Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
10.1(EOL), 10.2(EOL), 10.3(EOL), 10.4(EOL)
-
None
Description
SELECT REPLACE( CAST( CURDATE() AS BINARY ), CURDATE(), REPEAT('a',32) ) AS f FROM mysql.user GROUP BY f; |
10.1 28cb0417 |
==3123==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000075750 at pc 0x55e95f17c4e7 bp 0x7f930d1b0a80 sp 0x7f930d1b0a78
|
READ of size 10 at 0x60e000075750 thread T6
|
#0 0x55e95f17c4e6 in copy_if_not_alloced(String*, String*, unsigned int) /data/src/10.1/sql/sql_string.cc:915
|
#1 0x55e95f68d9f5 in Item_func_replace::val_str(String*) /data/src/10.1/sql/item_strfunc.cc:1197
|
#2 0x55e95f536641 in Item_copy_string::copy() /data/src/10.1/sql/item.cc:4063
|
#3 0x55e95f0c1fdb in copy_fields(TMP_TABLE_PARAM*) /data/src/10.1/sql/sql_select.cc:23163
|
#4 0x55e95f0d0115 in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.1/sql/sql_select.cc:19816
|
#5 0x55e95f0657b2 in evaluate_join_record /data/src/10.1/sql/sql_select.cc:18702
|
#6 0x55e95f0813fd in sub_select(JOIN*, st_join_table*, bool) /data/src/10.1/sql/sql_select.cc:18479
|
#7 0x55e95f0ba9d0 in do_select /data/src/10.1/sql/sql_select.cc:18134
|
#8 0x55e95f0ff54e in JOIN::exec_inner() /data/src/10.1/sql/sql_select.cc:3275
|
#9 0x55e95f100836 in JOIN::exec() /data/src/10.1/sql/sql_select.cc:2562
|
#10 0x55e95f0f5089 in mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.1/sql/sql_select.cc:3499
|
#11 0x55e95f0f5877 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.1/sql/sql_select.cc:388
|
#12 0x55e95efc4a59 in execute_sqlcom_select /data/src/10.1/sql/sql_parse.cc:5950
|
#13 0x55e95efdec69 in mysql_execute_command(THD*) /data/src/10.1/sql/sql_parse.cc:2995
|
#14 0x55e95eff6e7a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.1/sql/sql_parse.cc:7468
|
#15 0x55e95effdc5e in dispatch_command(enum_server_command, THD*, char*, unsigned int) /data/src/10.1/sql/sql_parse.cc:1496
|
#16 0x55e95f0043ea in do_command(THD*) /data/src/10.1/sql/sql_parse.cc:1124
|
#17 0x55e95f2ac8bf in do_handle_one_connection(THD*) /data/src/10.1/sql/sql_connect.cc:1330
|
#18 0x55e95f2acdd0 in handle_one_connection /data/src/10.1/sql/sql_connect.cc:1242
|
#19 0x55e95fb7bccc in pfs_spawn_thread /data/src/10.1/storage/perfschema/pfs.cc:1861
|
#20 0x7f93198e7493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
|
#21 0x7f9317ca093e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
|
|
0x60e000075750 is located 112 bytes inside of 148-byte region [0x60e0000756e0,0x60e000075774)
|
freed by thread T6 here:
|
#0 0x7f9319b51527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
|
#1 0x55e9603480e1 in free_memory /data/src/10.1/mysys/safemalloc.c:276
|
|
previously allocated by thread T6 here:
|
#0 0x7f9319b5173f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
|
#1 0x55e9603481b2 in sf_malloc /data/src/10.1/mysys/safemalloc.c:115
|
#2 0x55e960440c1a (/data/bld/10.1-asan/bin/mysqld+0x1d9ec1a)
|
|
Thread T6 created by T0 here:
|
#0 0x7f9319b20bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
|
#1 0x55e95fb87523 in spawn_thread_v1 /data/src/10.1/storage/perfschema/pfs.cc:1911
|
|
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.1/sql/sql_string.cc:915 copy_if_not_alloced(String*, String*, unsigned int)
|
Shadow bytes around the buggy address:
|
0x0c1c80006a90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c1c80006aa0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c1c80006ab0: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
|
0x0c1c80006ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c1c80006ad0: 00 00 04 fa fa fa fa fa fa fa fa fa fd fd fd fd
|
=>0x0c1c80006ae0: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fa
|
0x0c1c80006af0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
|
0x0c1c80006b00: 00 00 00 00 00 00 00 00 00 00 02 04 fa fa fa fa
|
0x0c1c80006b10: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c1c80006b20: 00 00 00 00 00 01 04 fa fa fa fa fa fa fa fa fa
|
0x0c1c80006b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Heap right redzone: fb
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack partial redzone: f4
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Contiguous container OOB:fc
|
ASan internal: fe
|
==3123==ABORTING
|
Attachments
Issue Links
- is duplicated by
-
MDEV-19359 ASAN heap-use-after-free in copy_if_not_alloced / make_sortkey
- Closed
- relates to
-
MDEV-19359 ASAN heap-use-after-free in copy_if_not_alloced / make_sortkey
- Closed