15 in handle_connections_sockets() /10.4/sql/mysqld.cc:6521
      		 
          #7 0x5600da178f35 in mysqld_main(int, char**) /10.4/sql/mysqld.cc:5853
      		 
          #8 0x5600da162b2f in main /10.4/sql/main.cc:25
      		 
          #9 0x7fa3454a682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
      		 
       
      		 
      SUMMARY: AddressSanitizer: heap-use-after-free /10.4/strings/dtoa.c:1378 my_strtod_int
      		 
      Shadow bytes around the buggy address:
      		 
        0x0c18800547b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
      		 
        0x0c18800547c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
      		 
        0x0c18800547d0: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
      		 
        0x0c18800547e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c18800547f0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
      		 
      =>0x0c1880054800: fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa fa fa
      		 
        0x0c1880054810: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c1880054820: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
      		 
        0x0c1880054830: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
      		 
        0x0c1880054840: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
      		 
        0x0c1880054850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      		 
      Shadow byte legend (one shadow byte represents 8 application bytes):
      		 
        Addressable:           00
      		 
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
      		 
        Heap right redzone:      fb
      		 
        Freed heap region:       fd
      		 
        Stack left redzone:      f1
      		 
        Stack mid redzone:       f2
      		 
        Stack right redzone:     f3
      		 
        Stack partial redzone:   f4
      		 
        Stack after return:      f5
      		 
        Stack use after scope:   f8
      		 
        Global redzone:          f9
      		 
        Global init order:       f6
      		 
        Poisoned by user:        f7
      		 
        Container overflow:      fc
      		 
        Array cookie:            ac
      		 
        Intra object redzone:    bb
      		 
        ASan internal:           fe
      		 
      ==27244==ABORTING


       perl ./runall-new.pl --grammar=conf/runtime/information_schema.yy --gendata-advanced --skip-gendata --no-mask --queries=100M --duration=400 --threads=6 --seed=1548935188 --views --vcols --reporters=Backtrace,ErrorLog,Deadlock --validators=TransformerNoComparator --transformers=ExecuteAsCTE,ExecuteAsDeleteReturning,ExecuteAsExcept,ExecuteAsExecuteImmediate,ExecuteAsInsertSelect,ExecuteAsIntersect,ExecuteAsUnion,ExecuteAsUpdateDelete,ExecuteAsView,ExecuteAsPreparedTwice,ExecuteAsSPTwice --redefine=conf/mariadb/general-workarounds.yy --redefine=conf/mariadb/alter_table.yy --redefine=conf/mariadb/bulk_insert.yy --redefine=conf/mariadb/event.yy --redefine=conf/mariadb/instant_add.yy --redefine=conf/mariadb/sequences.yy --redefine=conf/mariadb/sp.yy --redefine=conf/mariadb/versioning.yy --mysqld=--log_output=FILE --mysqld=--log-bin --mysqld=--log_bin_trust_function_creators=1 --mysqld=--join-cache-level=4 --engine=MyISAM --mysqld=--default-storage-engine=MyISAM --basedir=/home/alice/git/10.4 --vardir1=/1

      Attachments

        Issue Links

          duplicates

          Bug - A problem which impairs or prevents the functions of the product. MDEV-18414 Server crash or ASAN heap-use-after-free in my_strtod_int / Value_source::Converter_strntod::Converter_strntod

          • Major - Major loss of function.
          • Closed

          Activity

            People

              alice Alice Sherepa
              alice Alice Sherepa
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.