InnoDB: Failing assertion: field->col->mtype == type or ASAN heap-buffer-overflow in row_sel_convert_mysql_key_to_innobase upon SELECT on table with long index

--source include/have_innodb.inc

CREATE TABLE t1 (f VARCHAR(4096), UNIQUE(f)) ENGINE=InnoDB;

--error ER_CANT_DROP_FIELD_OR_KEY

ALTER TABLE t1 DROP x;

SELECT * FROM t1 WHERE f LIKE 'foo';

# Cleanup

DROP TABLE t1;

==17299==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61300010a518 at pc 0x559d59de8b85 bp 0x7fc90e4acc70 sp 0x7fc90e4acc68

READ of size 8 at 0x61300010a518 thread T27

    #0 0x559d59de8b84 in row_sel_convert_mysql_key_to_innobase(dtuple_t*, unsigned char*, unsigned long, dict_index_t*, unsigned char const*, unsigned long) /data/src/10.4/storage/innobase/row/row0sel.cc:2550

    #1 0x559d59ae75d1 in ha_innobase::records_in_range(unsigned int, st_key_range*, st_key_range*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:13537

    #2 0x559d58f59f55 in handler::multi_range_read_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/sql/multi_range_read.cc:177

    #3 0x559d58f652ac in DsMrr_impl::dsmrr_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/sql/multi_range_read.cc:1579

    #4 0x559d59afdeb0 in ha_innobase::multi_range_read_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:20289

    #5 0x559d59666828 in check_quick_select /data/src/10.4/sql/opt_range.cc:11070

    #6 0x559d59650709 in get_key_scans_params /data/src/10.4/sql/opt_range.cc:7374

    #7 0x559d59635900 in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool) /data/src/10.4/sql/opt_range.cc:2902

    #8 0x559d58bf02e1 in get_quick_record_count /data/src/10.4/sql/sql_select.cc:4622

    #9 0x559d58bf665c in make_join_statistics /data/src/10.4/sql/sql_select.cc:5348

    #10 0x559d58bd83b2 in JOIN::optimize_inner() /data/src/10.4/sql/sql_select.cc:2167

    #11 0x559d58bd2416 in JOIN::optimize() /data/src/10.4/sql/sql_select.cc:1551

    #12 0x559d58befb13 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4564

    #13 0x559d58bc637a in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:424

    #14 0x559d58b470a3 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604

    #15 0x559d58b33c2c in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841

    #16 0x559d58b4f996 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157

    #17 0x559d58b27b9f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829

    #18 0x559d58b249a0 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358

    #19 0x559d58eb80d3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399

    #20 0x559d58eb7acc in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302

    #21 0x559d59a81dae in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862

    #22 0x7fc919e5a493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

    #23 0x7fc91824093e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x61300010a518 is located 16 bytes to the right of 328-byte region [0x61300010a3c0,0x61300010a508)

allocated by thread T27 here:

    #0 0x7fc91a0c473f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)

    #1 0x559d59c52891 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /data/src/10.4/storage/innobase/mem/mem0mem.cc:269

    #2 0x559d59aa7412 in mem_heap_create_func /data/src/10.4/storage/innobase/include/mem0mem.ic:484

    #3 0x559d59ae7029 in ha_innobase::records_in_range(unsigned int, st_key_range*, st_key_range*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:13511

    #4 0x559d58f59f55 in handler::multi_range_read_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/sql/multi_range_read.cc:177

    #5 0x559d58f652ac in DsMrr_impl::dsmrr_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/sql/multi_range_read.cc:1579

    #6 0x559d59afdeb0 in ha_innobase::multi_range_read_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:20289

    #7 0x559d59666828 in check_quick_select /data/src/10.4/sql/opt_range.cc:11070

    #8 0x559d59650709 in get_key_scans_params /data/src/10.4/sql/opt_range.cc:7374

    #9 0x559d59635900 in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool) /data/src/10.4/sql/opt_range.cc:2902

    #10 0x559d58bf02e1 in get_quick_record_count /data/src/10.4/sql/sql_select.cc:4622

    #11 0x559d58bf665c in make_join_statistics /data/src/10.4/sql/sql_select.cc:5348

    #12 0x559d58bd83b2 in JOIN::optimize_inner() /data/src/10.4/sql/sql_select.cc:2167

