ASAN heap-use-after-free upon sorting by blob column from partitioned table

--source include/have_partition.inc

CREATE TABLE t1 ( 

  pk INT AUTO_INCREMENT,

  b TINYTEXT DEFAULT '',

  i INT,

  v TEXT AS (b) VIRTUAL,

  PRIMARY KEY(pk)

) WITH SYSTEM VERSIONING PARTITION BY system_time LIMIT 100 ( PARTITION p1 HISTORY, PARTITION pn CURRENT );

INSERT INTO t1 (pk) VALUES (NULL),(NULL),(NULL),(NULL);

UPDATE t1 SET b = 'foo' WHERE pk = 3;

REPLACE INTO t1 (pk, b, i) SELECT pk, b, i FROM t1;

INSERT INTO t1 (pk) VALUES (NULL);

UPDATE t1 SET i = 10 WHERE pk < 20 ORDER BY v LIMIT 2;

# Cleanup

DROP TABLE t1;

==6107==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000260f0 at pc 0x560b15b508f0 bp 0x7f656fcd5e10 sp 0x7f656fcd5e08

READ of size 1 at 0x60c0000260f0 thread T5

    #0 0x560b15b508ef in my_strnxfrm_simple_internal /data/src/10.3/strings/ctype-simple.c:87

    #1 0x560b15b50ace in my_strnxfrm_simple /data/src/10.3/strings/ctype-simple.c:105

    #2 0x560b1497107f in Field_blob::sort_string(unsigned char*, unsigned int) /data/src/10.3/sql/field.cc:8578

    #3 0x560b1490ea56 in Field::make_sort_key(unsigned char*, unsigned int) /data/src/10.3/sql/field.cc:1018

    #4 0x560b149b0377 in make_sortkey /data/src/10.3/sql/filesort.cc:1165

    #5 0x560b149b7a45 in Bounded_queue<unsigned char, unsigned char>::push(unsigned char*) (/data/bld/10.3-asan/bin/mysqld+0x1566a45)

    #6 0x560b149adb9f in find_all_keys /data/src/10.3/sql/filesort.cc:832

    #7 0x560b149a9ef5 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278

    #8 0x560b1451032a in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.3/sql/sql_update.cc:672

    #9 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584

    #10 0x560b142c0fa2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095

    #11 0x560b1429b07a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854

    #12 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396

    #13 0x560b1460b861 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403

    #14 0x560b1460b26d in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309

    #15 0x560b15140349 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862

    #16 0x7f657c2ad493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

    #17 0x7f657a69393e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x60c0000260f0 is located 112 bytes inside of 124-byte region [0x60c000026080,0x60c0000260fc)

freed by thread T5 here:

    #0 0x7f657c517527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)

    #1 0x560b15af026f in free_memory /data/src/10.3/mysys/safemalloc.c:279

    #2 0x560b15aef875 in sf_free /data/src/10.3/mysys/safemalloc.c:197

    #3 0x560b15ac02be in my_free /data/src/10.3/mysys/my_malloc.c:223

    #4 0x560b14027585 in String::free() /data/src/10.3/sql/sql_string.h:358

    #5 0x560b1406c285 in String::set(char const*, unsigned long, charset_info_st const*) /data/src/10.3/sql/sql_string.h:278

    #6 0x560b1496e849 in Field_blob::val_str(String*, String*) /data/src/10.3/sql/field.cc:8357

    #7 0x560b1404d01b in Field::val_str(String*) /data/src/10.3/sql/field.h:840

    #8 0x560b149974da in Field_blob::store_field(Field*) /data/src/10.3/sql/field.h:3631

    #9 0x560b149a5967 in field_conv_incompatible /data/src/10.3/sql/field_conv.cc:836

    #10 0x560b149a5a04 in field_conv(Field*, Field*) /data/src/10.3/sql/field_conv.cc:849

    #11 0x560b14a2b6a4 in save_field_in_field /data/src/10.3/sql/item.cc:6708

    #12 0x560b14a2bd00 in Item_field::save_in_field(Field*, bool) /data/src/10.3/sql/item.cc:6759

    #13 0x560b14571036 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.3/sql/table.cc:7814

    #14 0x560b149cde63 in handler::ha_index_next(unsigned char*) /data/src/10.3/sql/handler.cc:2928

    #15 0x560b149e05db in handler::read_range_next() /data/src/10.3/sql/handler.cc:5702

    #16 0x560b146a996f in handler::multi_range_read_next(void**) /data/src/10.3/sql/multi_range_read.cc:271

    #17 0x560b146aa060 in Mrr_simple_index_reader::get_next(void**) /data/src/10.3/sql/multi_range_read.cc:336

    #18 0x560b146b3182 in DsMrr_impl::dsmrr_next(void**) /data/src/10.3/sql/multi_range_read.cc:1406

    #19 0x560b158b3be3 in ha_myisam::multi_range_read_next(void**) /data/src/10.3/storage/myisam/ha_myisam.cc:2495

