[MDEV-18734] ASAN heap-use-after-free upon sorting by blob column from partitioned table - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Critical
Resolution: Fixed
Affects Version/s: 10.2(EOL), 10.3(EOL), 10.4(EOL)
Fix Version/s: 10.2.41, 10.3.32, 10.4.22, 10.5.13, 10.6.5
Component/s: Data Manipulation - Update, Partitioning, Virtual Columns
Labels:
None

Description

ASAN heap-use-after-free in my_strnxfrm_simple_internal upon update on versioned partitioned table.

--source include/have_partition.inc

CREATE TABLE t1 (

  pk INT AUTO_INCREMENT,

  b TINYTEXT DEFAULT '',

  i INT,

  v TEXT AS (b) VIRTUAL,

  PRIMARY KEY(pk)

) WITH SYSTEM VERSIONING PARTITION BY system_time LIMIT 100 ( PARTITION p1 HISTORY, PARTITION pn CURRENT );

INSERT INTO t1 (pk) VALUES (NULL),(NULL),(NULL),(NULL);

UPDATE t1 SET b = 'foo' WHERE pk = 3;

REPLACE INTO t1 (pk, b, i) SELECT pk, b, i FROM t1;

INSERT INTO t1 (pk) VALUES (NULL);

UPDATE t1 SET i = 10 WHERE pk < 20 ORDER BY v LIMIT 2;

# Cleanup

DROP TABLE t1;

10.4 09bd2138
==6107==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000260f0 at pc 0x560b15b508f0 bp 0x7f656fcd5e10 sp 0x7f656fcd5e08
READ of size 1 at 0x60c0000260f0 thread T5
#0 0x560b15b508ef in my_strnxfrm_simple_internal /data/src/10.3/strings/ctype-simple.c:87
#1 0x560b15b50ace in my_strnxfrm_simple /data/src/10.3/strings/ctype-simple.c:105
#2 0x560b1497107f in Field_blob::sort_string(unsigned char*, unsigned int) /data/src/10.3/sql/field.cc:8578
#3 0x560b1490ea56 in Field::make_sort_key(unsigned char*, unsigned int) /data/src/10.3/sql/field.cc:1018
#4 0x560b149b0377 in make_sortkey /data/src/10.3/sql/filesort.cc:1165
#5 0x560b149b7a45 in Bounded_queue<unsigned char, unsigned char>::push(unsigned char*) (/data/bld/10.3-asan/bin/mysqld+0x1566a45)
#6 0x560b149adb9f in find_all_keys /data/src/10.3/sql/filesort.cc:832
#7 0x560b149a9ef5 in filesort(THD, TABLE, Filesort, Filesort_tracker, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278
#8 0x560b1451032a in mysql_update(THD, TABLE_LIST, List<Item>&, List<Item>&, Item, unsigned int, st_order, unsigned long long, enum_duplicates, bool, unsigned long long, unsigned long long) /data/src/10.3/sql/sql_update.cc:672
#9 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584
#10 0x560b142c0fa2 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
#11 0x560b1429b07a in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
#12 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
#13 0x560b1460b861 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
#14 0x560b1460b26d in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309
#15 0x560b15140349 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
#16 0x7f657c2ad493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
#17 0x7f657a69393e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x60c0000260f0 is located 112 bytes inside of 124-byte region [0x60c000026080,0x60c0000260fc)
freed by thread T5 here:
#0 0x7f657c517527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
#1 0x560b15af026f in free_memory /data/src/10.3/mysys/safemalloc.c:279
#2 0x560b15aef875 in sf_free /data/src/10.3/mysys/safemalloc.c:197
#3 0x560b15ac02be in my_free /data/src/10.3/mysys/my_malloc.c:223
#4 0x560b14027585 in String::free() /data/src/10.3/sql/sql_string.h:358
#5 0x560b1406c285 in String::set(char const, unsigned long, charset_info_st const) /data/src/10.3/sql/sql_string.h:278
#6 0x560b1496e849 in Field_blob::val_str(String, String) /data/src/10.3/sql/field.cc:8357
#7 0x560b1404d01b in Field::val_str(String*) /data/src/10.3/sql/field.h:840
#8 0x560b149974da in Field_blob::store_field(Field*) /data/src/10.3/sql/field.h:3631
#9 0x560b149a5967 in field_conv_incompatible /data/src/10.3/sql/field_conv.cc:836
#10 0x560b149a5a04 in field_conv(Field, Field) /data/src/10.3/sql/field_conv.cc:849
#11 0x560b14a2b6a4 in save_field_in_field /data/src/10.3/sql/item.cc:6708
#12 0x560b14a2bd00 in Item_field::save_in_field(Field*, bool) /data/src/10.3/sql/item.cc:6759
#13 0x560b14571036 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.3/sql/table.cc:7814
#14 0x560b149cde63 in handler::ha_index_next(unsigned char*) /data/src/10.3/sql/handler.cc:2928
#15 0x560b149e05db in handler::read_range_next() /data/src/10.3/sql/handler.cc:5702
#16 0x560b146a996f in handler::multi_range_read_next(void**) /data/src/10.3/sql/multi_range_read.cc:271
#17 0x560b146aa060 in Mrr_simple_index_reader::get_next(void**) /data/src/10.3/sql/multi_range_read.cc:336
#18 0x560b146b3182 in DsMrr_impl::dsmrr_next(void**) /data/src/10.3/sql/multi_range_read.cc:1406
#19 0x560b158b3be3 in ha_myisam::multi_range_read_next(void**) /data/src/10.3/storage/myisam/ha_myisam.cc:2495
#20 0x560b15a2e543 in ha_partition::handle_ordered_next(unsigned char*, bool) /data/src/10.3/sql/ha_partition.cc:7824
#21 0x560b15a225fb in ha_partition::multi_range_read_next(void**) /data/src/10.3/sql/ha_partition.cc:6486
#22 0x560b14d4a2d2 in QUICK_RANGE_SELECT::get_next() /data/src/10.3/sql/opt_range.cc:11470
#23 0x560b149ad646 in find_all_keys /data/src/10.3/sql/filesort.cc:776
#24 0x560b149a9ef5 in filesort(THD, TABLE, Filesort, Filesort_tracker, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278
#25 0x560b1451032a in mysql_update(THD, TABLE_LIST, List<Item>&, List<Item>&, Item, unsigned int, st_order, unsigned long long, enum_duplicates, bool, unsigned long long, unsigned long long) /data/src/10.3/sql/sql_update.cc:672
#26 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584
#27 0x560b142c0fa2 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
#28 0x560b1429b07a in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
#29 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396

