[MDEV-19637] Crash on an SP variable assignment to a wrong subselect - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.4(EOL), 10.5
Fix Version/s: 10.4.6, 10.5.0
Component/s: Stored routines
Labels:
None

Description

SET sql_mode='';

DELIMITER $$

BEGIN NOT ATOMIC

  DECLARE a INT;

  SET a=(SELECT 1 FROM DUAL UNION SELECT HIGH_PRIORITY 2 FROM DUAL);

END;

$$

DELIMITER ;

ERROR 2013 (HY000): Lost connection to MySQL server during query

Note, 10.3 correctly returns the expected error without crashing:

ERROR 1234 (42000): Incorrect usage/placement of 'HIGH_PRIORITY'

Attachments

Issue Links

blocks

MDEV-5816 MySQL WL#4179 - Stored programs: validation of stored program statements

Closed

Activity

Elena Stepanova added a comment - 2019-05-30 10:44 - edited

To make it findable and comparable:

10.4 7d3a759d
#3 <signal handler called>
#4 0x0000562e0d716119 in plugin_unlock_list (thd=0x0, list=0x8f8f8f8f8f8f8f97, count=2408550286) at /data/src/10.4/sql/sql_plugin.cc:1404
#5 0x0000562e0d6c4e70 in lex_end_stage1 (lex=0x7fee34147a28) at /data/src/10.4/sql/sql_lex.cc:803
#6 0x0000562e0d6c4dd1 in lex_end (lex=0x7fee34147a28) at /data/src/10.4/sql/sql_lex.cc:789
#7 0x0000562e0d610b87 in sp_head::~sp_head (this=0x7fee34136d78, __in_chrg=<optimized out>) at /data/src/10.4/sql/sp_head.cc:821
#8 0x0000562e0d610c5e in sp_head::~sp_head (this=0x7fee34136d78, __in_chrg=<optimized out>) at /data/src/10.4/sql/sp_head.cc:832
#9 0x0000562e0d6ca9b4 in LEX::cleanup_lex_after_parse_error (thd=0x7fee34000b00) at /data/src/10.4/sql/sql_lex.cc:3138
#10 0x0000562e0d9a105c in MYSQLparse (thd=0x7fee34000b00) at /data/src/10.4/sql/sql_yacc.yy:16264
#11 0x0000562e0d710488 in parse_sql (thd=0x7fee34000b00, parser_state=0x7fee44ece180, creation_ctx=0x0, do_pfs_digest=true) at /data/src/10.4/sql/sql_parse.cc:10184
#12 0x0000562e0d70b404 in mysql_parse (thd=0x7fee34000b00, rawbuf=0x7fee34013108 "BEGIN NOT ATOMIC\nDECLARE a INT;\nSET a=(SELECT 1 FROM DUAL UNION SELECT HIGH_PRIORITY 2 FROM DUAL);\nEND", length=102, parser_state=0x7fee44ece180, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:8110
#13 0x0000562e0d6f6c83 in dispatch_command (command=COM_QUERY, thd=0x7fee34000b00, packet=0x7fee34008311 "BEGIN NOT ATOMIC\nDECLARE a INT;\nSET a=(SELECT 1 FROM DUAL UNION SELECT HIGH_PRIORITY 2 FROM DUAL);\nEND;\n", packet_length=104, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1829
#14 0x0000562e0d6f5441 in do_command (thd=0x7fee34000b00) at /data/src/10.4/sql/sql_parse.cc:1362
#15 0x0000562e0d86d411 in do_handle_one_connection (connect=0x562e0fff7010) at /data/src/10.4/sql/sql_connect.cc:1403
#16 0x0000562e0d86d175 in handle_one_connection (arg=0x562e0fff7010) at /data/src/10.4/sql/sql_connect.cc:1306
#17 0x0000562e0e1956ab in pfs_spawn_thread (arg=0x562e1002c3a0) at /data/src/10.4/storage/perfschema/pfs.cc:1862
#18 0x00007fee4c8714a4 in start_thread (arg=0x7fee44ecf700) at pthread_create.c:456
#19 0x00007fee4adb9d0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97

==31430==ERROR: AddressSanitizer: use-after-poison on address 0x6250000e7a58 at pc 0x55c409bba3fa bp 0x7f88f643fe00 sp 0x7f88f643fdf8

WRITE of size 8 at 0x6250000e7a58 thread T5

    #0 0x55c409bba3f9 in sp_head::~sp_head() /data/src/10.4/sql/sp_head.cc:820

    #1 0x55c409bba659 in sp_head::~sp_head() /data/src/10.4/sql/sp_head.cc:832

    #2 0x55c409d604e0 in LEX::cleanup_lex_after_parse_error(THD*) /data/src/10.4/sql/sql_lex.cc:3138

    #3 0x55c40a3afcf3 in MYSQLparse(THD*) /data/src/10.4/sql/sql_yacc.yy:16264

    #4 0x55c409df0d52 in parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool) /data/src/10.4/sql/sql_parse.cc:10184