    #20 0x560b15a2e543 in ha_partition::handle_ordered_next(unsigned char*, bool) /data/src/10.3/sql/ha_partition.cc:7824

    #21 0x560b15a225fb in ha_partition::multi_range_read_next(void**) /data/src/10.3/sql/ha_partition.cc:6486

    #22 0x560b14d4a2d2 in QUICK_RANGE_SELECT::get_next() /data/src/10.3/sql/opt_range.cc:11470

    #23 0x560b149ad646 in find_all_keys /data/src/10.3/sql/filesort.cc:776

    #24 0x560b149a9ef5 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278

    #25 0x560b1451032a in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.3/sql/sql_update.cc:672

    #26 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584

    #27 0x560b142c0fa2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095

    #28 0x560b1429b07a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854

    #29 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396

previously allocated by thread T5 here:

    #0 0x7f657c51773f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)

    #1 0x560b15aeefe5 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118

    #2 0x560b15abf8e0 in my_malloc /data/src/10.3/mysys/my_malloc.c:101

    #3 0x560b14488f2b in String::realloc_raw(unsigned long) /data/src/10.3/sql/sql_string.cc:101

    #4 0x560b140276ac in String::realloc(unsigned long) /data/src/10.3/sql/sql_string.h:374

    #5 0x560b14489d45 in String::copy() /data/src/10.3/sql/sql_string.cc:212

    #6 0x560b149975e3 in Field_blob::store_field(Field*) /data/src/10.3/sql/field.h:3634

    #7 0x560b149a5967 in field_conv_incompatible /data/src/10.3/sql/field_conv.cc:836

    #8 0x560b149a5a04 in field_conv(Field*, Field*) /data/src/10.3/sql/field_conv.cc:849

    #9 0x560b14a2b6a4 in save_field_in_field /data/src/10.3/sql/item.cc:6708

    #10 0x560b14a2bd00 in Item_field::save_in_field(Field*, bool) /data/src/10.3/sql/item.cc:6759

    #11 0x560b14571036 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.3/sql/table.cc:7814

    #12 0x560b149cde63 in handler::ha_index_next(unsigned char*) /data/src/10.3/sql/handler.cc:2928

    #13 0x560b149e05db in handler::read_range_next() /data/src/10.3/sql/handler.cc:5702

    #14 0x560b146a996f in handler::multi_range_read_next(void**) /data/src/10.3/sql/multi_range_read.cc:271

    #15 0x560b146aa060 in Mrr_simple_index_reader::get_next(void**) /data/src/10.3/sql/multi_range_read.cc:336

    #16 0x560b146b3182 in DsMrr_impl::dsmrr_next(void**) /data/src/10.3/sql/multi_range_read.cc:1406

    #17 0x560b158b3be3 in ha_myisam::multi_range_read_next(void**) /data/src/10.3/storage/myisam/ha_myisam.cc:2495

    #18 0x560b15a2e543 in ha_partition::handle_ordered_next(unsigned char*, bool) /data/src/10.3/sql/ha_partition.cc:7824

    #19 0x560b15a225fb in ha_partition::multi_range_read_next(void**) /data/src/10.3/sql/ha_partition.cc:6486

    #20 0x560b14d4a2d2 in QUICK_RANGE_SELECT::get_next() /data/src/10.3/sql/opt_range.cc:11470

    #21 0x560b149ad646 in find_all_keys /data/src/10.3/sql/filesort.cc:776

    #22 0x560b149a9ef5 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278

    #23 0x560b1451032a in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.3/sql/sql_update.cc:672

    #24 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584

    #25 0x560b142c0fa2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095

    #26 0x560b1429b07a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854

    #27 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396

    #28 0x560b1460b861 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403

    #29 0x560b1460b26d in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309

Thread T5 created by T0 here:

    #0 0x7f657c4e6bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)

    #1 0x560b15140911 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912

    #2 0x560b14002c08 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268

    #3 0x560b14018d9a in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6573

    #4 0x560b1401949f in create_new_thread /data/src/10.3/sql/mysqld.cc:6643

    #5 0x560b1401a4b6 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6918

    #6 0x560b14018257 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6195

    #7 0x560b14000c8f in main /data/src/10.3/sql/main.cc:25

    #8 0x7f657a5cb2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/strings/ctype-simple.c:87 my_strnxfrm_simple_internal

Shadow bytes around the buggy address:

  0x0c187fffcbc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c187fffcbd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c187fffcbe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04

  0x0c187fffcbf0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00

  0x0c187fffcc00: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa

=>0x0c187fffcc10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd

  0x0c187fffcc20: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c187fffcc30: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa

  0x0c187fffcc40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c187fffcc50: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c187fffcc60: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Contiguous container OOB:fc

  ASan internal:           fe

==6107==ABORTING

==6629== Invalid read of size 1

==6629==    at 0x1303139: my_strnxfrm_simple_internal (ctype-simple.c:87)