previously allocated by thread T5 here:
#0 0x7f657c51773f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x560b15aeefe5 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
#2 0x560b15abf8e0 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
#3 0x560b14488f2b in String::realloc_raw(unsigned long) /data/src/10.3/sql/sql_string.cc:101
#4 0x560b140276ac in String::realloc(unsigned long) /data/src/10.3/sql/sql_string.h:374
#5 0x560b14489d45 in String::copy() /data/src/10.3/sql/sql_string.cc:212
#6 0x560b149975e3 in Field_blob::store_field(Field*) /data/src/10.3/sql/field.h:3634
#7 0x560b149a5967 in field_conv_incompatible /data/src/10.3/sql/field_conv.cc:836
#8 0x560b149a5a04 in field_conv(Field, Field) /data/src/10.3/sql/field_conv.cc:849
#9 0x560b14a2b6a4 in save_field_in_field /data/src/10.3/sql/item.cc:6708
#10 0x560b14a2bd00 in Item_field::save_in_field(Field*, bool) /data/src/10.3/sql/item.cc:6759
#11 0x560b14571036 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.3/sql/table.cc:7814
#12 0x560b149cde63 in handler::ha_index_next(unsigned char*) /data/src/10.3/sql/handler.cc:2928
#13 0x560b149e05db in handler::read_range_next() /data/src/10.3/sql/handler.cc:5702
#14 0x560b146a996f in handler::multi_range_read_next(void**) /data/src/10.3/sql/multi_range_read.cc:271
#15 0x560b146aa060 in Mrr_simple_index_reader::get_next(void**) /data/src/10.3/sql/multi_range_read.cc:336
#16 0x560b146b3182 in DsMrr_impl::dsmrr_next(void**) /data/src/10.3/sql/multi_range_read.cc:1406
#17 0x560b158b3be3 in ha_myisam::multi_range_read_next(void**) /data/src/10.3/storage/myisam/ha_myisam.cc:2495
#18 0x560b15a2e543 in ha_partition::handle_ordered_next(unsigned char*, bool) /data/src/10.3/sql/ha_partition.cc:7824
#19 0x560b15a225fb in ha_partition::multi_range_read_next(void**) /data/src/10.3/sql/ha_partition.cc:6486
#20 0x560b14d4a2d2 in QUICK_RANGE_SELECT::get_next() /data/src/10.3/sql/opt_range.cc:11470
#21 0x560b149ad646 in find_all_keys /data/src/10.3/sql/filesort.cc:776
#22 0x560b149a9ef5 in filesort(THD, TABLE, Filesort, Filesort_tracker, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278
#23 0x560b1451032a in mysql_update(THD, TABLE_LIST, List<Item>&, List<Item>&, Item, unsigned int, st_order, unsigned long long, enum_duplicates, bool, unsigned long long, unsigned long long) /data/src/10.3/sql/sql_update.cc:672
#24 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584
#25 0x560b142c0fa2 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
#26 0x560b1429b07a in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
#27 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
#28 0x560b1460b861 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
#29 0x560b1460b26d in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309

Thread T5 created by T0 here:
#0 0x7f657c4e6bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
#1 0x560b15140911 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
#2 0x560b14002c08 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
#3 0x560b14018d9a in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6573
#4 0x560b1401949f in create_new_thread /data/src/10.3/sql/mysqld.cc:6643
#5 0x560b1401a4b6 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6918
#6 0x560b14018257 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6195
#7 0x560b14000c8f in main /data/src/10.3/sql/main.cc:25
#8 0x7f657a5cb2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/strings/ctype-simple.c:87 my_strnxfrm_simple_internal
Shadow bytes around the buggy address:
0x0c187fffcbc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c187fffcbd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c187fffcbe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
0x0c187fffcbf0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c187fffcc00: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
=>0x0c187fffcc10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
0x0c187fffcc20: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c187fffcc30: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
0x0c187fffcc40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c187fffcc50: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c187fffcc60: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==6107==ABORTING

Or with valgrind:

==6629== Invalid read of size 1

==6629==    at 0x1303139: my_strnxfrm_simple_internal (ctype-simple.c:87)

==6629==    by 0x13031FD: my_strnxfrm_simple (ctype-simple.c:105)

==6629==    by 0xAAD2FC: Field_blob::sort_string(unsigned char*, unsigned int) (field.cc:8578)

==6629==    by 0xA8B34F: Field::make_sort_key(unsigned char*, unsigned int) (field.cc:1018)

==6629==    by 0xAC6991: make_sortkey(Sort_param*, unsigned char*, unsigned char*) (filesort.cc:1165)

==6629==    by 0xAC98E6: Bounded_queue<unsigned char, unsigned char>::push(unsigned char*) (bounded_queue.h:184)

==6629==    by 0xAC5A97: find_all_keys(THD*, Sort_param*, SQL_SELECT*, SORT_INFO*, st_io_cache*, st_io_cache*, Bounded_queue<unsigned char, unsigned char>*, unsigned long long*) (filesort.cc:832)

==6629==    by 0xAC3E00: filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) (filesort.cc:278)

==6629==    by 0x8C0655: mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) (sql_update.cc:672)

==6629==    by 0x7C5FC8: mysql_execute_command(THD*) (sql_parse.cc:4584)

==6629==    by 0x7D14E4: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:8095)

==6629==    by 0x7BE54C: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1854)

==6629==    by 0x7BCF24: do_command(THD*) (sql_parse.cc:1396)

==6629==    by 0x92B078: do_handle_one_connection(CONNECT*) (sql_connect.cc:1403)

==6629==    by 0x92ADFC: handle_one_connection (sql_connect.cc:1309)

==6629==    by 0xDE91AA: pfs_spawn_thread (pfs.cc:1862)

==6629==  Address 0xd9c92a8 is 8 bytes inside a block of size 16 free'd

==6629==    at 0x4C2CDDB: free (vg_replace_malloc.c:530)

==6629==    by 0x12C442D: my_free (my_malloc.c:223)

==6629==    by 0x6A7D12: String::free() (sql_string.h:358)

==6629==    by 0x6C6A19: String::set(char const*, unsigned long, charset_info_st const*) (sql_string.h:278)

==6629==    by 0xAAC726: Field_blob::val_str(String*, String*) (field.cc:8357)

==6629==    by 0x6B85C0: Field::val_str(String*) (field.h:840)

==6629==    by 0xABCA46: Field_blob::store_field(Field*) (field.h:3631)

==6629==    by 0xAC1C5E: field_conv_incompatible(Field*, Field*) (field_conv.cc:836)

==6629==    by 0xAC1CBA: field_conv(Field*, Field*) (field_conv.cc:849)

