Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-18801

InnoDB: Failing assertion: field->col->mtype == type or ASAN heap-buffer-overflow in row_sel_convert_mysql_key_to_innobase upon SELECT on table with long index

    XMLWordPrintable

    Details

      Description

      --source include/have_innodb.inc
      CREATE TABLE t1 (f VARCHAR(4096), UNIQUE(f)) ENGINE=InnoDB;
      --error ER_CANT_DROP_FIELD_OR_KEY
      ALTER TABLE t1 DROP x;
      SELECT * FROM t1 WHERE f LIKE 'foo';
       
      # Cleanup
      DROP TABLE t1;
      

      10.4 3b47587f

      ==17299==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61300010a518 at pc 0x559d59de8b85 bp 0x7fc90e4acc70 sp 0x7fc90e4acc68
      READ of size 8 at 0x61300010a518 thread T27
          #0 0x559d59de8b84 in row_sel_convert_mysql_key_to_innobase(dtuple_t*, unsigned char*, unsigned long, dict_index_t*, unsigned char const*, unsigned long) /data/src/10.4/storage/innobase/row/row0sel.cc:2550
          #1 0x559d59ae75d1 in ha_innobase::records_in_range(unsigned int, st_key_range*, st_key_range*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:13537
          #2 0x559d58f59f55 in handler::multi_range_read_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/sql/multi_range_read.cc:177
          #3 0x559d58f652ac in DsMrr_impl::dsmrr_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/sql/multi_range_read.cc:1579
          #4 0x559d59afdeb0 in ha_innobase::multi_range_read_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:20289
          #5 0x559d59666828 in check_quick_select /data/src/10.4/sql/opt_range.cc:11070
          #6 0x559d59650709 in get_key_scans_params /data/src/10.4/sql/opt_range.cc:7374
          #7 0x559d59635900 in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool) /data/src/10.4/sql/opt_range.cc:2902
          #8 0x559d58bf02e1 in get_quick_record_count /data/src/10.4/sql/sql_select.cc:4622
          #9 0x559d58bf665c in make_join_statistics /data/src/10.4/sql/sql_select.cc:5348
          #10 0x559d58bd83b2 in JOIN::optimize_inner() /data/src/10.4/sql/sql_select.cc:2167
          #11 0x559d58bd2416 in JOIN::optimize() /data/src/10.4/sql/sql_select.cc:1551
          #12 0x559d58befb13 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4564
          #13 0x559d58bc637a in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:424
          #14 0x559d58b470a3 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604
          #15 0x559d58b33c2c in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841
          #16 0x559d58b4f996 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157
          #17 0x559d58b27b9f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
          #18 0x559d58b249a0 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358
          #19 0x559d58eb80d3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399
          #20 0x559d58eb7acc in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302
          #21 0x559d59a81dae in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
          #22 0x7fc919e5a493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
          #23 0x7fc91824093e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
       
      0x61300010a518 is located 16 bytes to the right of 328-byte region [0x61300010a3c0,0x61300010a508)
      allocated by thread T27 here:
          #0 0x7fc91a0c473f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
          #1 0x559d59c52891 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /data/src/10.4/storage/innobase/mem/mem0mem.cc:269
          #2 0x559d59aa7412 in mem_heap_create_func /data/src/10.4/storage/innobase/include/mem0mem.ic:484
          #3 0x559d59ae7029 in ha_innobase::records_in_range(unsigned int, st_key_range*, st_key_range*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:13511
          #4 0x559d58f59f55 in handler::multi_range_read_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/sql/multi_range_read.cc:177
          #5 0x559d58f652ac in DsMrr_impl::dsmrr_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/sql/multi_range_read.cc:1579
          #6 0x559d59afdeb0 in ha_innobase::multi_range_read_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:20289
          #7 0x559d59666828 in check_quick_select /data/src/10.4/sql/opt_range.cc:11070
          #8 0x559d59650709 in get_key_scans_params /data/src/10.4/sql/opt_range.cc:7374
          #9 0x559d59635900 in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool) /data/src/10.4/sql/opt_range.cc:2902
          #10 0x559d58bf02e1 in get_quick_record_count /data/src/10.4/sql/sql_select.cc:4622
          #11 0x559d58bf665c in make_join_statistics /data/src/10.4/sql/sql_select.cc:5348
          #12 0x559d58bd83b2 in JOIN::optimize_inner() /data/src/10.4/sql/sql_select.cc:2167
          #13 0x559d58bd2416 in JOIN::optimize() /data/src/10.4/sql/sql_select.cc:1551
          #14 0x559d58befb13 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4564
          #15 0x559d58bc637a in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:424
          #16 0x559d58b470a3 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604
          #17 0x559d58b33c2c in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841
          #18 0x559d58b4f996 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157
          #19 0x559d58b27b9f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
          #20 0x559d58b249a0 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358
          #21 0x559d58eb80d3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399
          #22 0x559d58eb7acc in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302
          #23 0x559d59a81dae in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
          #24 0x7fc919e5a493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
       