    #5 0x55c409de440c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8110

    #6 0x55c409dbd56a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829

    #7 0x55c409dba4d9 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1362

    #8 0x55c40a12df90 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1403

    #9 0x55c40a12d959 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1306

    #10 0x55c40b4ccf71 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862

    #11 0x7f8900c4b4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

    #12 0x7f88ff193d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)

0x6250000e7a58 is located 6488 bytes inside of 8268-byte region [0x6250000e6100,0x6250000e814c)

allocated by thread T5 here:

    #0 0x7f8900f22d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)

    #1 0x55c40b5f1eb8 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118

    #2 0x55c40b5c4159 in my_malloc /data/src/10.4/mysys/my_malloc.c:101

    #3 0x55c40b5a46f8 in alloc_root /data/src/10.4/mysys/my_alloc.c:250

    #4 0x55c409b40c49 in Sql_alloc::operator new(unsigned long, st_mem_root*) /data/src/10.4/sql/sql_alloc.h:39

    #5 0x55c409bc2d15 in sp_head::reset_lex(THD*) /data/src/10.4/sql/sp_head.cc:2402

    #6 0x55c40a34b886 in sp_create_assignment_lex(THD*, bool) /data/src/10.4/sql/sql_yacc.yy:520

    #7 0x55c40a3afa39 in MYSQLparse(THD*) /data/src/10.4/sql/sql_yacc.yy:16220

    #8 0x55c409df0d52 in parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool) /data/src/10.4/sql/sql_parse.cc:10184

    #9 0x55c409de440c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8110

    #10 0x55c409dbd56a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829

    #11 0x55c409dba4d9 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1362

    #12 0x55c40a12df90 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1403

    #13 0x55c40a12d959 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1306

    #14 0x55c40b4ccf71 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862

    #15 0x7f8900c4b4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

Thread T5 created by T0 here:

    #0 0x7f8900e91f59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)

    #1 0x55c40b4cd35e in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912

    #2 0x55c409b21908 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268

    #3 0x55c409b35a5d in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6238

    #4 0x55c409b36154 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6308

    #5 0x55c409b364df in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6406

    #6 0x55c409b37140 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6564

    #7 0x55c409b352a1 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5896

    #8 0x55c409b1f7ef in main /data/src/10.4/sql/main.cc:25

    #9 0x7f88ff0cb2e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)

SUMMARY: AddressSanitizer: use-after-poison /data/src/10.4/sql/sp_head.cc:820 in sp_head::~sp_head()

Shadow bytes around the buggy address:

  0x0c4a80014ef0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c4a80014f00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c4a80014f10: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c4a80014f20: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c4a80014f30: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

=>0x0c4a80014f40: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7[f7]f7 f7 f7 f7

  0x0c4a80014f50: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c4a80014f60: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c4a80014f70: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c4a80014f80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c4a80014f90: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==31430==ABORTING

