Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-18784

Server crashes in l_find, ASAN heap-use-after-free in Field_long::reset upon INSERT into temporary MyISAM table with indexed persistent virtual column

Details

    Description

      CREATE TEMPORARY TABLE t1 (
        pk INT AUTO_INCREMENT,
        a INT,
        b INT AS (a) STORED,
        PRIMARY KEY (pk),
        KEY(b)
      ) ENGINE=MyISAM;
       
      ALTER TABLE t1 FORCE;
      INSERT INTO t1 (a) VALUES (2),(3);
      --error ER_DUP_FIELDNAME
      ALTER TABLE t1 CHANGE COLUMN IF EXISTS a pk CHAR;
      INSERT INTO t1 (a) SELECT 1;
      INSERT INTO t1 (pk) VALUES (NULL);
      

      10.2 f65f40bb ASAN

      ==4914==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000072814 at pc 0x55de3efe30a5 bp 0x7f55cf3c85a0 sp 0x7f55cf3c8598
      WRITE of size 1 at 0x60e000072814 thread T5
          #0 0x55de3efe30a4 in Field_long::reset() /data/src/10.2/sql/field.h:2139
          #1 0x55de3efee16c in convert_null_to_field_value_or_error(Field*) /data/src/10.2/sql/field_conv.cc:174
          #2 0x55de3efee3f3 in set_field_to_null_with_conversions(Field*, bool) /data/src/10.2/sql/field_conv.cc:218
          #3 0x55de3f06992e in Item_null::save_in_field(Field*, bool) /data/src/10.2/sql/item.cc:6341
          #4 0x55de3e91e6a6 in fill_record(THD*, TABLE*, List<Item>&, List<Item>&, bool, bool) /data/src/10.2/sql/sql_base.cc:8022
          #5 0x55de3e91f42e in fill_record_n_invoke_before_triggers(THD*, TABLE*, List<Item>&, List<Item>&, bool, trg_event_type) /data/src/10.2/sql/sql_base.cc:8164
          #6 0x55de3e9b4a14 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.2/sql/sql_insert.cc:958
          #7 0x55de3ea179ec in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4441
          #8 0x55de3ea2ee2d in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8018
          #9 0x55de3ea0981a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1829
          #10 0x55de3ea06839 in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1379
          #11 0x55de3ed4e069 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
          #12 0x55de3ed4da7e in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1242
          #13 0x55de3f76c98b in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
          #14 0x7f55db83d493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
          #15 0x7f55d9c2393e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
       
      0x60e000072814 is located 116 bytes inside of 148-byte region [0x60e0000727a0,0x60e000072834)
      freed by thread T5 here:
          #0 0x7f55dbaa7527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
          #1 0x55de4008ea88 in free_memory /data/src/10.2/mysys/safemalloc.c:279
          #2 0x55de4008e08e in sf_free /data/src/10.2/mysys/safemalloc.c:197
          #3 0x55de4005d31d in my_free /data/src/10.2/mysys/my_malloc.c:218
          #4 0x55de3fe88f2c in mi_repair /data/src/10.2/storage/myisam/mi_check.c:1733
          #5 0x55de3fe6dda7 in ha_myisam::repair(THD*, st_handler_check_param&, bool) /data/src/10.2/storage/myisam/ha_myisam.cc:1283
          #6 0x55de3fe70737 in ha_myisam::enable_indexes(unsigned int) /data/src/10.2/storage/myisam/ha_myisam.cc:1619
          #7 0x55de3fe71428 in ha_myisam::end_bulk_insert() /data/src/10.2/storage/myisam/ha_myisam.cc:1756
          #8 0x55de3e9d233a in handler::ha_end_bulk_insert() /data/src/10.2/sql/handler.h:2917
          #9 0x55de3e9c9dbc in select_insert::prepare_eof() /data/src/10.2/sql/sql_insert.cc:3817
          #10 0x55de3e9cb317 in select_insert::send_eof() /data/src/10.2/sql/sql_insert.cc:3910
          #11 0x55de3eac240f in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3510
          #12 0x55de3eac1011 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3418
          #13 0x55de3eac43f9 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3818
          #14 0x55de3eaa33d4 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:376
          #15 0x55de3ea18831 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4548
          #16 0x55de3ea2ee2d in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8018
          #17 0x55de3ea0981a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1829
          #18 0x55de3ea06839 in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1379
          #19 0x55de3ed4e069 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
          #20 0x55de3ed4da7e in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1242
          #21 0x55de3f76c98b in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
          #22 0x7f55db83d493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
       
      previously allocated by thread T5 here:
          #0 0x7f55dbaa773f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
          #1 0x55de4008d7fe in sf_malloc /data/src/10.2/mysys/safemalloc.c:118
          #2 0x55de4005c984 in my_malloc /data/src/10.2/mysys/my_malloc.c:101
          #3 0x55de4005ceb6 in my_realloc /data/src/10.2/mysys/my_malloc.c:156
          #4 0x55de3fee630c in mi_alloc_rec_buff /data/src/10.2/storage/myisam/mi_open.c:762
          #5 0x55de3fe87340 in mi_repair /data/src/10.2/storage/myisam/mi_check.c:1545
          #6 0x55de3fe6dda7 in ha_myisam::repair(THD*, st_handler_check_param&, bool) /data/src/10.2/storage/myisam/ha_myisam.cc:1283
          #7 0x55de3fe70737 in ha_myisam::enable_indexes(unsigned int) /data/src/10.2/storage/myisam/ha_myisam.cc:1619
          #8 0x55de3fe71428 in ha_myisam::end_bulk_insert() /data/src/10.2/storage/myisam/ha_myisam.cc:1756
          #9 0x55de3e9d233a in handler::ha_end_bulk_insert() /data/src/10.2/sql/handler.h:2917
          #10 0x55de3e9c9dbc in select_insert::prepare_eof() /data/src/10.2/sql/sql_insert.cc:3817
          #11 0x55de3e9cb317 in select_insert::send_eof() /data/src/10.2/sql/sql_insert.cc:3910
          #12 0x55de3eac240f in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3510
          #13 0x55de3eac1011 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3418
          #14 0x55de3eac43f9 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3818
          #15 0x55de3eaa33d4 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:376
          #16 0x55de3ea18831 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4548
          #17 0x55de3ea2ee2d in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8018
          #18 0x55de3ea0981a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1829
          #19 0x55de3ea06839 in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1379
          #20 0x55de3ed4e069 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
          #21 0x55de3ed4da7e in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1242
          #22 0x55de3f76c98b in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
          #23 0x7f55db83d493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
       