      Thread T27 created by T0 here:
          #0 0x7fc91a093bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
          #1 0x559d59a82376 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912
          #2 0x559d588724a6 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268
          #3 0x559d588875b2 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6133
          #4 0x559d58887cb7 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6203
          #5 0x559d58888047 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6301
          #6 0x559d58888c93 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6459
          #7 0x559d58886ded in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5791
          #8 0x559d5887032f in main /data/src/10.4/sql/main.cc:25
          #9 0x7fc9181782b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
       
      SUMMARY: AddressSanitizer: heap-buffer-overflow /data/src/10.4/storage/innobase/row/row0sel.cc:2550 row_sel_convert_mysql_key_to_innobase(dtuple_t*, unsigned char*, unsigned long, dict_index_t*, unsigned char const*, unsigned long)
      Shadow bytes around the buggy address:
        0x0c2680019450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c2680019460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c2680019470: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
        0x0c2680019480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c2680019490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      =>0x0c26800194a0: 00 fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c26800194b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c26800194c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c26800194d0: 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa
        0x0c26800194e0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
        0x0c26800194f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Contiguous container OOB:fc
        ASan internal:           fe
      ==17299==ABORTING
      

      10.4 3b47587f

      2019-03-03 15:15:44 0x7efd81d1a700  InnoDB: Assertion failure in file /data/src/10.4/storage/innobase/row/row0sel.cc line 2551
      InnoDB: Failing assertion: field->col->mtype == type
       