==6629==    by 0xAF6C93: save_field_in_field(Field*, bool*, Field*, bool) (item.cc:6708)

==6629==    by 0xAF6ED5: Item_field::save_in_field(Field*, bool) (item.cc:6759)

==6629==    by 0x8E6B02: TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) (table.cc:7814)

==6629==    by 0xAD29B1: handler::ha_index_next(unsigned char*) (handler.cc:2928)

==6629==    by 0xAD98B9: handler::read_range_next() (handler.cc:5702)

==6629==    by 0x97B559: handler::multi_range_read_next(void**) (multi_range_read.cc:271)

==6629==    by 0x97B7F1: Mrr_simple_index_reader::get_next(void**) (multi_range_read.cc:336)

==6629==  Block was alloc'd at

==6629==    at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)

==6629==    by 0x12C3CB3: my_malloc (my_malloc.c:101)

==6629==    by 0x886C97: String::realloc_raw(unsigned long) (sql_string.cc:101)

==6629==    by 0x6A7D66: String::realloc(unsigned long) (sql_string.h:374)

==6629==    by 0x8871A3: String::copy() (sql_string.cc:212)

==6629==    by 0xABCAB1: Field_blob::store_field(Field*) (field.h:3634)

==6629==    by 0xAC1C5E: field_conv_incompatible(Field*, Field*) (field_conv.cc:836)

==6629==    by 0xAC1CBA: field_conv(Field*, Field*) (field_conv.cc:849)

==6629==    by 0xAF6C93: save_field_in_field(Field*, bool*, Field*, bool) (item.cc:6708)

==6629==    by 0xAF6ED5: Item_field::save_in_field(Field*, bool) (item.cc:6759)

==6629==    by 0x8E6B02: TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) (table.cc:7814)

==6629==    by 0xAD29B1: handler::ha_index_next(unsigned char*) (handler.cc:2928)

==6629==    by 0xAD98B9: handler::read_range_next() (handler.cc:5702)

==6629==    by 0x97B559: handler::multi_range_read_next(void**) (multi_range_read.cc:271)

==6629==    by 0x97B7F1: Mrr_simple_index_reader::get_next(void**) (multi_range_read.cc:336)

==6629==    by 0x97E441: DsMrr_impl::dsmrr_next(void**) (multi_range_read.cc:1406)

Not reproducible on 10.4.

Attachments

Issue Links

relates to

MDEV-18957 UPDATE with LIMIT clause is wrong for versioned partitioned tables

Closed

MDEV-18414 Server crash or ASAN heap-use-after-free in my_strtod_int / Value_source::Converter_strntod::Converter_strntod

Closed

Activity

Ascending order - Click to sort in descending order

Elena Stepanova created issue - 2019-02-25 19:03

Alexander Krizhanovsky made changes - 2019-03-08 16:57

Field	Original Value	New Value
Assignee	Alexander Krizhanovsky [ krizhanovsky ]	Aleksey Midenkov [ midenok ]

Aleksey Midenkov made changes - 2019-03-11 18:28

Component/s		Virtual Columns [ 10803 ]
Component/s	Versioned Tables [ 14303 ]

Aleksey Midenkov made changes - 2019-03-11 19:18

Status

Open [ 1 ]

In Progress [ 3 ]

Aleksey Midenkov made changes - 2019-03-18 11:55

Link

This issue relates to ~~MDEV-18957~~ [ ~~MDEV-18957~~ ]

Aleksey Midenkov made changes - 2019-03-19 18:21

Fix Version/s		10.2 [ 14601 ]
Fix Version/s		10.4 [ 22408 ]
Affects Version/s		10.2 [ 14601 ]
Affects Version/s		10.4 [ 22408 ]

Aleksey Midenkov made changes - 2019-03-19 18:40

Assignee	Aleksey Midenkov [ midenok ]	Sergei Golubchik [ serg ]
Status	In Progress [ 3 ]	In Review [ 10002 ]

Sergei Golubchik made changes - 2019-03-21 19:25

Assignee	Sergei Golubchik [ serg ]	Aleksey Midenkov [ midenok ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Aleksey Midenkov made changes - 2019-04-05 16:20

Assignee

Aleksey Midenkov [ midenok ]

Sergei Golubchik [ serg ]

Aleksey Midenkov made changes - 2019-11-25 18:08

Assignee

Sergei Golubchik [ serg ]

Aleksey Midenkov [ midenok ]

Aleksey Midenkov made changes - 2019-11-25 18:08

Comment

[ A comment with security level 'Developers' was removed. ]

Aleksey Midenkov made changes - 2019-11-26 14:19

Fix Version/s	10.2 [ 14601 ]
Affects Version/s	10.2 [ 14601 ]

Aleksey Midenkov made changes - 2019-11-26 14:20

Fix Version/s		10.2 [ 14601 ]
Affects Version/s		10.2 [ 14601 ]

Aleksey Midenkov made changes - 2019-11-26 14:22

Description

{code:sql}
--source include/have_partition.inc

CREATE TABLE t1 (
  pk INT AUTO_INCREMENT,
  b TINYTEXT DEFAULT '',
  i INT,
  v TEXT AS (b) VIRTUAL,
  PRIMARY KEY(pk)
) WITH SYSTEM VERSIONING PARTITION BY system_time LIMIT 100 ( PARTITION p1 HISTORY, PARTITION pn CURRENT );

INSERT INTO t1 (pk) VALUES (NULL),(NULL),(NULL),(NULL);
UPDATE t1 SET b = 'foo' WHERE pk = 3;
REPLACE INTO t1 (pk, b, i) SELECT pk, b, i FROM t1;
INSERT INTO t1 (pk) VALUES (NULL);
UPDATE t1 SET i = 10 WHERE pk < 20 ORDER BY v LIMIT 2;