      Thread T5 created by T0 here:
          #0 0x7f55dba76bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
          #1 0x55de3f76cf53 in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1912
          #2 0x55de3e802eae in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1239
          #3 0x55de3e817e83 in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6480
          #4 0x55de3e818588 in create_new_thread /data/src/10.2/sql/mysqld.cc:6550
          #5 0x55de3e81959f in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6825
          #6 0x55de3e8173d8 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6099
          #7 0x55de3e80124f in main /data/src/10.2/sql/main.cc:25
          #8 0x7f55d9b5b2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
       
      SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.2/sql/field.h:2139 Field_long::reset()
      Shadow bytes around the buggy address:
        0x0c1c800064b0: 00 00 00 04 fa fa fa fa fa fa fa fa fd fd fd fd
        0x0c1c800064c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
        0x0c1c800064d0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
        0x0c1c800064e0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
        0x0c1c800064f0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x0c1c80006500: fd fd[fd]fd fd fd fd fa fa fa fa fa fa fa fa fa
        0x0c1c80006510: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c1c80006520: fd fd fd fa fa fa fa fa fa fa fa fa fd fd fd fd
        0x0c1c80006530: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
        0x0c1c80006540: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
        0x0c1c80006550: 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Contiguous container OOB:fc
        ASan internal:           fe
      ==4914==ABORTING
      

      10.2 f65f40bb debug

      2019-03-01 17:07:50 139656029366016 [Warning] Warning: Enabling keys got errno 127 on test.t1, retrying
      190301 17:07:50 [ERROR] mysqld got signal 11 ;
       
      #0  0x000055b11d035a40 in l_find (head=0x7f041813bb80, cs=0x55b11da285c0 <my_charset_bin>, hashnr=1073741824, key=0x55b11d3a30fa "", keylen=0, cursor=0x7f042ee70cb0, pins=0x7f041801aa00, callback=0x0) at /data/src/10.2/mysys/lf_hash.c:112
      #1  0x000055b11d035c75 in l_insert (head=0x7f04180229a8, cs=0x55b11da285c0 <my_charset_bin>, node=0x7f041c0182e0, pins=0x7f041801aa00, flags=1) at /data/src/10.2/mysys/lf_hash.c:179
      #2  0x000055b11d036939 in initialize_bucket (hash=0x55b11e4135c0 <digest_hash>, node=0x7f04180229b8, bucket=2, pins=0x7f041801aa00) at /data/src/10.2/mysys/lf_hash.c:560
      #3  0x000055b11d0368c3 in initialize_bucket (hash=0x55b11e4135c0 <digest_hash>, node=0x7f04180229d8, bucket=6, pins=0x7f041801aa00) at /data/src/10.2/mysys/lf_hash.c:552
      #4  0x000055b11d0368c3 in initialize_bucket (hash=0x55b11e4135c0 <digest_hash>, node=0x7f0418022a18, bucket=14, pins=0x7f041801aa00) at /data/src/10.2/mysys/lf_hash.c:552
      #5  0x000055b11d03662d in lf_hash_search_using_hash_value (hash=0x55b11e4135c0 <digest_hash>, pins=0x7f041801aa00, hashnr=581353518, key=0x7f042ee70ee0, keylen=212) at /data/src/10.2/mysys/lf_hash.c:483
      #6  0x000055b11d036813 in lf_hash_search (hash=0x55b11e4135c0 <digest_hash>, pins=0x7f041801aa00, key=0x7f042ee70ee0, keylen=212) at /data/src/10.2/mysys/lf_hash.c:528
      #7  0x000055b11cb988b8 in find_or_create_digest (thread=0x7f04370b3440, digest_storage=0x7f041c004118, schema_name=0x7f041c0041f8 '\245' <repeats 192 times>, schema_name_length=0) at /data/src/10.2/storage/perfschema/pfs_digest.cc:229
      #8  0x000055b11cbce9aa in end_statement_v1 (locker=0x7f041c004150, stmt_da=0x7f041c005cb0) at /data/src/10.2/storage/perfschema/pfs.cc:4837
      #9  0x000055b11c649fed in inline_mysql_end_statement (locker=0x7f041c004150, stmt_da=0x7f041c005cb0) at /data/src/10.2/include/mysql/psi/mysql_statement.h:216
      #10 0x000055b11c6502bf in dispatch_command (command=COM_QUERY, thd=0x7f041c000b00, packet=0x7f041c0088c1 "", packet_length=17, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:2410
      #11 0x000055b11c64cf40 in do_command (thd=0x7f041c000b00) at /data/src/10.2/sql/sql_parse.cc:1379
      #12 0x000055b11c7a0466 in do_handle_one_connection (connect=0x55b11eb26730) at /data/src/10.2/sql/sql_connect.cc:1336
      #13 0x000055b11c7a01f3 in handle_one_connection (arg=0x55b11eb26730) at /data/src/10.2/sql/sql_connect.cc:1242
      #14 0x000055b11cbc81e6 in pfs_spawn_thread (arg=0x55b11eb499c0) at /data/src/10.2/storage/perfschema/pfs.cc:1862
      #15 0x00007f043a8c3494 in start_thread (arg=0x7f042ee72700) at pthread_create.c:333
      #16 0x00007f0438ca993f in clone () from /lib/x86_64-linux-gnu/libc.so.6
      

      Non-debug build crashes in a similar way.
      Not reproducible on 10.1.

      Attachments

        Issue Links

          Activity

            Somewhat different test case with similar but not identical stack traces.