    #13 0x559d58bd2416 in JOIN::optimize() /data/src/10.4/sql/sql_select.cc:1551

    #14 0x559d58befb13 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4564

    #15 0x559d58bc637a in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:424

    #16 0x559d58b470a3 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604

    #17 0x559d58b33c2c in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841

    #18 0x559d58b4f996 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157

    #19 0x559d58b27b9f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829

    #20 0x559d58b249a0 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358

    #21 0x559d58eb80d3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399

    #22 0x559d58eb7acc in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302

    #23 0x559d59a81dae in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862

    #24 0x7fc919e5a493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

Thread T27 created by T0 here:

    #0 0x7fc91a093bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)

    #1 0x559d59a82376 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912

    #2 0x559d588724a6 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268

    #3 0x559d588875b2 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6133

    #4 0x559d58887cb7 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6203

    #5 0x559d58888047 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6301

    #6 0x559d58888c93 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6459

    #7 0x559d58886ded in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5791

    #8 0x559d5887032f in main /data/src/10.4/sql/main.cc:25

    #9 0x7fc9181782b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: heap-buffer-overflow /data/src/10.4/storage/innobase/row/row0sel.cc:2550 row_sel_convert_mysql_key_to_innobase(dtuple_t*, unsigned char*, unsigned long, dict_index_t*, unsigned char const*, unsigned long)

Shadow bytes around the buggy address:

  0x0c2680019450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2680019460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2680019470: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00

  0x0c2680019480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c2680019490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

=>0x0c26800194a0: 00 fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c26800194b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c26800194c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c26800194d0: 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa

  0x0c26800194e0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00

  0x0c26800194f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Contiguous container OOB:fc

  ASan internal:           fe

==17299==ABORTING

2019-03-03 15:15:44 0x7efd81d1a700  InnoDB: Assertion failure in file /data/src/10.4/storage/innobase/row/row0sel.cc line 2551

InnoDB: Failing assertion: field->col->mtype == type

#5  0x00007efd889f93fa in abort () from /lib/x86_64-linux-gnu/libc.so.6

#6  0x000055deffc05260 in ut_dbg_assertion_failed (expr=0x55df0021b8da "field->col->mtype == type", file=0x55df0021b1e0 "/data/src/10.4/storage/innobase/row/row0sel.cc", line=2551) at /data/src/10.4/storage/innobase/ut/ut0dbg.cc:60

#7  0x000055deffb7d0be in row_sel_convert_mysql_key_to_innobase (tuple=0x7efd38073bc8, buf=0x7efd38154590 "", buf_len=8, index=0x7efd38151918, key_ptr=0x7efd38070a21 ' ' <repeats 200 times>..., key_len=4099) at /data/src/10.4/storage/innobase/row/row0sel.cc:2551

#8  0x000055deff9ea51e in ha_innobase::records_in_range (this=0x7efd381a2538, keynr=0, min_key=0x0, max_key=0x7efd81d166d0) at /data/src/10.4/storage/innobase/handler/ha_innodb.cc:13537

#9  0x000055deff518531 in handler::multi_range_read_info_const (this=0x7efd381a2538, keyno=0, seq=0x7efd81d168d0, seq_init_param=0x7efd81d16900, n_ranges_arg=0, bufsz=0x7efd81d167d4, flags=0x7efd81d167d0, cost=0x7efd81d16f90) at /data/src/10.4/sql/multi_range_read.cc:177

#10 0x000055deff51bf44 in DsMrr_impl::dsmrr_info_const (this=0x7efd381a2990, keyno=0, seq=0x7efd81d168d0, seq_init_param=0x7efd81d16900, n_ranges=0, bufsz=0x7efd81d16e88, flags=0x7efd81d16e84, cost=0x7efd81d16f90) at /data/src/10.4/sql/multi_range_read.cc:1579

#11 0x000055deff9f4c54 in ha_innobase::multi_range_read_info_const (this=0x7efd381a2538, keyno=0, seq=0x7efd81d168d0, seq_init_param=0x7efd81d16900, n_ranges=0, bufsz=0x7efd81d16e88, flags=0x7efd81d16e84, cost=0x7efd81d16f90) at /data/src/10.4/storage/innobase/handler/ha_innodb.cc:20289

#12 0x000055deff81a43a in check_quick_select (param=0x7efd81d17200, idx=0, index_only=true, tree=0x7efd3806e9e0, update_tbl_stats=true, mrr_flags=0x7efd81d16e84, bufsize=0x7efd81d16e88, cost=0x7efd81d16f90) at /data/src/10.4/sql/opt_range.cc:11070

#13 0x000055deff810db2 in get_key_scans_params (param=0x7efd81d17200, tree=0x7efd3806e960, index_read_must_be_used=false, update_tbl_stats=true, read_time=1.0501830942935613) at /data/src/10.4/sql/opt_range.cc:7374

#14 0x000055deff8058df in SQL_SELECT::test_quick_select (this=0x7efd380189d0, thd=0x7efd38000b00, keys_to_use=..., prev_tables=0, limit=18446744073709551615, force_quick_range=false, ordered_output=false, remove_false_parts_of_where=true, only_single_index_range_scan=false) at /data/src/10.4/sql/opt_range.cc:2902

#15 0x000055deff3a5f5e in get_quick_record_count (thd=0x7efd38000b00, select=0x7efd380189d0, table=0x7efd381a16d0, keys=0x7efd38017950, limit=18446744073709551615) at /data/src/10.4/sql/sql_select.cc:4622

#16 0x000055deff3a87a5 in make_join_statistics (join=0x7efd38016ed0, tables_list=..., keyuse_array=0x7efd380171c0) at /data/src/10.4/sql/sql_select.cc:5348

#17 0x000055deff39d191 in JOIN::optimize_inner (this=0x7efd38016ed0) at /data/src/10.4/sql/sql_select.cc:2167

#18 0x000055deff39ad4e in JOIN::optimize (this=0x7efd38016ed0) at /data/src/10.4/sql/sql_select.cc:1551

#19 0x000055deff3a5c30 in mysql_select (thd=0x7efd38000b00, tables=0x7efd38015b10, wild_num=1, fields=..., conds=0x7efd38016418, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7efd38016ea8, unit=0x7efd38004a18, select_lex=0x7efd38015558) at /data/src/10.4/sql/sql_select.cc:4564

#20 0x000055deff396274 in handle_select (thd=0x7efd38000b00, lex=0x7efd38004950, result=0x7efd38016ea8, setup_tables_done_option=0) at /data/src/10.4/sql/sql_select.cc:424

#21 0x000055deff35f6e7 in execute_sqlcom_select (thd=0x7efd38000b00, all_tables=0x7efd38015b10) at /data/src/10.4/sql/sql_parse.cc:6604

#22 0x000055deff35498e in mysql_execute_command (thd=0x7efd38000b00) at /data/src/10.4/sql/sql_parse.cc:3841

#23 0x000055deff363636 in mysql_parse (thd=0x7efd38000b00, rawbuf=0x7efd380154a8 "SELECT * FROM t1 WHERE f LIKE 'foo'", length=35, parser_state=0x7efd81d19180, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:8157

#24 0x000055deff34ed24 in dispatch_command (command=COM_QUERY, thd=0x7efd38000b00, packet=0x7efd3813a181 "SELECT * FROM t1 WHERE f LIKE 'foo'", packet_length=35, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1829

#25 0x000055deff34d4f8 in do_command (thd=0x7efd38000b00) at /data/src/10.4/sql/sql_parse.cc:1358

#26 0x000055deff4c7003 in do_handle_one_connection (connect=0x55df01bb19d0) at /data/src/10.4/sql/sql_connect.cc:1399

#27 0x000055deff4c6d74 in handle_one_connection (arg=0x55df01bb19d0) at /data/src/10.4/sql/sql_connect.cc:1302

#28 0x000055deff9bdd17 in pfs_spawn_thread (arg=0x55df01bf7840) at /data/src/10.4/storage/perfschema/pfs.cc:1862

#29 0x00007efd8a6c7494 in start_thread (arg=0x7efd81d1a700) at pthread_create.c:333

#30 0x00007efd88aad93f in clone () from /lib/x86_64-linux-gnu/libc.so.6