# Cleanup
DROP TABLE t1;
{code}

{noformat:title=10.4 09bd2138}
==6107==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000260f0 at pc 0x560b15b508f0 bp 0x7f656fcd5e10 sp 0x7f656fcd5e08
READ of size 1 at 0x60c0000260f0 thread T5
    #0 0x560b15b508ef in my_strnxfrm_simple_internal /data/src/10.3/strings/ctype-simple.c:87
    #1 0x560b15b50ace in my_strnxfrm_simple /data/src/10.3/strings/ctype-simple.c:105
    #2 0x560b1497107f in Field_blob::sort_string(unsigned char*, unsigned int) /data/src/10.3/sql/field.cc:8578
    #3 0x560b1490ea56 in Field::make_sort_key(unsigned char*, unsigned int) /data/src/10.3/sql/field.cc:1018
    #4 0x560b149b0377 in make_sortkey /data/src/10.3/sql/filesort.cc:1165
    #5 0x560b149b7a45 in Bounded_queue<unsigned char, unsigned char>::push(unsigned char*) (/data/bld/10.3-asan/bin/mysqld+0x1566a45)
    #6 0x560b149adb9f in find_all_keys /data/src/10.3/sql/filesort.cc:832
    #7 0x560b149a9ef5 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278
    #8 0x560b1451032a in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.3/sql/sql_update.cc:672
    #9 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584
    #10 0x560b142c0fa2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
    #11 0x560b1429b07a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
    #12 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
    #13 0x560b1460b861 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
    #14 0x560b1460b26d in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309
    #15 0x560b15140349 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
    #16 0x7f657c2ad493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
    #17 0x7f657a69393e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x60c0000260f0 is located 112 bytes inside of 124-byte region [0x60c000026080,0x60c0000260fc)
freed by thread T5 here:
    #0 0x7f657c517527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
    #1 0x560b15af026f in free_memory /data/src/10.3/mysys/safemalloc.c:279
    #2 0x560b15aef875 in sf_free /data/src/10.3/mysys/safemalloc.c:197
    #3 0x560b15ac02be in my_free /data/src/10.3/mysys/my_malloc.c:223
    #4 0x560b14027585 in String::free() /data/src/10.3/sql/sql_string.h:358
    #5 0x560b1406c285 in String::set(char const*, unsigned long, charset_info_st const*) /data/src/10.3/sql/sql_string.h:278
    #6 0x560b1496e849 in Field_blob::val_str(String*, String*) /data/src/10.3/sql/field.cc:8357
    #7 0x560b1404d01b in Field::val_str(String*) /data/src/10.3/sql/field.h:840
    #8 0x560b149974da in Field_blob::store_field(Field*) /data/src/10.3/sql/field.h:3631
    #9 0x560b149a5967 in field_conv_incompatible /data/src/10.3/sql/field_conv.cc:836
    #10 0x560b149a5a04 in field_conv(Field*, Field*) /data/src/10.3/sql/field_conv.cc:849
    #11 0x560b14a2b6a4 in save_field_in_field /data/src/10.3/sql/item.cc:6708
    #12 0x560b14a2bd00 in Item_field::save_in_field(Field*, bool) /data/src/10.3/sql/item.cc:6759
    #13 0x560b14571036 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.3/sql/table.cc:7814
    #14 0x560b149cde63 in handler::ha_index_next(unsigned char*) /data/src/10.3/sql/handler.cc:2928
    #15 0x560b149e05db in handler::read_range_next() /data/src/10.3/sql/handler.cc:5702
    #16 0x560b146a996f in handler::multi_range_read_next(void**) /data/src/10.3/sql/multi_range_read.cc:271
    #17 0x560b146aa060 in Mrr_simple_index_reader::get_next(void**) /data/src/10.3/sql/multi_range_read.cc:336
    #18 0x560b146b3182 in DsMrr_impl::dsmrr_next(void**) /data/src/10.3/sql/multi_range_read.cc:1406
    #19 0x560b158b3be3 in ha_myisam::multi_range_read_next(void**) /data/src/10.3/storage/myisam/ha_myisam.cc:2495
    #20 0x560b15a2e543 in ha_partition::handle_ordered_next(unsigned char*, bool) /data/src/10.3/sql/ha_partition.cc:7824
    #21 0x560b15a225fb in ha_partition::multi_range_read_next(void**) /data/src/10.3/sql/ha_partition.cc:6486
    #22 0x560b14d4a2d2 in QUICK_RANGE_SELECT::get_next() /data/src/10.3/sql/opt_range.cc:11470
    #23 0x560b149ad646 in find_all_keys /data/src/10.3/sql/filesort.cc:776
    #24 0x560b149a9ef5 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278
    #25 0x560b1451032a in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.3/sql/sql_update.cc:672
    #26 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584
    #27 0x560b142c0fa2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
    #28 0x560b1429b07a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
    #29 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396

previously allocated by thread T5 here:
    #0 0x7f657c51773f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
    #1 0x560b15aeefe5 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
    #2 0x560b15abf8e0 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
    #3 0x560b14488f2b in String::realloc_raw(unsigned long) /data/src/10.3/sql/sql_string.cc:101
    #4 0x560b140276ac in String::realloc(unsigned long) /data/src/10.3/sql/sql_string.h:374
    #5 0x560b14489d45 in String::copy() /data/src/10.3/sql/sql_string.cc:212
    #6 0x560b149975e3 in Field_blob::store_field(Field*) /data/src/10.3/sql/field.h:3634
    #7 0x560b149a5967 in field_conv_incompatible /data/src/10.3/sql/field_conv.cc:836
    #8 0x560b149a5a04 in field_conv(Field*, Field*) /data/src/10.3/sql/field_conv.cc:849
    #9 0x560b14a2b6a4 in save_field_in_field /data/src/10.3/sql/item.cc:6708
    #10 0x560b14a2bd00 in Item_field::save_in_field(Field*, bool) /data/src/10.3/sql/item.cc:6759
    #11 0x560b14571036 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.3/sql/table.cc:7814
    #12 0x560b149cde63 in handler::ha_index_next(unsigned char*) /data/src/10.3/sql/handler.cc:2928
    #13 0x560b149e05db in handler::read_range_next() /data/src/10.3/sql/handler.cc:5702
    #14 0x560b146a996f in handler::multi_range_read_next(void**) /data/src/10.3/sql/multi_range_read.cc:271
    #15 0x560b146aa060 in Mrr_simple_index_reader::get_next(void**) /data/src/10.3/sql/multi_range_read.cc:336
    #16 0x560b146b3182 in DsMrr_impl::dsmrr_next(void**) /data/src/10.3/sql/multi_range_read.cc:1406
    #17 0x560b158b3be3 in ha_myisam::multi_range_read_next(void**) /data/src/10.3/storage/myisam/ha_myisam.cc:2495
    #18 0x560b15a2e543 in ha_partition::handle_ordered_next(unsigned char*, bool) /data/src/10.3/sql/ha_partition.cc:7824
    #19 0x560b15a225fb in ha_partition::multi_range_read_next(void**) /data/src/10.3/sql/ha_partition.cc:6486
    #20 0x560b14d4a2d2 in QUICK_RANGE_SELECT::get_next() /data/src/10.3/sql/opt_range.cc:11470
    #21 0x560b149ad646 in find_all_keys /data/src/10.3/sql/filesort.cc:776
    #22 0x560b149a9ef5 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278
    #23 0x560b1451032a in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.3/sql/sql_update.cc:672
    #24 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584
    #25 0x560b142c0fa2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
    #26 0x560b1429b07a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
    #27 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
    #28 0x560b1460b861 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
    #29 0x560b1460b26d in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309