            CREATE TABLE t1 (a INT) ENGINE=MyISAM;
            INSERT INTO t1 VALUES (NULL),(0);
             
            CREATE TEMPORARY TABLE tmp (b INT, c INT AS (b) PERSISTENT, KEY(c)) ENGINE=MyISAM;
            INSERT tmp (b) SELECT a FROM t1;
            INSERT INTO tmp (b) VALUES (NULL);
             
            # Cleanup
            DROP TABLE t1;
            

            10.3 82da9855

            #3  <signal handler called>
            #4  0x0000560fe7059194 in l_find (head=0x7f761c09a0e0, cs=0x560fe7b50c80 <my_charset_bin>, hashnr=669422065, key=0x7f762da622e0 "\026\256\245q\333\024\245UY[1KH\370\261;test", keylen=212, cursor=0x7f762da621d0, pins=0x7f761c01d200, callback=0x0) at /data/src/10.3/mysys/lf_hash.c:112
            #5  0x0000560fe7059693 in l_search (head=0x7f761c025258, cs=0x560fe7b50c80 <my_charset_bin>, hashnr=669422065, key=0x7f762da622e0 "\026\256\245q\333\024\245UY[1KH\370\261;test", keylen=212, pins=0x7f761c01d200) at /data/src/10.3/mysys/lf_hash.c:286
            #6  0x0000560fe7059e29 in lf_hash_search_using_hash_value (hash=0x560fe853f880 <digest_hash>, pins=0x7f761c01d200, hashnr=260663268, key=0x7f762da622e0, keylen=212) at /data/src/10.3/mysys/lf_hash.c:488
            #7  0x0000560fe7059f9b in lf_hash_search (hash=0x560fe853f880 <digest_hash>, pins=0x7f761c01d200, key=0x7f762da622e0, keylen=212) at /data/src/10.3/mysys/lf_hash.c:528
            #8  0x0000560fe6b77167 in find_or_create_digest (thread=0x7f7631d817c0, digest_storage=0x7f761c004388, schema_name=0x7f761c004468 "test", '\245' <repeats 188 times>, "\004", schema_name_length=4) at /data/src/10.3/storage/perfschema/pfs_digest.cc:229
            #9  0x0000560fe6bae8a4 in end_statement_v1 (locker=0x7f761c0043c0, stmt_da=0x7f761c006080) at /data/src/10.3/storage/perfschema/pfs.cc:4837
            #10 0x0000560fe659fbb3 in inline_mysql_end_statement (locker=0x7f761c0043c0, stmt_da=0x7f761c006080) at /data/src/10.3/include/mysql/psi/mysql_statement.h:216
            #11 0x0000560fe65a6023 in dispatch_command (command=COM_QUERY, thd=0x7f761c000b00, packet=0x7f761c00b201 "", packet_length=33, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:2434
            #12 0x0000560fe65a2cd1 in do_command (thd=0x7f761c000b00) at /data/src/10.3/sql/sql_parse.cc:1396
            #13 0x0000560fe670b41f in do_handle_one_connection (connect=0x560fe8b95d60) at /data/src/10.3/sql/sql_connect.cc:1403
            #14 0x0000560fe670b1a3 in handle_one_connection (arg=0x560fe8b95d60) at /data/src/10.3/sql/sql_connect.cc:1309
            #15 0x0000560fe6ba78b3 in pfs_spawn_thread (arg=0x560fe8b9e450) at /data/src/10.3/storage/perfschema/pfs.cc:1862
            #16 0x00007f7635592494 in start_thread (arg=0x7f762da63700) at pthread_create.c:333
            #17 0x00007f763397893f in clone () from /lib/x86_64-linux-gnu/libc.so.6
            

            10.3 82da9855 ASAN

            ==25313==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e00006ed70 at pc 0x558a3a53ac55 bp 0x7fc71de98bd0 sp 0x7fc71de98bc8
            READ of size 1 at 0x60e00006ed70 thread T5
                #0 0x558a3a53ac54 in Field::set_null(long long) /data/src/10.3/sql/field.h:1175
                #1 0x558a3ad9fba5 in set_field_to_null_with_conversions(Field*, bool) /data/src/10.3/sql/field_conv.cc:212
                #2 0x558a3ae2d73c in Item_null::save_in_field(Field*, bool) /data/src/10.3/sql/item.cc:6779
                #3 0x558a3a570d1a in fill_record(THD*, TABLE*, List<Item>&, List<Item>&, bool, bool) /data/src/10.3/sql/sql_base.cc:8281
                #4 0x558a3a571ecb in fill_record_n_invoke_before_triggers(THD*, TABLE*, List<Item>&, List<Item>&, bool, trg_event_type) /data/src/10.3/sql/sql_base.cc:8450
                #5 0x558a3a61035f in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.3/sql/sql_insert.cc:960
                #6 0x558a3a6ab97f in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4730
                #7 0x558a3a6c180e in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
                #8 0x558a3a69b8e6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
                #9 0x558a3a6988f8 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
                #10 0x558a3aa0c18d in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
                #11 0x558a3aa0bb99 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309
                #12 0x558a3b541d5f in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
                #13 0x7fc72a46f493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
                #14 0x7fc72885593e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
             
            0x60e00006ed70 is located 112 bytes inside of 148-byte region [0x60e00006ed00,0x60e00006ed94)
            freed by thread T5 here:
                #0 0x7fc72a6d9527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
                #1 0x558a3bef212b in free_memory /data/src/10.3/mysys/safemalloc.c:279
                #2 0x558a3bef1731 in sf_free /data/src/10.3/mysys/safemalloc.c:197
                #3 0x558a3bec217a in my_free /data/src/10.3/mysys/my_malloc.c:223
                #4 0x558a3bccec7d in mi_repair_by_sort /data/src/10.3/storage/myisam/mi_check.c:2554
                #5 0x558a3bcabd3e in ha_myisam::repair(THD*, st_handler_check_param&, bool) /data/src/10.3/storage/myisam/ha_myisam.cc:1270
                #6 0x558a3bcae804 in ha_myisam::enable_indexes(unsigned int) /data/src/10.3/storage/myisam/ha_myisam.cc:1608
                #7 0x558a3bcaf70c in ha_myisam::end_bulk_insert() /data/src/10.3/storage/myisam/ha_myisam.cc:1769
                #8 0x558a3a630272 in handler::ha_end_bulk_insert() /data/src/10.3/sql/handler.h:3166
                #9 0x558a3a627572 in select_insert::prepare_eof() /data/src/10.3/sql/sql_insert.cc:3918
                #10 0x558a3a628bbf in select_insert::send_eof() /data/src/10.3/sql/sql_insert.cc:4011
                #11 0x558a3a7be1dd in do_select /data/src/10.3/sql/sql_select.cc:18990
                #12 0x558a3a75a34b in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4040
                #13 0x558a3a757f79 in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3834
                #14 0x558a3a75b492 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4239
                #15 0x558a3a735fac in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:385
                #16 0x558a3a6ac869 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4837
                #17 0x558a3a6c180e in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
                #18 0x558a3a69b8e6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
                #19 0x558a3a6988f8 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
                #20 0x558a3aa0c18d in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
                #21 0x558a3aa0bb99 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309
                #22 0x558a3b541d5f in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
                #23 0x7fc72a46f493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
             