      #5  0x00007efd889f93fa in abort () from /lib/x86_64-linux-gnu/libc.so.6
      #6  0x000055deffc05260 in ut_dbg_assertion_failed (expr=0x55df0021b8da "field->col->mtype == type", file=0x55df0021b1e0 "/data/src/10.4/storage/innobase/row/row0sel.cc", line=2551) at /data/src/10.4/storage/innobase/ut/ut0dbg.cc:60
      #7  0x000055deffb7d0be in row_sel_convert_mysql_key_to_innobase (tuple=0x7efd38073bc8, buf=0x7efd38154590 "", buf_len=8, index=0x7efd38151918, key_ptr=0x7efd38070a21 ' ' <repeats 200 times>..., key_len=4099) at /data/src/10.4/storage/innobase/row/row0sel.cc:2551
      #8  0x000055deff9ea51e in ha_innobase::records_in_range (this=0x7efd381a2538, keynr=0, min_key=0x0, max_key=0x7efd81d166d0) at /data/src/10.4/storage/innobase/handler/ha_innodb.cc:13537
      #9  0x000055deff518531 in handler::multi_range_read_info_const (this=0x7efd381a2538, keyno=0, seq=0x7efd81d168d0, seq_init_param=0x7efd81d16900, n_ranges_arg=0, bufsz=0x7efd81d167d4, flags=0x7efd81d167d0, cost=0x7efd81d16f90) at /data/src/10.4/sql/multi_range_read.cc:177
      #10 0x000055deff51bf44 in DsMrr_impl::dsmrr_info_const (this=0x7efd381a2990, keyno=0, seq=0x7efd81d168d0, seq_init_param=0x7efd81d16900, n_ranges=0, bufsz=0x7efd81d16e88, flags=0x7efd81d16e84, cost=0x7efd81d16f90) at /data/src/10.4/sql/multi_range_read.cc:1579
      #11 0x000055deff9f4c54 in ha_innobase::multi_range_read_info_const (this=0x7efd381a2538, keyno=0, seq=0x7efd81d168d0, seq_init_param=0x7efd81d16900, n_ranges=0, bufsz=0x7efd81d16e88, flags=0x7efd81d16e84, cost=0x7efd81d16f90) at /data/src/10.4/storage/innobase/handler/ha_innodb.cc:20289
      #12 0x000055deff81a43a in check_quick_select (param=0x7efd81d17200, idx=0, index_only=true, tree=0x7efd3806e9e0, update_tbl_stats=true, mrr_flags=0x7efd81d16e84, bufsize=0x7efd81d16e88, cost=0x7efd81d16f90) at /data/src/10.4/sql/opt_range.cc:11070
      #13 0x000055deff810db2 in get_key_scans_params (param=0x7efd81d17200, tree=0x7efd3806e960, index_read_must_be_used=false, update_tbl_stats=true, read_time=1.0501830942935613) at /data/src/10.4/sql/opt_range.cc:7374
      #14 0x000055deff8058df in SQL_SELECT::test_quick_select (this=0x7efd380189d0, thd=0x7efd38000b00, keys_to_use=..., prev_tables=0, limit=18446744073709551615, force_quick_range=false, ordered_output=false, remove_false_parts_of_where=true, only_single_index_range_scan=false) at /data/src/10.4/sql/opt_range.cc:2902
      #15 0x000055deff3a5f5e in get_quick_record_count (thd=0x7efd38000b00, select=0x7efd380189d0, table=0x7efd381a16d0, keys=0x7efd38017950, limit=18446744073709551615) at /data/src/10.4/sql/sql_select.cc:4622
      #16 0x000055deff3a87a5 in make_join_statistics (join=0x7efd38016ed0, tables_list=..., keyuse_array=0x7efd380171c0) at /data/src/10.4/sql/sql_select.cc:5348
      #17 0x000055deff39d191 in JOIN::optimize_inner (this=0x7efd38016ed0) at /data/src/10.4/sql/sql_select.cc:2167
      #18 0x000055deff39ad4e in JOIN::optimize (this=0x7efd38016ed0) at /data/src/10.4/sql/sql_select.cc:1551
      #19 0x000055deff3a5c30 in mysql_select (thd=0x7efd38000b00, tables=0x7efd38015b10, wild_num=1, fields=..., conds=0x7efd38016418, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7efd38016ea8, unit=0x7efd38004a18, select_lex=0x7efd38015558) at /data/src/10.4/sql/sql_select.cc:4564
      #20 0x000055deff396274 in handle_select (thd=0x7efd38000b00, lex=0x7efd38004950, result=0x7efd38016ea8, setup_tables_done_option=0) at /data/src/10.4/sql/sql_select.cc:424
      #21 0x000055deff35f6e7 in execute_sqlcom_select (thd=0x7efd38000b00, all_tables=0x7efd38015b10) at /data/src/10.4/sql/sql_parse.cc:6604
      #22 0x000055deff35498e in mysql_execute_command (thd=0x7efd38000b00) at /data/src/10.4/sql/sql_parse.cc:3841
      #23 0x000055deff363636 in mysql_parse (thd=0x7efd38000b00, rawbuf=0x7efd380154a8 "SELECT * FROM t1 WHERE f LIKE 'foo'", length=35, parser_state=0x7efd81d19180, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:8157
      #24 0x000055deff34ed24 in dispatch_command (command=COM_QUERY, thd=0x7efd38000b00, packet=0x7efd3813a181 "SELECT * FROM t1 WHERE f LIKE 'foo'", packet_length=35, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1829
      #25 0x000055deff34d4f8 in do_command (thd=0x7efd38000b00) at /data/src/10.4/sql/sql_parse.cc:1358
      #26 0x000055deff4c7003 in do_handle_one_connection (connect=0x55df01bb19d0) at /data/src/10.4/sql/sql_connect.cc:1399
      #27 0x000055deff4c6d74 in handle_one_connection (arg=0x55df01bb19d0) at /data/src/10.4/sql/sql_connect.cc:1302
      #28 0x000055deff9bdd17 in pfs_spawn_thread (arg=0x55df01bf7840) at /data/src/10.4/storage/perfschema/pfs.cc:1862
      #29 0x00007efd8a6c7494 in start_thread (arg=0x7efd81d1a700) at pthread_create.c:333
      #30 0x00007efd88aad93f in clone () from /lib/x86_64-linux-gnu/libc.so.6
      

      Non-debug build fails the same way.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              serg Sergei Golubchik
              Reporter:
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: