ASAN heap-use-after-free in ha_maria::info

--source include/have_innodb.inc

CREATE TABLE t1 (a INT) ENGINE=InnoDB;

INSERT INTO t1 VALUES (1),(2);

CREATE TABLE t2 (b INT) ENGINE=Aria;

CREATE TABLE t3 (c INT) ENGINE=Aria;

INSERT INTO t3 VALUES (1),(2);

EXPLAIN SELECT * FROM t1, t2, t3;

SHOW TABLE STATUS;

# Cleanup

DROP TABLE t1, t2, t3;

==1693==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000046c30 at pc 0x56522524fe86 bp 0x7ff758352fc0 sp 0x7ff758352fb8

READ of size 4 at 0x611000046c30 thread T27

    #0 0x56522524fe85 in ha_maria::info(unsigned int) /data/src/10.3/storage/maria/ha_maria.cc:2453

    #1 0x565223fa0374 in get_schema_tables_record /data/src/10.3/sql/sql_show.cc:5556

    #2 0x565223f98778 in fill_schema_table_by_open /data/src/10.3/sql/sql_show.cc:4657

    #3 0x565223f9bee6 in get_all_tables(THD*, TABLE_LIST*, Item*) /data/src/10.3/sql/sql_show.cc:5260

    #4 0x565223fcec10 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/10.3/sql/sql_show.cc:8873

    #5 0x565223ebf846 in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4061

    #6 0x565223ebdb4f in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3892

    #7 0x565223ec102e in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4297

    #8 0x565223e9b065 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:370

    #9 0x565223e1cda4 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6294

    #10 0x565223e0c5a9 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3821

    #11 0x565223e25de0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7818

    #12 0x565223e00acc in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1856

    #13 0x565223dfd9ab in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1401

    #14 0x565224173ae4 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403

    #15 0x5652241734ab in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #16 0x5652255dd1f3 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862

    #17 0x7ff76ff374a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

    #18 0x7ff76e06bd0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)

0x611000046c30 is located 176 bytes inside of 252-byte region [0x611000046b80,0x611000046c7c)

freed by thread T27 here:

    #0 0x7ff77020ea10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)

    #1 0x56522570de9a in free_memory /data/src/10.3/mysys/safemalloc.c:279

    #2 0x56522570d583 in sf_free /data/src/10.3/mysys/safemalloc.c:197

    #3 0x5652256df715 in my_free /data/src/10.3/mysys/my_malloc.c:223

    #4 0x56522521c593 in _ma_trnman_end_trans_hook /data/src/10.3/storage/maria/ma_state.c:551

    #5 0x56522525c050 in trnman_end_trn /data/src/10.3/storage/maria/trnman.c:474

    #6 0x5652252d6e2c in ma_commit /data/src/10.3/storage/maria/ma_commit.c:39

    #7 0x565225252c86 in ha_maria::implicit_commit(THD*, bool) /data/src/10.3/storage/maria/ha_maria.cc:2854

    #8 0x565223e1b383 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6110

    #9 0x565223e25de0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7818

    #10 0x565223e00acc in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1856

    #11 0x565223dfd9ab in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1401

    #12 0x565224173ae4 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403

    #13 0x5652241734ab in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #14 0x5652255dd1f3 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862

    #15 0x7ff76ff374a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

previously allocated by thread T27 here:

    #0 0x7ff77020ed28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)

    #1 0x56522570cf9b in sf_malloc /data/src/10.3/mysys/safemalloc.c:118

    #2 0x5652256dee24 in my_malloc /data/src/10.3/mysys/my_malloc.c:101

    #3 0x5652252194c7 in _ma_setup_live_state /data/src/10.3/storage/maria/ma_state.c:81

    #4 0x565225252f83 in ha_maria::implicit_commit(THD*, bool) /data/src/10.3/storage/maria/ha_maria.cc:2893

    #5 0x565224503ee8 in ha_commit_trans(THD*, bool) /data/src/10.3/sql/handler.cc:1387

    #6 0x5652241a2f89 in trans_commit_stmt(THD*) /data/src/10.3/sql/transaction.cc:505

    #7 0x565223e1b353 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6106

    #8 0x565223e25de0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7818

    #9 0x565223e00acc in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1856

    #10 0x565223dfd9ab in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1401

    #11 0x565224173ae4 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403

    #12 0x5652241734ab in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #13 0x5652255dd1f3 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862

    #14 0x7ff76ff374a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

Thread T27 created by T0 here:

    #0 0x7ff77017df59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)