            previously allocated by thread T5 here:
                #0 0x7fc72a6d973f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
                #1 0x558a3bef0ea1 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
                #2 0x558a3bec179c in my_malloc /data/src/10.3/mysys/my_malloc.c:101
                #3 0x558a3bec1ce2 in my_realloc /data/src/10.3/mysys/my_malloc.c:156
                #4 0x558a3bd25ac4 in mi_alloc_rec_buff /data/src/10.3/storage/myisam/mi_open.c:762
                #5 0x558a3bccbdc0 in mi_repair_by_sort /data/src/10.3/storage/myisam/mi_check.c:2237
                #6 0x558a3bcabd3e in ha_myisam::repair(THD*, st_handler_check_param&, bool) /data/src/10.3/storage/myisam/ha_myisam.cc:1270
                #7 0x558a3bcae804 in ha_myisam::enable_indexes(unsigned int) /data/src/10.3/storage/myisam/ha_myisam.cc:1608
                #8 0x558a3bcaf70c in ha_myisam::end_bulk_insert() /data/src/10.3/storage/myisam/ha_myisam.cc:1769
                #9 0x558a3a630272 in handler::ha_end_bulk_insert() /data/src/10.3/sql/handler.h:3166
                #10 0x558a3a627572 in select_insert::prepare_eof() /data/src/10.3/sql/sql_insert.cc:3918
                #11 0x558a3a628bbf in select_insert::send_eof() /data/src/10.3/sql/sql_insert.cc:4011
                #12 0x558a3a7be1dd in do_select /data/src/10.3/sql/sql_select.cc:18990
                #13 0x558a3a75a34b in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4040
                #14 0x558a3a757f79 in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3834
                #15 0x558a3a75b492 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4239
                #16 0x558a3a735fac in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:385
                #17 0x558a3a6ac869 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4837
                #18 0x558a3a6c180e in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
                #19 0x558a3a69b8e6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
                #20 0x558a3a6988f8 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
                #21 0x558a3aa0c18d in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
                #22 0x558a3aa0bb99 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309
                #23 0x558a3b541d5f in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
                #24 0x7fc72a46f493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
             
            Thread T5 created by T0 here:
                #0 0x7fc72a6a8bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
                #1 0x558a3b542327 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
                #2 0x558a3a403468 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
                #3 0x558a3a4196e1 in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6587
                #4 0x558a3a419de6 in create_new_thread /data/src/10.3/sql/mysqld.cc:6657
                #5 0x558a3a41adfd in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6932
                #6 0x558a3a418b9e in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6209
                #7 0x558a3a4014ef in main /data/src/10.3/sql/main.cc:25
                #8 0x7fc72878d2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
             
            SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/sql/field.h:1175 Field::set_null(long long)
            Shadow bytes around the buggy address:
              0x0c1c80005d50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
              0x0c1c80005d60: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
              0x0c1c80005d70: 00 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa
              0x0c1c80005d80: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
              0x0c1c80005d90: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
            =>0x0c1c80005da0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
              0x0c1c80005db0: fd fd fd fa fa fa fa fa fa fa fa fa 00 00 00 00
              0x0c1c80005dc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
              0x0c1c80005dd0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
              0x0c1c80005de0: 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa
              0x0c1c80005df0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
            Shadow byte legend (one shadow byte represents 8 application bytes):
              Addressable:           00
              Partially addressable: 01 02 03 04 05 06 07 
              Heap left redzone:       fa
              Heap right redzone:      fb
              Freed heap region:       fd
              Stack left redzone:      f1
              Stack mid redzone:       f2
              Stack right redzone:     f3
              Stack partial redzone:   f4
              Stack after return:      f5
              Stack use after scope:   f8
              Global redzone:          f9
              Global init order:       f6
              Poisoned by user:        f7
              Contiguous container OOB:fc
              ASan internal:           fe
            ==25313==ABORTING
            