Thread T5 created by T0 here:
    #0 0x7f657c4e6bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
    #1 0x560b15140911 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
    #2 0x560b14002c08 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
    #3 0x560b14018d9a in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6573
    #4 0x560b1401949f in create_new_thread /data/src/10.3/sql/mysqld.cc:6643
    #5 0x560b1401a4b6 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6918
    #6 0x560b14018257 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6195
    #7 0x560b14000c8f in main /data/src/10.3/sql/main.cc:25
    #8 0x7f657a5cb2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/strings/ctype-simple.c:87 my_strnxfrm_simple_internal
Shadow bytes around the buggy address:
  0x0c187fffcbc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffcbd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffcbe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
  0x0c187fffcbf0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c187fffcc00: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
=>0x0c187fffcc10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
  0x0c187fffcc20: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c187fffcc30: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffcc40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c187fffcc50: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c187fffcc60: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable: 00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone: fa
  Heap right redzone: fb
  Freed heap region: fd
  Stack left redzone: f1
  Stack mid redzone: f2
  Stack right redzone: f3
  Stack partial redzone: f4
  Stack after return: f5
  Stack use after scope: f8
  Global redzone: f9
  Global init order: f6
  Poisoned by user: f7
  Contiguous container OOB:fc
  ASan internal: fe
==6107==ABORTING
{noformat}

Or with valgrind:
{noformat}
==6629== Invalid read of size 1
==6629== at 0x1303139: my_strnxfrm_simple_internal (ctype-simple.c:87)
==6629== by 0x13031FD: my_strnxfrm_simple (ctype-simple.c:105)
==6629== by 0xAAD2FC: Field_blob::sort_string(unsigned char*, unsigned int) (field.cc:8578)
==6629== by 0xA8B34F: Field::make_sort_key(unsigned char*, unsigned int) (field.cc:1018)
==6629== by 0xAC6991: make_sortkey(Sort_param*, unsigned char*, unsigned char*) (filesort.cc:1165)
==6629== by 0xAC98E6: Bounded_queue<unsigned char, unsigned char>::push(unsigned char*) (bounded_queue.h:184)
==6629== by 0xAC5A97: find_all_keys(THD*, Sort_param*, SQL_SELECT*, SORT_INFO*, st_io_cache*, st_io_cache*, Bounded_queue<unsigned char, unsigned char>*, unsigned long long*) (filesort.cc:832)
==6629== by 0xAC3E00: filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) (filesort.cc:278)
==6629== by 0x8C0655: mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) (sql_update.cc:672)
==6629== by 0x7C5FC8: mysql_execute_command(THD*) (sql_parse.cc:4584)
==6629== by 0x7D14E4: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:8095)
==6629== by 0x7BE54C: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1854)
==6629== by 0x7BCF24: do_command(THD*) (sql_parse.cc:1396)
==6629== by 0x92B078: do_handle_one_connection(CONNECT*) (sql_connect.cc:1403)
==6629== by 0x92ADFC: handle_one_connection (sql_connect.cc:1309)
==6629== by 0xDE91AA: pfs_spawn_thread (pfs.cc:1862)
==6629== Address 0xd9c92a8 is 8 bytes inside a block of size 16 free'd
==6629== at 0x4C2CDDB: free (vg_replace_malloc.c:530)
==6629== by 0x12C442D: my_free (my_malloc.c:223)
==6629== by 0x6A7D12: String::free() (sql_string.h:358)
==6629== by 0x6C6A19: String::set(char const*, unsigned long, charset_info_st const*) (sql_string.h:278)
==6629== by 0xAAC726: Field_blob::val_str(String*, String*) (field.cc:8357)
==6629== by 0x6B85C0: Field::val_str(String*) (field.h:840)
==6629== by 0xABCA46: Field_blob::store_field(Field*) (field.h:3631)
==6629== by 0xAC1C5E: field_conv_incompatible(Field*, Field*) (field_conv.cc:836)
==6629== by 0xAC1CBA: field_conv(Field*, Field*) (field_conv.cc:849)
==6629== by 0xAF6C93: save_field_in_field(Field*, bool*, Field*, bool) (item.cc:6708)
==6629== by 0xAF6ED5: Item_field::save_in_field(Field*, bool) (item.cc:6759)
==6629== by 0x8E6B02: TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) (table.cc:7814)
==6629== by 0xAD29B1: handler::ha_index_next(unsigned char*) (handler.cc:2928)
==6629== by 0xAD98B9: handler::read_range_next() (handler.cc:5702)
==6629== by 0x97B559: handler::multi_range_read_next(void**) (multi_range_read.cc:271)
==6629== by 0x97B7F1: Mrr_simple_index_reader::get_next(void**) (multi_range_read.cc:336)
==6629== Block was alloc'd at
==6629== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)
==6629== by 0x12C3CB3: my_malloc (my_malloc.c:101)
==6629== by 0x886C97: String::realloc_raw(unsigned long) (sql_string.cc:101)
==6629== by 0x6A7D66: String::realloc(unsigned long) (sql_string.h:374)
==6629== by 0x8871A3: String::copy() (sql_string.cc:212)
==6629== by 0xABCAB1: Field_blob::store_field(Field*) (field.h:3634)
==6629== by 0xAC1C5E: field_conv_incompatible(Field*, Field*) (field_conv.cc:836)
==6629== by 0xAC1CBA: field_conv(Field*, Field*) (field_conv.cc:849)
==6629== by 0xAF6C93: save_field_in_field(Field*, bool*, Field*, bool) (item.cc:6708)
==6629== by 0xAF6ED5: Item_field::save_in_field(Field*, bool) (item.cc:6759)
==6629== by 0x8E6B02: TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) (table.cc:7814)
==6629== by 0xAD29B1: handler::ha_index_next(unsigned char*) (handler.cc:2928)
==6629== by 0xAD98B9: handler::read_range_next() (handler.cc:5702)
==6629== by 0x97B559: handler::multi_range_read_next(void**) (multi_range_read.cc:271)
==6629== by 0x97B7F1: Mrr_simple_index_reader::get_next(void**) (multi_range_read.cc:336)
==6629== by 0x97E441: DsMrr_impl::dsmrr_next(void**) (multi_range_read.cc:1406)
{noformat}

Not reproducible on 10.4.

h3. ASAN heap-use-after-free in my_strnxfrm_simple_internal upon update on versioned partitioned table.

