[MDEV-18738] ASAN heap-use-after-free in copy_if_not_alloced / copy_fields - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.1(EOL), 10.2(EOL), 10.3(EOL), 10.4(EOL)
Fix Version/s: 10.2.24, 10.1.39, 10.3.15, 10.4.5
Component/s: Data types, Server
Labels:
None

Description

SELECT REPLACE( CAST( CURDATE() AS BINARY ), CURDATE(), REPEAT('a',32) ) AS f FROM mysql.user GROUP BY f;

10.1 28cb0417
==3123==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000075750 at pc 0x55e95f17c4e7 bp 0x7f930d1b0a80 sp 0x7f930d1b0a78
READ of size 10 at 0x60e000075750 thread T6
#0 0x55e95f17c4e6 in copy_if_not_alloced(String, String, unsigned int) /data/src/10.1/sql/sql_string.cc:915
#1 0x55e95f68d9f5 in Item_func_replace::val_str(String*) /data/src/10.1/sql/item_strfunc.cc:1197
#2 0x55e95f536641 in Item_copy_string::copy() /data/src/10.1/sql/item.cc:4063
#3 0x55e95f0c1fdb in copy_fields(TMP_TABLE_PARAM*) /data/src/10.1/sql/sql_select.cc:23163
#4 0x55e95f0d0115 in end_send_group(JOIN, st_join_table, bool) /data/src/10.1/sql/sql_select.cc:19816
#5 0x55e95f0657b2 in evaluate_join_record /data/src/10.1/sql/sql_select.cc:18702
#6 0x55e95f0813fd in sub_select(JOIN, st_join_table, bool) /data/src/10.1/sql/sql_select.cc:18479
#7 0x55e95f0ba9d0 in do_select /data/src/10.1/sql/sql_select.cc:18134
#8 0x55e95f0ff54e in JOIN::exec_inner() /data/src/10.1/sql/sql_select.cc:3275
#9 0x55e95f100836 in JOIN::exec() /data/src/10.1/sql/sql_select.cc:2562
#10 0x55e95f0f5089 in mysql_select(THD, Item*, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.1/sql/sql_select.cc:3499
#11 0x55e95f0f5877 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.1/sql/sql_select.cc:388
#12 0x55e95efc4a59 in execute_sqlcom_select /data/src/10.1/sql/sql_parse.cc:5950
#13 0x55e95efdec69 in mysql_execute_command(THD*) /data/src/10.1/sql/sql_parse.cc:2995
#14 0x55e95eff6e7a in mysql_parse(THD, char, unsigned int, Parser_state*) /data/src/10.1/sql/sql_parse.cc:7468
#15 0x55e95effdc5e in dispatch_command(enum_server_command, THD, char, unsigned int) /data/src/10.1/sql/sql_parse.cc:1496
#16 0x55e95f0043ea in do_command(THD*) /data/src/10.1/sql/sql_parse.cc:1124
#17 0x55e95f2ac8bf in do_handle_one_connection(THD*) /data/src/10.1/sql/sql_connect.cc:1330
#18 0x55e95f2acdd0 in handle_one_connection /data/src/10.1/sql/sql_connect.cc:1242
#19 0x55e95fb7bccc in pfs_spawn_thread /data/src/10.1/storage/perfschema/pfs.cc:1861
#20 0x7f93198e7493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
#21 0x7f9317ca093e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x60e000075750 is located 112 bytes inside of 148-byte region [0x60e0000756e0,0x60e000075774)
freed by thread T6 here:
#0 0x7f9319b51527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
#1 0x55e9603480e1 in free_memory /data/src/10.1/mysys/safemalloc.c:276

previously allocated by thread T6 here:
#0 0x7f9319b5173f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x55e9603481b2 in sf_malloc /data/src/10.1/mysys/safemalloc.c:115
#2 0x55e960440c1a (/data/bld/10.1-asan/bin/mysqld+0x1d9ec1a)

Thread T6 created by T0 here:
#0 0x7f9319b20bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
#1 0x55e95fb87523 in spawn_thread_v1 /data/src/10.1/storage/perfschema/pfs.cc:1911

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.1/sql/sql_string.cc:915 copy_if_not_alloced(String, String, unsigned int)
Shadow bytes around the buggy address:
0x0c1c80006a90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1c80006aa0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1c80006ab0: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
0x0c1c80006ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1c80006ad0: 00 00 04 fa fa fa fa fa fa fa fa fa fd fd fd fd
=>0x0c1c80006ae0: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fa
0x0c1c80006af0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c1c80006b00: 00 00 00 00 00 00 00 00 00 00 02 04 fa fa fa fa
0x0c1c80006b10: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1c80006b20: 00 00 00 00 00 01 04 fa fa fa fa fa fa fa fa fa
0x0c1c80006b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==3123==ABORTING