            elenst Elena Stepanova added a comment - Somewhat different test case with similar but not identical stack traces. CREATE TABLE t1 (a INT ) ENGINE=MyISAM; INSERT INTO t1 VALUES ( NULL ),(0);   CREATE TEMPORARY TABLE tmp (b INT , c INT AS (b) PERSISTENT, KEY (c)) ENGINE=MyISAM; INSERT tmp (b) SELECT a FROM t1; INSERT INTO tmp (b) VALUES ( NULL );   # Cleanup DROP TABLE t1; 10.3 82da9855 #3 <signal handler called> #4 0x0000560fe7059194 in l_find (head=0x7f761c09a0e0, cs=0x560fe7b50c80 <my_charset_bin>, hashnr=669422065, key=0x7f762da622e0 "\026\256\245q\333\024\245UY[1KH\370\261;test", keylen=212, cursor=0x7f762da621d0, pins=0x7f761c01d200, callback=0x0) at /data/src/10.3/mysys/lf_hash.c:112 #5 0x0000560fe7059693 in l_search (head=0x7f761c025258, cs=0x560fe7b50c80 <my_charset_bin>, hashnr=669422065, key=0x7f762da622e0 "\026\256\245q\333\024\245UY[1KH\370\261;test", keylen=212, pins=0x7f761c01d200) at /data/src/10.3/mysys/lf_hash.c:286 #6 0x0000560fe7059e29 in lf_hash_search_using_hash_value (hash=0x560fe853f880 <digest_hash>, pins=0x7f761c01d200, hashnr=260663268, key=0x7f762da622e0, keylen=212) at /data/src/10.3/mysys/lf_hash.c:488 #7 0x0000560fe7059f9b in lf_hash_search (hash=0x560fe853f880 <digest_hash>, pins=0x7f761c01d200, key=0x7f762da622e0, keylen=212) at /data/src/10.3/mysys/lf_hash.c:528 #8 0x0000560fe6b77167 in find_or_create_digest (thread=0x7f7631d817c0, digest_storage=0x7f761c004388, schema_name=0x7f761c004468 "test", '\245' <repeats 188 times>, "\004", schema_name_length=4) at /data/src/10.3/storage/perfschema/pfs_digest.cc:229 #9 0x0000560fe6bae8a4 in end_statement_v1 (locker=0x7f761c0043c0, stmt_da=0x7f761c006080) at /data/src/10.3/storage/perfschema/pfs.cc:4837 #10 0x0000560fe659fbb3 in inline_mysql_end_statement (locker=0x7f761c0043c0, stmt_da=0x7f761c006080) at /data/src/10.3/include/mysql/psi/mysql_statement.h:216 #11 0x0000560fe65a6023 in dispatch_command (command=COM_QUERY, thd=0x7f761c000b00, packet=0x7f761c00b201 "", packet_length=33, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:2434 #12 0x0000560fe65a2cd1 in do_command (thd=0x7f761c000b00) at /data/src/10.3/sql/sql_parse.cc:1396 #13 0x0000560fe670b41f in do_handle_one_connection (connect=0x560fe8b95d60) at /data/src/10.3/sql/sql_connect.cc:1403 #14 0x0000560fe670b1a3 in handle_one_connection (arg=0x560fe8b95d60) at /data/src/10.3/sql/sql_connect.cc:1309 #15 0x0000560fe6ba78b3 in pfs_spawn_thread (arg=0x560fe8b9e450) at /data/src/10.3/storage/perfschema/pfs.cc:1862 #16 0x00007f7635592494 in start_thread (arg=0x7f762da63700) at pthread_create.c:333 #17 0x00007f763397893f in clone () from /lib/x86_64-linux-gnu/libc.so.6 10.3 82da9855 ASAN ==25313==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e00006ed70 at pc 0x558a3a53ac55 bp 0x7fc71de98bd0 sp 0x7fc71de98bc8 READ of size 1 at 0x60e00006ed70 thread T5 #0 0x558a3a53ac54 in Field::set_null(long long) /data/src/10.3/sql/field.h:1175 #1 0x558a3ad9fba5 in set_field_to_null_with_conversions(Field*, bool) /data/src/10.3/sql/field_conv.cc:212 #2 0x558a3ae2d73c in Item_null::save_in_field(Field*, bool) /data/src/10.3/sql/item.cc:6779 #3 0x558a3a570d1a in fill_record(THD*, TABLE*, List<Item>&, List<Item>&, bool, bool) /data/src/10.3/sql/sql_base.cc:8281 #4 0x558a3a571ecb in fill_record_n_invoke_before_triggers(THD*, TABLE*, List<Item>&, List<Item>&, bool, trg_event_type) /data/src/10.3/sql/sql_base.cc:8450 #5 0x558a3a61035f in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.3/sql/sql_insert.cc:960 #6 0x558a3a6ab97f in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4730 #7 0x558a3a6c180e in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095 #8 0x558a3a69b8e6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854 #9 0x558a3a6988f8 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396 #10 0x558a3aa0c18d in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403 #11 0x558a3aa0bb99 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309 #12 0x558a3b541d5f in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862 #13 0x7fc72a46f493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493) #14 0x7fc72885593e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)   0x60e00006ed70 is located 112 bytes inside of 148-byte region [0x60e00006ed00,0x60e00006ed94) freed by thread T5 here: #0 0x7fc72a6d9527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527) #1 0x558a3bef212b in free_memory /data/src/10.3/mysys/safemalloc.c:279 #2 0x558a3bef1731 in sf_free /data/src/10.3/mysys/safemalloc.c:197 #3 0x558a3bec217a in my_free /data/src/10.3/mysys/my_malloc.c:223 #4 0x558a3bccec7d in mi_repair_by_sort /data/src/10.3/storage/myisam/mi_check.c:2554 #5 0x558a3bcabd3e in ha_myisam::repair(THD*, st_handler_check_param&, bool) /data/src/10.3/storage/myisam/ha_myisam.cc:1270 #6 0x558a3bcae804 in ha_myisam::enable_indexes(unsigned int) /data/src/10.3/storage/myisam/ha_myisam.cc:1608 #7 0x558a3bcaf70c in ha_myisam::end_bulk_insert() /data/src/10.3/storage/myisam/ha_myisam.cc:1769 #8 0x558a3a630272 in handler::ha_end_bulk_insert() /data/src/10.3/sql/handler.h:3166 #9 0x558a3a627572 in select_insert::prepare_eof() /data/src/10.3/sql/sql_insert.cc:3918 #10 0x558a3a628bbf in select_insert::send_eof() /data/src/10.3/sql/sql_insert.cc:4011 #11 0x558a3a7be1dd in do_select /data/src/10.3/sql/sql_select.cc:18990 #12 0x558a3a75a34b in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4040 #13 0x558a3a757f79 in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3834 #14 0x558a3a75b492 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4239 #15 0x558a3a735fac in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:385 #16 0x558a3a6ac869 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4837 #17 0x558a3a6c180e in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095 #18 0x558a3a69b8e6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854 #19 0x558a3a6988f8 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396 #20 0x558a3aa0c18d in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403 #21 0x558a3aa0bb99 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309 #22 0x558a3b541d5f in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862 #23 0x7fc72a46f493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)   previously allocated by thread T5 here: #0 0x7fc72a6d973f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f) #1 0x558a3bef0ea1 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118 #2 0x558a3bec179c in my_malloc /data/src/10.3/mysys/my_malloc.c:101 #3 0x558a3bec1ce2 in my_realloc /data/src/10.3/mysys/my_malloc.c:156 #4 0x558a3bd25ac4 in mi_alloc_rec_buff /data/src/10.3/storage/myisam/mi_open.c:762 #5 0x558a3bccbdc0 in mi_repair_by_sort /data/src/10.3/storage/myisam/mi_check.c:2237 #6 0x558a3bcabd3e in ha_myisam::repair(THD*, st_handler_check_param&, bool) /data/src/10.3/storage/myisam/ha_myisam.cc:1270 #7 0x558a3bcae804 in ha_myisam::enable_indexes(unsigned int) /data/src/10.3/storage/myisam/ha_myisam.cc:1608 #8 0x558a3bcaf70c in ha_myisam::end_bulk_insert() /data/src/10.3/storage/myisam/ha_myisam.cc:1769 #9 0x558a3a630272 in handler::ha_end_bulk_insert() /data/src/10.3/sql/handler.h:3166 #10 0x558a3a627572 in select_insert::prepare_eof() /data/src/10.3/sql/sql_insert.cc:3918 #11 0x558a3a628bbf in select_insert::send_eof() /data/src/10.3/sql/sql_insert.cc:4011 #12 0x558a3a7be1dd in do_select /data/src/10.3/sql/sql_select.cc:18990 #13 0x558a3a75a34b in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4040 #14 0x558a3a757f79 in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3834 #15 0x558a3a75b492 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4239 #16 0x558a3a735fac in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:385 #17 0x558a3a6ac869 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4837 #18 0x558a3a6c180e in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095 #19 0x558a3a69b8e6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854 #20 0x558a3a6988f8 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396 #21 0x558a3aa0c18d in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403 #22 0x558a3aa0bb99 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309 #23 0x558a3b541d5f in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862 #24 0x7fc72a46f493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)   Thread T5 created by T0 here: #0 0x7fc72a6a8bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba) #1 0x558a3b542327 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912 #2 0x558a3a403468 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268 #3 0x558a3a4196e1 in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6587 #4 0x558a3a419de6 in create_new_thread /data/src/10.3/sql/mysqld.cc:6657 #5 0x558a3a41adfd in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6932 #6 0x558a3a418b9e in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6209 #7 0x558a3a4014ef in main /data/src/10.3/sql/main.cc:25 #8 0x7fc72878d2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)   SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/sql/field.h:1175 Field::set_null(long long) Shadow bytes around the buggy address: 0x0c1c80005d50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1c80005d60: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c1c80005d70: 00 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa 0x0c1c80005d80: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd 0x0c1c80005d90: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa =>0x0c1c80005da0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd 0x0c1c80005db0: fd fd fd fa fa fa fa fa fa fa fa fa 00 00 00 00 0x0c1c80005dc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 0x0c1c80005dd0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c1c80005de0: 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa 0x0c1c80005df0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==25313==ABORTING

            CREATE TABLE t1 (
              pk int auto_increment,
              f1 int,
              f2 INT AS (f1) STORED,
              primary key (pk),
              key (f2)
            ) ENGINE=MyISAM;
             
            INSERT INTO t1 (f1) VALUES (NULL),(2);
             
            CREATE TEMPORARY TABLE IF NOT EXISTS tmp LIKE t1;
            INSERT INTO tmp SELECT * FROM t1;
            INSERT tmp SELECT * FROM t1;
             
            # Cleanup
            DROP TABLE t1;
            

            10.4 ASAN 1bcb66c5

            ==29250==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e00006b811 at pc 0x55ddd8393d61 bp 0x7f2ecdb50050 sp 0x7f2ecdb50048
            WRITE of size 4 at 0x60e00006b811 thread T5
                #0 0x55ddd8393d60 in field_conv_memcpy /data/src/10.4/sql/field_conv.cc:833
                #1 0x55ddd8393e66 in field_conv(Field*, Field*) /data/src/10.4/sql/field_conv.cc:864
                #2 0x55ddd841eb12 in save_field_in_field /data/src/10.4/sql/item.cc:6336
                #3 0x55ddd841f16e in Item_field::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6387
                #4 0x55ddd7ac5f69 in fill_record(THD*, TABLE*, Field**, List<Item>&, bool, bool) /data/src/10.4/sql/sql_base.cc:8692
                #5 0x55ddd7ac6410 in fill_record_n_invoke_before_triggers(THD*, TABLE*, Field**, List<Item>&, bool, trg_event_type) /data/src/10.4/sql/sql_base.cc:8745
                #6 0x55ddd7b80d97 in select_insert::store_values(List<Item>&) /data/src/10.4/sql/sql_insert.cc:3917
                #7 0x55ddd7b7ffc8 in select_insert::send_data(List<Item>&) /data/src/10.4/sql/sql_insert.cc:3848
                #8 0x55ddd7d4050c in end_send /data/src/10.4/sql/sql_select.cc:21198
                #9 0x55ddd7d38659 in evaluate_join_record /data/src/10.4/sql/sql_select.cc:20229
                #10 0x55ddd7d37233 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:20009
                #11 0x55ddd7d3553e in do_select /data/src/10.4/sql/sql_select.cc:19547
                #12 0x55ddd7cce894 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4364
                #13 0x55ddd7ccc18f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4146
                #14 0x55ddd7ccfc6c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4578
                #15 0x55ddd7ca62dc in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:424
                #16 0x55ddd7c19bee in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4896
                #17 0x55ddd7c2f8fe in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157
                #18 0x55ddd7c07b07 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
                #19 0x55ddd7c04908 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358
                #20 0x55ddd7f98007 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399
                #21 0x55ddd7f97a00 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302
                #22 0x55ddd8b5f6c6 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
                #23 0x7f2ed8ed1493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
                #24 0x7f2ed72b793e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
             
            0x60e00006b811 is located 113 bytes inside of 148-byte region [0x60e00006b7a0,0x60e00006b834)
            freed by thread T5 here:
                #0 0x7f2ed913b527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
                #1 0x55ddd9510365 in free_memory /data/src/10.4/mysys/safemalloc.c:279
                #2 0x55ddd950f96b in sf_free /data/src/10.4/mysys/safemalloc.c:197
                #3 0x55ddd94e03b4 in my_free /data/src/10.4/mysys/my_malloc.c:222
                #4 0x55ddd92eae45 in mi_repair_by_sort /data/src/10.4/storage/myisam/mi_check.c:2558
                #5 0x55ddd92c7b84 in ha_myisam::repair(THD*, st_handler_check_param&, bool) /data/src/10.4/storage/myisam/ha_myisam.cc:1302
                #6 0x55ddd92ca644 in ha_myisam::enable_indexes(unsigned int) /data/src/10.4/storage/myisam/ha_myisam.cc:1640
                #7 0x55ddd92cb54c in ha_myisam::end_bulk_insert() /data/src/10.4/storage/myisam/ha_myisam.cc:1801
                #8 0x55ddd7b8a35a in handler::ha_end_bulk_insert() /data/src/10.4/sql/handler.h:3281
                #9 0x55ddd7b8115b in select_insert::prepare_eof() /data/src/10.4/sql/sql_insert.cc:3939
                #10 0x55ddd7b82815 in select_insert::send_eof() /data/src/10.4/sql/sql_insert.cc:4032
                #11 0x55ddd7d35be9 in do_select /data/src/10.4/sql/sql_select.cc:19602
                #12 0x55ddd7cce894 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4364
                #13 0x55ddd7ccc18f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4146
                #14 0x55ddd7ccfc6c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4578
                #15 0x55ddd7ca62dc in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:424
                #16 0x55ddd7c19bee in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4896
                #17 0x55ddd7c2f8fe in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157
                #18 0x55ddd7c07b07 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
                #19 0x55ddd7c04908 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358
                #20 0x55ddd7f98007 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399
                #21 0x55ddd7f97a00 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302
                #22 0x55ddd8b5f6c6 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
                #23 0x7f2ed8ed1493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
             
            previously allocated by thread T5 here:
                #0 0x7f2ed913b73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
                #1 0x55ddd950f0db in sf_malloc /data/src/10.4/mysys/safemalloc.c:118
                #2 0x55ddd94df9d6 in my_malloc /data/src/10.4/mysys/my_malloc.c:101
                #3 0x55ddd94dff1c in my_realloc /data/src/10.4/mysys/my_malloc.c:155
                #4 0x55ddd9341ffe in mi_alloc_rec_buff /data/src/10.4/storage/myisam/mi_open.c:762
                #5 0x55ddd92e7f88 in mi_repair_by_sort /data/src/10.4/storage/myisam/mi_check.c:2241
                #6 0x55ddd92c7b84 in ha_myisam::repair(THD*, st_handler_check_param&, bool) /data/src/10.4/storage/myisam/ha_myisam.cc:1302
                #7 0x55ddd92ca644 in ha_myisam::enable_indexes(unsigned int) /data/src/10.4/storage/myisam/ha_myisam.cc:1640
                #8 0x55ddd92cb54c in ha_myisam::end_bulk_insert() /data/src/10.4/storage/myisam/ha_myisam.cc:1801
                #9 0x55ddd7b8a35a in handler::ha_end_bulk_insert() /data/src/10.4/sql/handler.h:3281
                #10 0x55ddd7b8115b in select_insert::prepare_eof() /data/src/10.4/sql/sql_insert.cc:3939
                #11 0x55ddd7b82815 in select_insert::send_eof() /data/src/10.4/sql/sql_insert.cc:4032
                #12 0x55ddd7d35be9 in do_select /data/src/10.4/sql/sql_select.cc:19602
                #13 0x55ddd7cce894 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4364
                #14 0x55ddd7ccc18f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4146
                #15 0x55ddd7ccfc6c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4578
                #16 0x55ddd7ca62dc in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:424
                #17 0x55ddd7c19bee in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4896
                #18 0x55ddd7c2f8fe in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157
                #19 0x55ddd7c07b07 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
                #20 0x55ddd7c04908 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358
                #21 0x55ddd7f98007 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399
                #22 0x55ddd7f97a00 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302
                #23 0x55ddd8b5f6c6 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
                #24 0x7f2ed8ed1493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
             
            Thread T5 created by T0 here:
                #0 0x7f2ed910abba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
                #1 0x55ddd8b5fc8e in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912
                #2 0x55ddd7951246 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268
                #3 0x55ddd7966352 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6133
                #4 0x55ddd7966a57 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6203
                #5 0x55ddd7966de7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6301
                #6 0x55ddd7967a33 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6459
                #7 0x55ddd7965b8d in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5791
                #8 0x55ddd794f0cf in main /data/src/10.4/sql/main.cc:25
                #9 0x7f2ed71ef2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
             
            SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.4/sql/field_conv.cc:833 field_conv_memcpy
            Shadow bytes around the buggy address:
              0x0c1c800056b0: 00 00 00 04 fa fa fa fa fa fa fa fa fd fd fd fd
              0x0c1c800056c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
              0x0c1c800056d0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
              0x0c1c800056e0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
              0x0c1c800056f0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
            =>0x0c1c80005700: fd fd[fd]fd fd fd fd fa fa fa fa fa fa fa fa fa
              0x0c1c80005710: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
              0x0c1c80005720: 00 00 00 04 fa fa fa fa fa fa fa fa 00 00 00 00
              0x0c1c80005730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa
              0x0c1c80005740: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
              0x0c1c80005750: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
            Shadow byte legend (one shadow byte represents 8 application bytes):
              Addressable:           00
              Partially addressable: 01 02 03 04 05 06 07 
              Heap left redzone:       fa
              Heap right redzone:      fb
              Freed heap region:       fd
              Stack left redzone:      f1
              Stack mid redzone:       f2
              Stack right redzone:     f3
              Stack partial redzone:   f4
              Stack after return:      f5
              Stack use after scope:   f8
              Global redzone:          f9
              Global init order:       f6
              Poisoned by user:        f7
              Contiguous container OOB:fc
              ASan internal:           fe
            ==29250==ABORTING
            

            elenst Elena Stepanova added a comment - CREATE TABLE t1 ( pk int auto_increment, f1 int, f2 INT AS (f1) STORED, primary key (pk), key (f2) ) ENGINE=MyISAM;   INSERT INTO t1 (f1) VALUES (NULL),(2);   CREATE TEMPORARY TABLE IF NOT EXISTS tmp LIKE t1; INSERT INTO tmp SELECT * FROM t1; INSERT tmp SELECT * FROM t1;   # Cleanup DROP TABLE t1; 10.4 ASAN 1bcb66c5 ==29250==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e00006b811 at pc 0x55ddd8393d61 bp 0x7f2ecdb50050 sp 0x7f2ecdb50048 WRITE of size 4 at 0x60e00006b811 thread T5 #0 0x55ddd8393d60 in field_conv_memcpy /data/src/10.4/sql/field_conv.cc:833 #1 0x55ddd8393e66 in field_conv(Field*, Field*) /data/src/10.4/sql/field_conv.cc:864 #2 0x55ddd841eb12 in save_field_in_field /data/src/10.4/sql/item.cc:6336 #3 0x55ddd841f16e in Item_field::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6387 #4 0x55ddd7ac5f69 in fill_record(THD*, TABLE*, Field**, List<Item>&, bool, bool) /data/src/10.4/sql/sql_base.cc:8692 #5 0x55ddd7ac6410 in fill_record_n_invoke_before_triggers(THD*, TABLE*, Field**, List<Item>&, bool, trg_event_type) /data/src/10.4/sql/sql_base.cc:8745 #6 0x55ddd7b80d97 in select_insert::store_values(List<Item>&) /data/src/10.4/sql/sql_insert.cc:3917 #7 0x55ddd7b7ffc8 in select_insert::send_data(List<Item>&) /data/src/10.4/sql/sql_insert.cc:3848 #8 0x55ddd7d4050c in end_send /data/src/10.4/sql/sql_select.cc:21198 #9 0x55ddd7d38659 in evaluate_join_record /data/src/10.4/sql/sql_select.cc:20229 #10 0x55ddd7d37233 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:20009 #11 0x55ddd7d3553e in do_select /data/src/10.4/sql/sql_select.cc:19547 #12 0x55ddd7cce894 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4364 #13 0x55ddd7ccc18f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4146 #14 0x55ddd7ccfc6c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4578 #15 0x55ddd7ca62dc in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:424 #16 0x55ddd7c19bee in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4896 #17 0x55ddd7c2f8fe in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157 #18 0x55ddd7c07b07 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829 #19 0x55ddd7c04908 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358 #20 0x55ddd7f98007 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399 #21 0x55ddd7f97a00 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302 #22 0x55ddd8b5f6c6 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862 #23 0x7f2ed8ed1493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493) #24 0x7f2ed72b793e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)   0x60e00006b811 is located 113 bytes inside of 148-byte region [0x60e00006b7a0,0x60e00006b834) freed by thread T5 here: #0 0x7f2ed913b527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527) #1 0x55ddd9510365 in free_memory /data/src/10.4/mysys/safemalloc.c:279 #2 0x55ddd950f96b in sf_free /data/src/10.4/mysys/safemalloc.c:197 #3 0x55ddd94e03b4 in my_free /data/src/10.4/mysys/my_malloc.c:222 #4 0x55ddd92eae45 in mi_repair_by_sort /data/src/10.4/storage/myisam/mi_check.c:2558 #5 0x55ddd92c7b84 in ha_myisam::repair(THD*, st_handler_check_param&, bool) /data/src/10.4/storage/myisam/ha_myisam.cc:1302 #6 0x55ddd92ca644 in ha_myisam::enable_indexes(unsigned int) /data/src/10.4/storage/myisam/ha_myisam.cc:1640 #7 0x55ddd92cb54c in ha_myisam::end_bulk_insert() /data/src/10.4/storage/myisam/ha_myisam.cc:1801 #8 0x55ddd7b8a35a in handler::ha_end_bulk_insert() /data/src/10.4/sql/handler.h:3281 #9 0x55ddd7b8115b in select_insert::prepare_eof() /data/src/10.4/sql/sql_insert.cc:3939 #10 0x55ddd7b82815 in select_insert::send_eof() /data/src/10.4/sql/sql_insert.cc:4032 #11 0x55ddd7d35be9 in do_select /data/src/10.4/sql/sql_select.cc:19602 #12 0x55ddd7cce894 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4364 #13 0x55ddd7ccc18f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4146 #14 0x55ddd7ccfc6c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4578 #15 0x55ddd7ca62dc in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:424 #16 0x55ddd7c19bee in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4896 #17 0x55ddd7c2f8fe in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157 #18 0x55ddd7c07b07 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829 #19 0x55ddd7c04908 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358 #20 0x55ddd7f98007 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399 #21 0x55ddd7f97a00 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302 #22 0x55ddd8b5f6c6 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862 #23 0x7f2ed8ed1493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)   previously allocated by thread T5 here: #0 0x7f2ed913b73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f) #1 0x55ddd950f0db in sf_malloc /data/src/10.4/mysys/safemalloc.c:118 #2 0x55ddd94df9d6 in my_malloc /data/src/10.4/mysys/my_malloc.c:101 #3 0x55ddd94dff1c in my_realloc /data/src/10.4/mysys/my_malloc.c:155 #4 0x55ddd9341ffe in mi_alloc_rec_buff /data/src/10.4/storage/myisam/mi_open.c:762 #5 0x55ddd92e7f88 in mi_repair_by_sort /data/src/10.4/storage/myisam/mi_check.c:2241 #6 0x55ddd92c7b84 in ha_myisam::repair(THD*, st_handler_check_param&, bool) /data/src/10.4/storage/myisam/ha_myisam.cc:1302 #7 0x55ddd92ca644 in ha_myisam::enable_indexes(unsigned int) /data/src/10.4/storage/myisam/ha_myisam.cc:1640 #8 0x55ddd92cb54c in ha_myisam::end_bulk_insert() /data/src/10.4/storage/myisam/ha_myisam.cc:1801 #9 0x55ddd7b8a35a in handler::ha_end_bulk_insert() /data/src/10.4/sql/handler.h:3281 #10 0x55ddd7b8115b in select_insert::prepare_eof() /data/src/10.4/sql/sql_insert.cc:3939 #11 0x55ddd7b82815 in select_insert::send_eof() /data/src/10.4/sql/sql_insert.cc:4032 #12 0x55ddd7d35be9 in do_select /data/src/10.4/sql/sql_select.cc:19602 #13 0x55ddd7cce894 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4364 #14 0x55ddd7ccc18f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4146 #15 0x55ddd7ccfc6c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4578 #16 0x55ddd7ca62dc in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:424 #17 0x55ddd7c19bee in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4896 #18 0x55ddd7c2f8fe in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157 #19 0x55ddd7c07b07 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829 #20 0x55ddd7c04908 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358 #21 0x55ddd7f98007 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399 #22 0x55ddd7f97a00 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302 #23 0x55ddd8b5f6c6 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862 #24 0x7f2ed8ed1493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)   Thread T5 created by T0 here: #0 0x7f2ed910abba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba) #1 0x55ddd8b5fc8e in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912 #2 0x55ddd7951246 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268 #3 0x55ddd7966352 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6133 #4 0x55ddd7966a57 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6203 #5 0x55ddd7966de7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6301 #6 0x55ddd7967a33 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6459 #7 0x55ddd7965b8d in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5791 #8 0x55ddd794f0cf in main /data/src/10.4/sql/main.cc:25 #9 0x7f2ed71ef2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)   SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.4/sql/field_conv.cc:833 field_conv_memcpy Shadow bytes around the buggy address: 0x0c1c800056b0: 00 00 00 04 fa fa fa fa fa fa fa fa fd fd fd fd 0x0c1c800056c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa 0x0c1c800056d0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c1c800056e0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa 0x0c1c800056f0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c1c80005700: fd fd[fd]fd fd fd fd fa fa fa fa fa fa fa fa fa 0x0c1c80005710: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c1c80005720: 00 00 00 04 fa fa fa fa fa fa fa fa 00 00 00 00 0x0c1c80005730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa 0x0c1c80005740: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c1c80005750: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==29250==ABORTING
            elenst Elena Stepanova added a comment - - edited

            The bug appears to be fixed in the scope of MDEV-18486.

            elenst Elena Stepanova added a comment - - edited The bug appears to be fixed in the scope of MDEV-18486 .

            People

              serg Sergei Golubchik
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.