    #1 0x5652255dd62f in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912

    #2 0x565223b6ab50 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268

    #3 0x565223b7fe5c in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6600

    #4 0x565223b8053f in create_new_thread /data/src/10.3/sql/mysqld.cc:6670

    #5 0x565223b81557 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6945

    #6 0x565223b7f32c in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6222

    #7 0x565223b6926f in main /data/src/10.3/sql/main.cc:25

    #8 0x7ff76dfa32e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/maria/ha_maria.cc:2453 in ha_maria::info(unsigned int)

Shadow bytes around the buggy address:

  0x0c2280000d30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa

  0x0c2280000d40: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00

  0x0c2280000d50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c2280000d60: 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa fa

  0x0c2280000d70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c2280000d80: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd

  0x0c2280000d90: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c2280000da0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2280000db0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa

  0x0c2280000dc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2280000dd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==1693==ABORTING

==1954==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100001f4c0 at pc 0x55cef415a3ec bp 0x7f5f21902710 sp 0x7f5f21902708

READ of size 8 at 0x61100001f4c0 thread T23

    #0 0x55cef415a3eb in maria_status /data/src/10.1/storage/maria/ma_info.c:45

    #1 0x55cef417c2a3 in ha_maria::info(unsigned int) /data/src/10.1/storage/maria/ha_maria.cc:2497

    #2 0x55cef417d94f in ha_maria::update_create_info(HA_CREATE_INFO*) /data/src/10.1/storage/maria/ha_maria.cc:2998

    #3 0x55cef3947101 in get_schema_tables_record /data/src/10.1/sql/sql_show.cc:5191

    #4 0x55cef3927f7b in fill_schema_table_by_open /data/src/10.1/sql/sql_show.cc:4325

    #5 0x55cef3967150 in get_all_tables(THD*, TABLE_LIST*, Item*) /data/src/10.1/sql/sql_show.cc:4924

    #6 0x55cef396b765 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/10.1/sql/sql_show.cc:8280

    #7 0x55cef3910b0c in JOIN::exec_inner() /data/src/10.1/sql/sql_select.cc:2716

    #8 0x55cef3918831 in JOIN::exec() /data/src/10.1/sql/sql_select.cc:2564

    #9 0x55cef390b5dc in mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.1/sql/sql_select.cc:3501

    #10 0x55cef390dbc9 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.1/sql/sql_select.cc:377

    #11 0x55cef37dd161 in execute_sqlcom_select /data/src/10.1/sql/sql_parse.cc:5691

    #12 0x55cef37f8974 in mysql_execute_command(THD*) /data/src/10.1/sql/sql_parse.cc:3038

    #13 0x55cef380f41b in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.1/sql/sql_parse.cc:7209

    #14 0x55cef3816753 in dispatch_command(enum_server_command, THD*, char*, unsigned int) /data/src/10.1/sql/sql_parse.cc:1499

    #15 0x55cef381b8fa in do_command(THD*) /data/src/10.1/sql/sql_parse.cc:1131

    #16 0x55cef3ac0862 in do_handle_one_connection(THD*) /data/src/10.1/sql/sql_connect.cc:1331

    #17 0x55cef3ac0e1a in handle_one_connection /data/src/10.1/sql/sql_connect.cc:1242

    #18 0x55cef442643a in pfs_spawn_thread /data/src/10.1/storage/perfschema/pfs.cc:1861

    #19 0x7f5f36ebb4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

    #20 0x7f5f356c9d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)

0x61100001f4c0 is located 128 bytes inside of 252-byte region [0x61100001f440,0x61100001f53c)

freed by thread T23 here:

    #0 0x7f5f37192a10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)

    #1 0x55cef4ad0708 in free_memory /data/src/10.1/mysys/safemalloc.c:276

previously allocated by thread T23 here:

    #0 0x7f5f37192d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)

    #1 0x55cef4ad08ac in sf_malloc /data/src/10.1/mysys/safemalloc.c:115

    #2 0x55cef4c2da52  (/data/bld/10.1-asan-nightly/bin/mysqld+0x1dcfa52)

Thread T23 created by T0 here:

    #0 0x7f5f37101f59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)

    #1 0x55cef4431dbe in spawn_thread_v1 /data/src/10.1/storage/perfschema/pfs.cc:1911

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.1/storage/maria/ma_info.c:45 in maria_status

Shadow bytes around the buggy address:

  0x0c227fffbe40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c227fffbe50: 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa fa

  0x0c227fffbe60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c227fffbe70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa

  0x0c227fffbe80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

=>0x0c227fffbe90: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd

  0x0c227fffbea0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa

  0x0c227fffbeb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c227fffbec0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c227fffbed0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c227fffbee0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==1954==ABORTING