{code:sql}
--source include/have_partition.inc

CREATE TABLE t1 (
  pk INT AUTO_INCREMENT,
  b TINYTEXT DEFAULT '',
  i INT,
  v TEXT AS (b) VIRTUAL,
  PRIMARY KEY(pk)
) WITH SYSTEM VERSIONING PARTITION BY system_time LIMIT 100 ( PARTITION p1 HISTORY, PARTITION pn CURRENT );

INSERT INTO t1 (pk) VALUES (NULL),(NULL),(NULL),(NULL);
UPDATE t1 SET b = 'foo' WHERE pk = 3;
REPLACE INTO t1 (pk, b, i) SELECT pk, b, i FROM t1;
INSERT INTO t1 (pk) VALUES (NULL);
UPDATE t1 SET i = 10 WHERE pk < 20 ORDER BY v LIMIT 2;

# Cleanup
DROP TABLE t1;
{code}

{noformat:title=10.4 09bd2138}
==6107==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000260f0 at pc 0x560b15b508f0 bp 0x7f656fcd5e10 sp 0x7f656fcd5e08
READ of size 1 at 0x60c0000260f0 thread T5
    #0 0x560b15b508ef in my_strnxfrm_simple_internal /data/src/10.3/strings/ctype-simple.c:87
    #1 0x560b15b50ace in my_strnxfrm_simple /data/src/10.3/strings/ctype-simple.c:105
    #2 0x560b1497107f in Field_blob::sort_string(unsigned char*, unsigned int) /data/src/10.3/sql/field.cc:8578
    #3 0x560b1490ea56 in Field::make_sort_key(unsigned char*, unsigned int) /data/src/10.3/sql/field.cc:1018
    #4 0x560b149b0377 in make_sortkey /data/src/10.3/sql/filesort.cc:1165
    #5 0x560b149b7a45 in Bounded_queue<unsigned char, unsigned char>::push(unsigned char*) (/data/bld/10.3-asan/bin/mysqld+0x1566a45)
    #6 0x560b149adb9f in find_all_keys /data/src/10.3/sql/filesort.cc:832
    #7 0x560b149a9ef5 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278
    #8 0x560b1451032a in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.3/sql/sql_update.cc:672
    #9 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584
    #10 0x560b142c0fa2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
    #11 0x560b1429b07a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
    #12 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
    #13 0x560b1460b861 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
    #14 0x560b1460b26d in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309
    #15 0x560b15140349 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
    #16 0x7f657c2ad493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
    #17 0x7f657a69393e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x60c0000260f0 is located 112 bytes inside of 124-byte region [0x60c000026080,0x60c0000260fc)
freed by thread T5 here:
    #0 0x7f657c517527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
    #1 0x560b15af026f in free_memory /data/src/10.3/mysys/safemalloc.c:279
    #2 0x560b15aef875 in sf_free /data/src/10.3/mysys/safemalloc.c:197
    #3 0x560b15ac02be in my_free /data/src/10.3/mysys/my_malloc.c:223
    #4 0x560b14027585 in String::free() /data/src/10.3/sql/sql_string.h:358
    #5 0x560b1406c285 in String::set(char const*, unsigned long, charset_info_st const*) /data/src/10.3/sql/sql_string.h:278
    #6 0x560b1496e849 in Field_blob::val_str(String*, String*) /data/src/10.3/sql/field.cc:8357
    #7 0x560b1404d01b in Field::val_str(String*) /data/src/10.3/sql/field.h:840
    #8 0x560b149974da in Field_blob::store_field(Field*) /data/src/10.3/sql/field.h:3631
    #9 0x560b149a5967 in field_conv_incompatible /data/src/10.3/sql/field_conv.cc:836
    #10 0x560b149a5a04 in field_conv(Field*, Field*) /data/src/10.3/sql/field_conv.cc:849
    #11 0x560b14a2b6a4 in save_field_in_field /data/src/10.3/sql/item.cc:6708
    #12 0x560b14a2bd00 in Item_field::save_in_field(Field*, bool) /data/src/10.3/sql/item.cc:6759
    #13 0x560b14571036 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.3/sql/table.cc:7814
    #14 0x560b149cde63 in handler::ha_index_next(unsigned char*) /data/src/10.3/sql/handler.cc:2928
    #15 0x560b149e05db in handler::read_range_next() /data/src/10.3/sql/handler.cc:5702
    #16 0x560b146a996f in handler::multi_range_read_next(void**) /data/src/10.3/sql/multi_range_read.cc:271
    #17 0x560b146aa060 in Mrr_simple_index_reader::get_next(void**) /data/src/10.3/sql/multi_range_read.cc:336
    #18 0x560b146b3182 in DsMrr_impl::dsmrr_next(void**) /data/src/10.3/sql/multi_range_read.cc:1406
    #19 0x560b158b3be3 in ha_myisam::multi_range_read_next(void**) /data/src/10.3/storage/myisam/ha_myisam.cc:2495
    #20 0x560b15a2e543 in ha_partition::handle_ordered_next(unsigned char*, bool) /data/src/10.3/sql/ha_partition.cc:7824
    #21 0x560b15a225fb in ha_partition::multi_range_read_next(void**) /data/src/10.3/sql/ha_partition.cc:6486
    #22 0x560b14d4a2d2 in QUICK_RANGE_SELECT::get_next() /data/src/10.3/sql/opt_range.cc:11470
    #23 0x560b149ad646 in find_all_keys /data/src/10.3/sql/filesort.cc:776
    #24 0x560b149a9ef5 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278
    #25 0x560b1451032a in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.3/sql/sql_update.cc:672
    #26 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584
    #27 0x560b142c0fa2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
    #28 0x560b1429b07a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
    #29 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396