Attachments

Issue Links

is duplicated by

MDEV-19359 ASAN heap-use-after-free in copy_if_not_alloced / make_sortkey

Closed

relates to

MDEV-19359 ASAN heap-use-after-free in copy_if_not_alloced / make_sortkey

Closed

Activity

Ascending order - Click to sort in descending order

Alexander Barkov added a comment - 2019-04-29 13:07 - edited

mysql.user is not necessarily needed to reproduce this. It can be any other table:

DROP TABLE IF EXISTS t1;

CREATE TABLE t1 (a INT) ENGINE=MyISAM;

INSERT INTO t1 VALUES (1), (2);

SELECT REPLACE( CAST( CURDATE() AS BINARY ), CURDATE(), REPEAT('a',32) ) AS f FROM t1 GROUP BY f;

The problem is even repeatable with a single record:

DROP TABLE IF EXISTS t1;

CREATE TABLE t1 (a INT) ENGINE=MyISAM;

INSERT INTO t1 VALUES (1);

SELECT REPLACE( CAST( CURDATE() AS BINARY ), CURDATE(), REPEAT('a',32) ) AS f FROM t1 GROUP BY f;

Alexander Barkov added a comment - 2019-04-29 13:07 - edited mysql.user is not necessarily needed to reproduce this. It can be any other table: DROP TABLE IF EXISTS t1; CREATE TABLE t1 (a INT ) ENGINE=MyISAM; INSERT INTO t1 VALUES (1), (2); SELECT REPLACE ( CAST ( CURDATE() AS BINARY ), CURDATE(), REPEAT( 'a' ,32) ) AS f FROM t1 GROUP BY f; The problem is even repeatable with a single record: DROP TABLE IF EXISTS t1; CREATE TABLE t1 (a INT ) ENGINE=MyISAM; INSERT INTO t1 VALUES (1); SELECT REPLACE ( CAST ( CURDATE() AS BINARY ), CURDATE(), REPEAT( 'a' ,32) ) AS f FROM t1 GROUP BY f;

Alexander Barkov added a comment - 2019-04-29 16:15 - edited

Also repeatable with these scripts:

DROP TABLE IF EXISTS t1;

CREATE TABLE t1 (a INT) ENGINE=MyISAM;

INSERT INTO t1 VALUES (1),(2);

SELECT REPLACE( LEFT( CURDATE(), 4), LEFT(CURDATE(),4), REPEAT('a',32) ) AS f FROM t1 GROUP BY f;

DROP TABLE IF EXISTS t1;

CREATE TABLE t1 (a INT) ENGINE=MyISAM;

INSERT INTO t1 VALUES (1),(2);

SELECT REPLACE(RIGHT(CURDATE(), 4), RIGHT(CURDATE(),4), REPEAT('a',32)) AS f FROM t1 GROUP BY f;

DROP TABLE IF EXISTS t1;

CREATE TABLE t1 (a INT) ENGINE=MyISAM;

INSERT INTO t1 VALUES (1),(2);

SELECT REPLACE(SUBSTR(CURDATE(),2,3), SUBSTR(CURDATE(),2,3), REPEAT('a',32)) AS f FROM t1 GROUP BY f;

Note, with these scripts the crash happens on a different line in Item_func_replace::val_str().

Alexander Barkov added a comment - 2019-04-29 16:15 - edited Also repeatable with these scripts: DROP TABLE IF EXISTS t1; CREATE TABLE t1 (a INT ) ENGINE=MyISAM; INSERT INTO t1 VALUES (1),(2); SELECT REPLACE ( LEFT ( CURDATE(), 4), LEFT (CURDATE(),4), REPEAT( 'a' ,32) ) AS f FROM t1 GROUP BY f; DROP TABLE IF EXISTS t1; CREATE TABLE t1 (a INT ) ENGINE=MyISAM; INSERT INTO t1 VALUES (1),(2); SELECT REPLACE ( RIGHT (CURDATE(), 4), RIGHT (CURDATE(),4), REPEAT( 'a' ,32)) AS f FROM t1 GROUP BY f; DROP TABLE IF EXISTS t1; CREATE TABLE t1 (a INT ) ENGINE=MyISAM; INSERT INTO t1 VALUES (1),(2); SELECT REPLACE (SUBSTR(CURDATE(),2,3), SUBSTR(CURDATE(),2,3), REPEAT( 'a' ,32)) AS f FROM t1 GROUP BY f; Note, with these scripts the crash happens on a different line in Item_func_replace::val_str().

MariaDB Server

ASAN heap-use-after-free in copy_if_not_alloced / copy_fields

Details

Description

Attachments

Issue Links

Activity

People

Dates

Git Integration