==6629==    by 0x13031FD: my_strnxfrm_simple (ctype-simple.c:105)

==6629==    by 0xAAD2FC: Field_blob::sort_string(unsigned char*, unsigned int) (field.cc:8578)

==6629==    by 0xA8B34F: Field::make_sort_key(unsigned char*, unsigned int) (field.cc:1018)

==6629==    by 0xAC6991: make_sortkey(Sort_param*, unsigned char*, unsigned char*) (filesort.cc:1165)

==6629==    by 0xAC98E6: Bounded_queue<unsigned char, unsigned char>::push(unsigned char*) (bounded_queue.h:184)

==6629==    by 0xAC5A97: find_all_keys(THD*, Sort_param*, SQL_SELECT*, SORT_INFO*, st_io_cache*, st_io_cache*, Bounded_queue<unsigned char, unsigned char>*, unsigned long long*) (filesort.cc:832)

==6629==    by 0xAC3E00: filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) (filesort.cc:278)

==6629==    by 0x8C0655: mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) (sql_update.cc:672)

==6629==    by 0x7C5FC8: mysql_execute_command(THD*) (sql_parse.cc:4584)

==6629==    by 0x7D14E4: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:8095)

==6629==    by 0x7BE54C: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1854)

==6629==    by 0x7BCF24: do_command(THD*) (sql_parse.cc:1396)

==6629==    by 0x92B078: do_handle_one_connection(CONNECT*) (sql_connect.cc:1403)

==6629==    by 0x92ADFC: handle_one_connection (sql_connect.cc:1309)

==6629==    by 0xDE91AA: pfs_spawn_thread (pfs.cc:1862)

==6629==  Address 0xd9c92a8 is 8 bytes inside a block of size 16 free'd

==6629==    at 0x4C2CDDB: free (vg_replace_malloc.c:530)

==6629==    by 0x12C442D: my_free (my_malloc.c:223)

==6629==    by 0x6A7D12: String::free() (sql_string.h:358)

==6629==    by 0x6C6A19: String::set(char const*, unsigned long, charset_info_st const*) (sql_string.h:278)

==6629==    by 0xAAC726: Field_blob::val_str(String*, String*) (field.cc:8357)

==6629==    by 0x6B85C0: Field::val_str(String*) (field.h:840)

==6629==    by 0xABCA46: Field_blob::store_field(Field*) (field.h:3631)

==6629==    by 0xAC1C5E: field_conv_incompatible(Field*, Field*) (field_conv.cc:836)

==6629==    by 0xAC1CBA: field_conv(Field*, Field*) (field_conv.cc:849)

==6629==    by 0xAF6C93: save_field_in_field(Field*, bool*, Field*, bool) (item.cc:6708)

==6629==    by 0xAF6ED5: Item_field::save_in_field(Field*, bool) (item.cc:6759)

==6629==    by 0x8E6B02: TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) (table.cc:7814)

==6629==    by 0xAD29B1: handler::ha_index_next(unsigned char*) (handler.cc:2928)

==6629==    by 0xAD98B9: handler::read_range_next() (handler.cc:5702)

==6629==    by 0x97B559: handler::multi_range_read_next(void**) (multi_range_read.cc:271)

==6629==    by 0x97B7F1: Mrr_simple_index_reader::get_next(void**) (multi_range_read.cc:336)

==6629==  Block was alloc'd at

==6629==    at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)

==6629==    by 0x12C3CB3: my_malloc (my_malloc.c:101)

==6629==    by 0x886C97: String::realloc_raw(unsigned long) (sql_string.cc:101)

==6629==    by 0x6A7D66: String::realloc(unsigned long) (sql_string.h:374)

==6629==    by 0x8871A3: String::copy() (sql_string.cc:212)

==6629==    by 0xABCAB1: Field_blob::store_field(Field*) (field.h:3634)

==6629==    by 0xAC1C5E: field_conv_incompatible(Field*, Field*) (field_conv.cc:836)

==6629==    by 0xAC1CBA: field_conv(Field*, Field*) (field_conv.cc:849)

==6629==    by 0xAF6C93: save_field_in_field(Field*, bool*, Field*, bool) (item.cc:6708)

==6629==    by 0xAF6ED5: Item_field::save_in_field(Field*, bool) (item.cc:6759)

==6629==    by 0x8E6B02: TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) (table.cc:7814)

==6629==    by 0xAD29B1: handler::ha_index_next(unsigned char*) (handler.cc:2928)

==6629==    by 0xAD98B9: handler::read_range_next() (handler.cc:5702)

==6629==    by 0x97B559: handler::multi_range_read_next(void**) (multi_range_read.cc:271)

==6629==    by 0x97B7F1: Mrr_simple_index_reader::get_next(void**) (multi_range_read.cc:336)

==6629==    by 0x97E441: DsMrr_impl::dsmrr_next(void**) (multi_range_read.cc:1406)