previously allocated by thread T5 here:
    #0 0x7f657c51773f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
    #1 0x560b15aeefe5 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
    #2 0x560b15abf8e0 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
    #3 0x560b14488f2b in String::realloc_raw(unsigned long) /data/src/10.3/sql/sql_string.cc:101
    #4 0x560b140276ac in String::realloc(unsigned long) /data/src/10.3/sql/sql_string.h:374
    #5 0x560b14489d45 in String::copy() /data/src/10.3/sql/sql_string.cc:212
    #6 0x560b149975e3 in Field_blob::store_field(Field*) /data/src/10.3/sql/field.h:3634
    #7 0x560b149a5967 in field_conv_incompatible /data/src/10.3/sql/field_conv.cc:836
    #8 0x560b149a5a04 in field_conv(Field*, Field*) /data/src/10.3/sql/field_conv.cc:849
    #9 0x560b14a2b6a4 in save_field_in_field /data/src/10.3/sql/item.cc:6708
    #10 0x560b14a2bd00 in Item_field::save_in_field(Field*, bool) /data/src/10.3/sql/item.cc:6759
    #11 0x560b14571036 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.3/sql/table.cc:7814
    #12 0x560b149cde63 in handler::ha_index_next(unsigned char*) /data/src/10.3/sql/handler.cc:2928
    #13 0x560b149e05db in handler::read_range_next() /data/src/10.3/sql/handler.cc:5702
    #14 0x560b146a996f in handler::multi_range_read_next(void**) /data/src/10.3/sql/multi_range_read.cc:271
    #15 0x560b146aa060 in Mrr_simple_index_reader::get_next(void**) /data/src/10.3/sql/multi_range_read.cc:336
    #16 0x560b146b3182 in DsMrr_impl::dsmrr_next(void**) /data/src/10.3/sql/multi_range_read.cc:1406
    #17 0x560b158b3be3 in ha_myisam::multi_range_read_next(void**) /data/src/10.3/storage/myisam/ha_myisam.cc:2495
    #18 0x560b15a2e543 in ha_partition::handle_ordered_next(unsigned char*, bool) /data/src/10.3/sql/ha_partition.cc:7824
    #19 0x560b15a225fb in ha_partition::multi_range_read_next(void**) /data/src/10.3/sql/ha_partition.cc:6486
    #20 0x560b14d4a2d2 in QUICK_RANGE_SELECT::get_next() /data/src/10.3/sql/opt_range.cc:11470
    #21 0x560b149ad646 in find_all_keys /data/src/10.3/sql/filesort.cc:776
    #22 0x560b149a9ef5 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278
    #23 0x560b1451032a in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.3/sql/sql_update.cc:672
    #24 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584
    #25 0x560b142c0fa2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
    #26 0x560b1429b07a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
    #27 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
    #28 0x560b1460b861 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
    #29 0x560b1460b26d in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309

Thread T5 created by T0 here:
    #0 0x7f657c4e6bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
    #1 0x560b15140911 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
    #2 0x560b14002c08 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
    #3 0x560b14018d9a in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6573
    #4 0x560b1401949f in create_new_thread /data/src/10.3/sql/mysqld.cc:6643
    #5 0x560b1401a4b6 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6918
    #6 0x560b14018257 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6195
    #7 0x560b14000c8f in main /data/src/10.3/sql/main.cc:25
    #8 0x7f657a5cb2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/strings/ctype-simple.c:87 my_strnxfrm_simple_internal
Shadow bytes around the buggy address:
  0x0c187fffcbc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffcbd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffcbe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
  0x0c187fffcbf0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c187fffcc00: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
=>0x0c187fffcc10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
  0x0c187fffcc20: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c187fffcc30: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffcc40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c187fffcc50: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c187fffcc60: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable: 00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone: fa
  Heap right redzone: fb
  Freed heap region: fd
  Stack left redzone: f1
  Stack mid redzone: f2
  Stack right redzone: f3
  Stack partial redzone: f4
  Stack after return: f5
  Stack use after scope: f8
  Global redzone: f9
  Global init order: f6
  Poisoned by user: f7
  Contiguous container OOB:fc
  ASan internal: fe
==6107==ABORTING
{noformat}

Or with valgrind:
{noformat}
==6629== Invalid read of size 1
==6629== at 0x1303139: my_strnxfrm_simple_internal (ctype-simple.c:87)
==6629== by 0x13031FD: my_strnxfrm_simple (ctype-simple.c:105)
==6629== by 0xAAD2FC: Field_blob::sort_string(unsigned char*, unsigned int) (field.cc:8578)
==6629== by 0xA8B34F: Field::make_sort_key(unsigned char*, unsigned int) (field.cc:1018)
==6629== by 0xAC6991: make_sortkey(Sort_param*, unsigned char*, unsigned char*) (filesort.cc:1165)
==6629== by 0xAC98E6: Bounded_queue<unsigned char, unsigned char>::push(unsigned char*) (bounded_queue.h:184)
==6629== by 0xAC5A97: find_all_keys(THD*, Sort_param*, SQL_SELECT*, SORT_INFO*, st_io_cache*, st_io_cache*, Bounded_queue<unsigned char, unsigned char>*, unsigned long long*) (filesort.cc:832)
==6629== by 0xAC3E00: filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) (filesort.cc:278)
==6629== by 0x8C0655: mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) (sql_update.cc:672)
==6629== by 0x7C5FC8: mysql_execute_command(THD*) (sql_parse.cc:4584)
==6629== by 0x7D14E4: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:8095)
==6629== by 0x7BE54C: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1854)
==6629== by 0x7BCF24: do_command(THD*) (sql_parse.cc:1396)
==6629== by 0x92B078: do_handle_one_connection(CONNECT*) (sql_connect.cc:1403)
==6629== by 0x92ADFC: handle_one_connection (sql_connect.cc:1309)
==6629== by 0xDE91AA: pfs_spawn_thread (pfs.cc:1862)
==6629== Address 0xd9c92a8 is 8 bytes inside a block of size 16 free'd
==6629== at 0x4C2CDDB: free (vg_replace_malloc.c:530)
==6629== by 0x12C442D: my_free (my_malloc.c:223)
==6629== by 0x6A7D12: String::free() (sql_string.h:358)
==6629== by 0x6C6A19: String::set(char const*, unsigned long, charset_info_st const*) (sql_string.h:278)
==6629== by 0xAAC726: Field_blob::val_str(String*, String*) (field.cc:8357)
==6629== by 0x6B85C0: Field::val_str(String*) (field.h:840)
==6629== by 0xABCA46: Field_blob::store_field(Field*) (field.h:3631)
==6629== by 0xAC1C5E: field_conv_incompatible(Field*, Field*) (field_conv.cc:836)
==6629== by 0xAC1CBA: field_conv(Field*, Field*) (field_conv.cc:849)
==6629== by 0xAF6C93: save_field_in_field(Field*, bool*, Field*, bool) (item.cc:6708)
==6629== by 0xAF6ED5: Item_field::save_in_field(Field*, bool) (item.cc:6759)
==6629== by 0x8E6B02: TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) (table.cc:7814)
==6629== by 0xAD29B1: handler::ha_index_next(unsigned char*) (handler.cc:2928)
==6629== by 0xAD98B9: handler::read_range_next() (handler.cc:5702)
==6629== by 0x97B559: handler::multi_range_read_next(void**) (multi_range_read.cc:271)
==6629== by 0x97B7F1: Mrr_simple_index_reader::get_next(void**) (multi_range_read.cc:336)
==6629== Block was alloc'd at
==6629== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)
==6629== by 0x12C3CB3: my_malloc (my_malloc.c:101)
==6629== by 0x886C97: String::realloc_raw(unsigned long) (sql_string.cc:101)
==6629== by 0x6A7D66: String::realloc(unsigned long) (sql_string.h:374)
==6629== by 0x8871A3: String::copy() (sql_string.cc:212)
==6629== by 0xABCAB1: Field_blob::store_field(Field*) (field.h:3634)
==6629== by 0xAC1C5E: field_conv_incompatible(Field*, Field*) (field_conv.cc:836)
==6629== by 0xAC1CBA: field_conv(Field*, Field*) (field_conv.cc:849)
==6629== by 0xAF6C93: save_field_in_field(Field*, bool*, Field*, bool) (item.cc:6708)
==6629== by 0xAF6ED5: Item_field::save_in_field(Field*, bool) (item.cc:6759)
==6629== by 0x8E6B02: TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) (table.cc:7814)
==6629== by 0xAD29B1: handler::ha_index_next(unsigned char*) (handler.cc:2928)
==6629== by 0xAD98B9: handler::read_range_next() (handler.cc:5702)
==6629== by 0x97B559: handler::multi_range_read_next(void**) (multi_range_read.cc:271)
==6629== by 0x97B7F1: Mrr_simple_index_reader::get_next(void**) (multi_range_read.cc:336)
==6629== by 0x97E441: DsMrr_impl::dsmrr_next(void**) (multi_range_read.cc:1406)
{noformat}

Not reproducible on 10.4.

Aleksey Midenkov made changes - 2019-11-26 14:23

Summary

ASAN heap-use-after-free in my_strnxfrm_simple_internal upon update on versioned partitioned table

ASAN heap-use-after-free upon update of blob column pointed by virtual column

Alice Sherepa made changes - 2020-04-30 14:04

Link

This issue relates to ~~MDEV-18414~~ [ ~~MDEV-18414~~ ]

Aleksey Midenkov made changes - 2020-08-10 23:10

Status

Stalled [ 10000 ]

In Progress [ 3 ]

Aleksey Midenkov made changes - 2020-08-17 13:04

Assignee	Aleksey Midenkov [ midenok ]	Sergei Golubchik [ serg ]
Status	In Progress [ 3 ]	In Review [ 10002 ]

Sergei Golubchik made changes - 2020-10-21 13:20

Assignee	Sergei Golubchik [ serg ]	Aleksey Midenkov [ midenok ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Aleksey Midenkov made changes - 2020-10-21 21:29

Status

Stalled [ 10000 ]

In Progress [ 3 ]

Aleksey Midenkov made changes - 2020-10-25 16:08

Summary

ASAN heap-use-after-free upon update of blob column pointed by virtual column

ASAN heap-use-after-free upon sorting by blob column from partitioned table

Aleksey Midenkov made changes - 2020-10-26 20:15

Assignee	Aleksey Midenkov [ midenok ]	Sergei Golubchik [ serg ]
Status	In Progress [ 3 ]	In Review [ 10002 ]

Aleksey Midenkov made changes - 2020-11-02 11:29

Comment

[ Please review last 3 commits in bb-10.2-midenok:

0e0a406287143a74fc6b3379cb3d0e4412de36da
07d7712fa9eb593691c08ac8a5757790e2296d48
b3659b54809c456f30bd9f4e0dbe91674deff90d

https://github.com/MariaDB/server/commits/b3659b54809c456f30bd9f4e0dbe91674deff90d ]

Aleksey Midenkov made changes - 2020-11-02 11:29

Comment

[ A comment with security level 'Developers' was removed. ]

Sergei Golubchik made changes - 2020-11-02 20:33

Assignee	Sergei Golubchik [ serg ]	Aleksey Midenkov [ midenok ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Aleksey Midenkov made changes - 2020-11-03 17:17

Comment

[ A comment with security level 'Developers' was removed. ]

Aleksey Midenkov made changes - 2020-11-03 17:18

Assignee	Aleksey Midenkov [ midenok ]	Sergei Golubchik [ serg ]
Status	Stalled [ 10000 ]	In Review [ 10002 ]

Sergei Golubchik made changes - 2021-01-09 15:37

Assignee	Sergei Golubchik [ serg ]	Aleksey Midenkov [ midenok ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Aleksey Midenkov made changes - 2021-01-25 23:02

Assignee	Aleksey Midenkov [ midenok ]	Sergei Golubchik [ serg ]
Status	Stalled [ 10000 ]	In Review [ 10002 ]

Sergei Golubchik made changes - 2021-07-21 20:38

Assignee	Sergei Golubchik [ serg ]	Aleksey Midenkov [ midenok ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Aleksey Midenkov made changes - 2021-07-23 13:57

Status

Stalled [ 10000 ]

In Progress [ 3 ]

Aleksey Midenkov made changes - 2021-07-23 13:58

Assignee	Aleksey Midenkov [ midenok ]	Sergei Golubchik [ serg ]
Status	In Progress [ 3 ]	In Review [ 10002 ]

Aleksey Midenkov made changes - 2021-07-23 14:00

Priority

Major [ 3 ]

Critical [ 2 ]

Sergei Golubchik made changes - 2021-07-26 19:03

Assignee	Sergei Golubchik [ serg ]	Aleksey Midenkov [ midenok ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Aleksey Midenkov made changes - 2021-08-03 08:35

Status

Stalled [ 10000 ]

In Progress [ 3 ]

Aleksey Midenkov made changes - 2021-08-07 10:34

Fix Version/s		10.2.41 [ 26032 ]
Fix Version/s		10.3.32 [ 26029 ]
Fix Version/s		10.4.22 [ 26031 ]
Fix Version/s		10.5.13 [ 26026 ]
Fix Version/s		10.6.5 [ 26034 ]
Fix Version/s	10.2 [ 14601 ]
Fix Version/s	10.3 [ 22126 ]
Fix Version/s	10.4 [ 22408 ]
Resolution		Fixed [ 1 ]
Status	In Progress [ 3 ]	Closed [ 6 ]

Sergei Golubchik made changes - 2021-12-06 21:49

Workflow

MariaDB v3 [ 92845 ]

MariaDB v4 [ 155802 ]

People

Assignee:: Aleksey Midenkov

Reporter:: Elena Stepanova

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Dates

Created:: 2019-02-25 19:03

Updated:: 2021-08-18 15:44

Resolved:: 2021-08-07 10:34

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server

Details

Description

ASAN heap-use-after-free in my_strnxfrm_simple_internal upon update on versioned partitioned table.

Attachments

Issue Links

Activity

People

Dates

Git Integration