Elena Stepanova added a comment - 2019-05-30 10:44 - edited To make it findable and comparable: 10.4 7d3a759d #3 <signal handler called> #4 0x0000562e0d716119 in plugin_unlock_list (thd=0x0, list=0x8f8f8f8f8f8f8f97, count=2408550286) at /data/src/10.4/sql/sql_plugin.cc:1404 #5 0x0000562e0d6c4e70 in lex_end_stage1 (lex=0x7fee34147a28) at /data/src/10.4/sql/sql_lex.cc:803 #6 0x0000562e0d6c4dd1 in lex_end (lex=0x7fee34147a28) at /data/src/10.4/sql/sql_lex.cc:789 #7 0x0000562e0d610b87 in sp_head::~sp_head (this=0x7fee34136d78, __in_chrg=<optimized out>) at /data/src/10.4/sql/sp_head.cc:821 #8 0x0000562e0d610c5e in sp_head::~sp_head (this=0x7fee34136d78, __in_chrg=<optimized out>) at /data/src/10.4/sql/sp_head.cc:832 #9 0x0000562e0d6ca9b4 in LEX::cleanup_lex_after_parse_error (thd=0x7fee34000b00) at /data/src/10.4/sql/sql_lex.cc:3138 #10 0x0000562e0d9a105c in MYSQLparse (thd=0x7fee34000b00) at /data/src/10.4/sql/sql_yacc.yy:16264 #11 0x0000562e0d710488 in parse_sql (thd=0x7fee34000b00, parser_state=0x7fee44ece180, creation_ctx=0x0, do_pfs_digest=true) at /data/src/10.4/sql/sql_parse.cc:10184 #12 0x0000562e0d70b404 in mysql_parse (thd=0x7fee34000b00, rawbuf=0x7fee34013108 "BEGIN NOT ATOMIC\nDECLARE a INT;\nSET a=(SELECT 1 FROM DUAL UNION SELECT HIGH_PRIORITY 2 FROM DUAL);\nEND", length=102, parser_state=0x7fee44ece180, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:8110 #13 0x0000562e0d6f6c83 in dispatch_command (command=COM_QUERY, thd=0x7fee34000b00, packet=0x7fee34008311 "BEGIN NOT ATOMIC\nDECLARE a INT;\nSET a=(SELECT 1 FROM DUAL UNION SELECT HIGH_PRIORITY 2 FROM DUAL);\nEND;\n", packet_length=104, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1829 #14 0x0000562e0d6f5441 in do_command (thd=0x7fee34000b00) at /data/src/10.4/sql/sql_parse.cc:1362 #15 0x0000562e0d86d411 in do_handle_one_connection (connect=0x562e0fff7010) at /data/src/10.4/sql/sql_connect.cc:1403 #16 0x0000562e0d86d175 in handle_one_connection (arg=0x562e0fff7010) at /data/src/10.4/sql/sql_connect.cc:1306 #17 0x0000562e0e1956ab in pfs_spawn_thread (arg=0x562e1002c3a0) at /data/src/10.4/storage/perfschema/pfs.cc:1862 #18 0x00007fee4c8714a4 in start_thread (arg=0x7fee44ecf700) at pthread_create.c:456 #19 0x00007fee4adb9d0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97 ==31430==ERROR: AddressSanitizer: use-after-poison on address 0x6250000e7a58 at pc 0x55c409bba3fa bp 0x7f88f643fe00 sp 0x7f88f643fdf8 WRITE of size 8 at 0x6250000e7a58 thread T5 #0 0x55c409bba3f9 in sp_head::~sp_head() /data/src/10.4/sql/sp_head.cc:820 #1 0x55c409bba659 in sp_head::~sp_head() /data/src/10.4/sql/sp_head.cc:832 #2 0x55c409d604e0 in LEX::cleanup_lex_after_parse_error(THD*) /data/src/10.4/sql/sql_lex.cc:3138 #3 0x55c40a3afcf3 in MYSQLparse(THD*) /data/src/10.4/sql/sql_yacc.yy:16264 #4 0x55c409df0d52 in parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool) /data/src/10.4/sql/sql_parse.cc:10184 #5 0x55c409de440c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8110 #6 0x55c409dbd56a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829 #7 0x55c409dba4d9 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1362 #8 0x55c40a12df90 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1403 #9 0x55c40a12d959 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1306 #10 0x55c40b4ccf71 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862 #11 0x7f8900c4b4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3) #12 0x7f88ff193d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e) 0x6250000e7a58 is located 6488 bytes inside of 8268-byte region [0x6250000e6100,0x6250000e814c) allocated by thread T5 here: #0 0x7f8900f22d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28) #1 0x55c40b5f1eb8 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118 #2 0x55c40b5c4159 in my_malloc /data/src/10.4/mysys/my_malloc.c:101 #3 0x55c40b5a46f8 in alloc_root /data/src/10.4/mysys/my_alloc.c:250 #4 0x55c409b40c49 in Sql_alloc::operator new(unsigned long, st_mem_root*) /data/src/10.4/sql/sql_alloc.h:39 #5 0x55c409bc2d15 in sp_head::reset_lex(THD*) /data/src/10.4/sql/sp_head.cc:2402 #6 0x55c40a34b886 in sp_create_assignment_lex(THD*, bool) /data/src/10.4/sql/sql_yacc.yy:520 #7 0x55c40a3afa39 in MYSQLparse(THD*) /data/src/10.4/sql/sql_yacc.yy:16220 #8 0x55c409df0d52 in parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool) /data/src/10.4/sql/sql_parse.cc:10184 #9 0x55c409de440c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8110 #10 0x55c409dbd56a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829 #11 0x55c409dba4d9 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1362 #12 0x55c40a12df90 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1403 #13 0x55c40a12d959 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1306 #14 0x55c40b4ccf71 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862 #15 0x7f8900c4b4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3) Thread T5 created by T0 here: #0 0x7f8900e91f59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59) #1 0x55c40b4cd35e in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912 #2 0x55c409b21908 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268 #3 0x55c409b35a5d in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6238 #4 0x55c409b36154 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6308 #5 0x55c409b364df in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6406 #6 0x55c409b37140 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6564 #7 0x55c409b352a1 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5896 #8 0x55c409b1f7ef in main /data/src/10.4/sql/main.cc:25 #9 0x7f88ff0cb2e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0) SUMMARY: AddressSanitizer: use-after-poison /data/src/10.4/sql/sp_head.cc:820 in sp_head::~sp_head() Shadow bytes around the buggy address: 0x0c4a80014ef0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a80014f00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a80014f10: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a80014f20: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a80014f30: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 =>0x0c4a80014f40: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7[f7]f7 f7 f7 f7 0x0c4a80014f50: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a80014f60: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a80014f70: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a80014f80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a80014f90: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==31430==ABORTING

MariaDB Server

Crash on an SP variable assignment to a wrong subselect

Details

Description

Attachments

Issue Links

Activity

People

Dates

Git Integration