DEFAULT() on a BLOB column can overwrite the default record, which can cause crashes when accessing already released memory

--source include/have_innodb.inc

CREATE TEMPORARY TABLE t1 (h POINT DEFAULT ST_GEOMFROMTEXT('Point(1 1)')) ENGINE=InnoDB;

INSERT INTO t1 () VALUES (),();

ALTER TABLE t1 FORCE;

SELECT DEFAULT(h) FROM t1;

INSERT INTO t1 () VALUES ();

==14343==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000096c30 at pc 0x7f70cfd98f7f bp 0x7f70b7eb51e0 sp 0x7f70b7eb4990

READ of size 25 at 0x60e000096c30 thread T27

    #0 0x7f70cfd98f7e  (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cf7e)

    #1 0x55bfa65879d9 in rec_convert_dtuple_to_rec_comp /data/src/10.2/storage/innobase/rem/rem0rec.cc:1310

    #2 0x55bfa6587c52 in rec_convert_dtuple_to_rec_new /data/src/10.2/storage/innobase/rem/rem0rec.cc:1339

    #3 0x55bfa6587ee0 in rec_convert_dtuple_to_rec(unsigned char*, dict_index_t const*, dtuple_t const*, unsigned long) /data/src/10.2/storage/innobase/rem/rem0rec.cc:1370

    #4 0x55bfa67dd250 in page_cur_tuple_insert /data/src/10.2/storage/innobase/include/page0cur.ic:280

    #5 0x55bfa67ebf90 in btr_cur_optimistic_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t*, unsigned char**, big_rec_t**, unsigned long, que_thr_t*, mtr_t*) /data/src/10.2/storage/innobase/btr/btr0cur.cc:3211

    #6 0x55bfa65d0592 in row_ins_clust_index_entry_low(unsigned long, unsigned long, dict_index_t*, unsigned long, dtuple_t*, unsigned long, que_thr_t*) /data/src/10.2/storage/innobase/row/row0ins.cc:2703

    #7 0x55bfa65d239d in row_ins_clust_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, unsigned long) /data/src/10.2/storage/innobase/row/row0ins.cc:3155

    #8 0x55bfa65d2bcb in row_ins_index_entry /data/src/10.2/storage/innobase/row/row0ins.cc:3274

    #9 0x55bfa65d37d6 in row_ins_index_entry_step /data/src/10.2/storage/innobase/row/row0ins.cc:3425

    #10 0x55bfa65d406d in row_ins /data/src/10.2/storage/innobase/row/row0ins.cc:3562

    #11 0x55bfa65d49c4 in row_ins_step(que_thr_t*) /data/src/10.2/storage/innobase/row/row0ins.cc:3682

    #12 0x55bfa660efd5 in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1414

    #13 0x55bfa63944f8 in ha_innobase::write_row(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:8177

    #14 0x55bfa5ede0d3 in handler::ha_write_row(unsigned char*) /data/src/10.2/sql/handler.cc:6095

    #15 0x55bfa588e3ea in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1941

    #16 0x55bfa5888816 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.2/sql/sql_insert.cc:1066

    #17 0x55bfa58e846f in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4167

    #18 0x55bfa58ff9af in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7740

    #19 0x55bfa58dbb08 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1832

    #20 0x55bfa58d8bad in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1385

    #21 0x55bfa5c11e31 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336

    #22 0x55bfa5c11801 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241

    #23 0x55bfa6e17aec in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869

    #24 0x7f70cfb264a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

    #25 0x7f70cdc5ad0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)

0x60e000096c30 is located 112 bytes inside of 148-byte region [0x60e000096bc0,0x60e000096c54)

freed by thread T27 here:

    #0 0x7f70cfdfda10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)

    #1 0x55bfa6f1dc4f in free_memory /data/src/10.2/mysys/safemalloc.c:279

    #2 0x55bfa6f1d2c9 in sf_free /data/src/10.2/mysys/safemalloc.c:197

    #3 0x55bfa6eedde3 in my_free /data/src/10.2/mysys/my_malloc.c:218

    #4 0x55bfa56d8c87 in String::free() /data/src/10.2/sql/sql_string.h:351

    #5 0x55bfa56d8a6f in String::~String() /data/src/10.2/sql/sql_string.h:187

    #6 0x55bfa5e99ee2 in Field_blob::~Field_blob() /data/src/10.2/sql/field.h:3299

    #7 0x55bfa5e9d786 in Field_geom::~Field_geom() /data/src/10.2/sql/field.h:3523

    #8 0x55bfa5e9d7a1 in Field_geom::~Field_geom() /data/src/10.2/sql/field.h:3523

    #9 0x55bfa5f2fe7b in Item_default_value::cleanup() /data/src/10.2/sql/item.cc:9004

    #10 0x55bfa58563f7 in Item::delete_self() /data/src/10.2/sql/item.h:1931

    #11 0x55bfa58411a9 in Query_arena::free_items() /data/src/10.2/sql/sql_class.cc:3499

    #12 0x55bfa5834e30 in THD::cleanup_after_query() /data/src/10.2/sql/sql_class.cc:2095

    #13 0x55bfa58ffc66 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7761

    #14 0x55bfa58dbb08 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1832

    #15 0x55bfa58d8bad in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1385

    #16 0x55bfa5c11e31 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336

    #17 0x55bfa5c11801 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241

    #18 0x55bfa6e17aec in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869

    #19 0x7f70cfb264a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

previously allocated by thread T27 here:

    #0 0x7f70cfdfdd28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)

    #1 0x55bfa6f1cca0 in sf_malloc /data/src/10.2/mysys/safemalloc.c:118

    #2 0x55bfa6eed546 in my_malloc /data/src/10.2/mysys/my_malloc.c:101

    #3 0x55bfa5ab53dc in String::real_alloc(unsigned long) /data/src/10.2/sql/sql_string.cc:45

    #4 0x55bfa56f9dbb in String::alloc(unsigned long) /data/src/10.2/sql/sql_string.h:361

    #5 0x55bfa5ab6123 in String::copy(char const*, unsigned long, charset_info_st const*) /data/src/10.2/sql/sql_string.cc:188

    #6 0x55bfa5e7f9dd in Field_geom::store(char const*, unsigned int, charset_info_st const*) /data/src/10.2/sql/field.cc:8880

    #7 0x55bfa5f18bc6 in Item::save_in_field(Field*, bool) /data/src/10.2/sql/item.cc:6420

    #8 0x55bfa5e3abf7 in Field::set_default() /data/src/10.2/sql/field.cc:2457

    #9 0x55bfa5f300c6 in Item_default_value::calculate() /data/src/10.2/sql/item.cc:9030

    #10 0x55bfa5f302b1 in Item_default_value::send(Protocol*, String*) /data/src/10.2/sql/item.cc:9066

    #11 0x55bfa56f3a52 in Protocol::send_result_set_row(List<Item>*) /data/src/10.2/sql/protocol.cc:990

    #12 0x55bfa58397b9 in select_send::send_data(List<Item>&) /data/src/10.2/sql/sql_class.cc:2731

    #13 0x55bfa59f9c42 in end_send /data/src/10.2/sql/sql_select.cc:20039

    #14 0x55bfa59f2a16 in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19087

    #15 0x55bfa59f15bd in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18867

    #16 0x55bfa59ef9d7 in do_select /data/src/10.2/sql/sql_select.cc:18411

    #17 0x55bfa5990368 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3633

    #18 0x55bfa598e135 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3428

    #19 0x55bfa59913ab in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3828

    #20 0x55bfa597061b in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361

    #21 0x55bfa58f7055 in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6225

    #22 0x55bfa58e5337 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3532

    #23 0x55bfa58ff9af in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7740

    #24 0x55bfa58dbb08 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1832

    #25 0x55bfa58d8bad in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1385

    #26 0x55bfa5c11e31 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336

    #27 0x55bfa5c11801 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241

    #28 0x55bfa6e17aec in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869

    #29 0x7f70cfb264a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

Thread T27 created by T0 here:

    #0 0x7f70cfd6cf59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)

    #1 0x55bfa6e17f28 in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919

    #2 0x55bfa56b7492 in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246

    #3 0x55bfa56cbc78 in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6515

    #4 0x55bfa56cc35b in create_new_thread /data/src/10.2/sql/mysqld.cc:6585

    #5 0x55bfa56cd373 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6860

    #6 0x55bfa56cb1b7 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6134

    #7 0x55bfa56b5e1f in main /data/src/10.2/sql/main.cc:25

    #8 0x7f70cdb922e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)

SUMMARY: AddressSanitizer: heap-use-after-free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cf7e) 

Shadow bytes around the buggy address:

  0x0c1c8000ad30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c1c8000ad40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c1c8000ad50: fa fa fa fa fa fa fa fa fa fa fa fa 00 00 00 00

  0x0c1c8000ad60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04

  0x0c1c8000ad70: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

=>0x0c1c8000ad80: fd fd fd fd fd fd[fd]fd fd fd fd fa fa fa fa fa

  0x0c1c8000ad90: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c1c8000ada0: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa

  0x0c1c8000adb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c1c8000adc0: 00 00 04 fa fa fa fa fa fa fa fa fa 00 00 00 00

  0x0c1c8000add0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==14343==ABORTING

--source include/have_innodb.inc

CREATE TEMPORARY TABLE t1 (h POINT DEFAULT ST_GEOMFROMTEXT('Point(1 1)')) ENGINE=InnoDB ROW_FORMAT=REDUNDANT;

INSERT INTO t1 () VALUES (),();

ALTER TABLE t1 FORCE;

SELECT DEFAULT(h) FROM t1;

INSERT INTO t1 () VALUES ();

==14461==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000097090 at pc 0x7fd3c5517f7f bp 0x7fd3ad634350 sp 0x7fd3ad633b00

READ of size 25 at 0x60e000097090 thread T27

    #0 0x7fd3c5517f7e  (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cf7e)

    #1 0x5630c6ea0870 in rec_convert_dtuple_to_rec_old /data/src/10.2/storage/innobase/rem/rem0rec.cc:1107

    #2 0x5630c6ea1f06 in rec_convert_dtuple_to_rec(unsigned char*, dict_index_t const*, dtuple_t const*, unsigned long) /data/src/10.2/storage/innobase/rem/rem0rec.cc:1372

    #3 0x5630c70f7250 in page_cur_tuple_insert /data/src/10.2/storage/innobase/include/page0cur.ic:280

    #4 0x5630c7105f90 in btr_cur_optimistic_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t*, unsigned char**, big_rec_t**, unsigned long, que_thr_t*, mtr_t*) /data/src/10.2/storage/innobase/btr/btr0cur.cc:3211

    #5 0x5630c6eea592 in row_ins_clust_index_entry_low(unsigned long, unsigned long, dict_index_t*, unsigned long, dtuple_t*, unsigned long, que_thr_t*) /data/src/10.2/storage/innobase/row/row0ins.cc:2703

    #6 0x5630c6eec39d in row_ins_clust_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, unsigned long) /data/src/10.2/storage/innobase/row/row0ins.cc:3155

    #7 0x5630c6eecbcb in row_ins_index_entry /data/src/10.2/storage/innobase/row/row0ins.cc:3274

    #8 0x5630c6eed7d6 in row_ins_index_entry_step /data/src/10.2/storage/innobase/row/row0ins.cc:3425

    #9 0x5630c6eee06d in row_ins /data/src/10.2/storage/innobase/row/row0ins.cc:3562

    #10 0x5630c6eee9c4 in row_ins_step(que_thr_t*) /data/src/10.2/storage/innobase/row/row0ins.cc:3682

    #11 0x5630c6f28fd5 in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1414

    #12 0x5630c6cae4f8 in ha_innobase::write_row(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:8177

    #13 0x5630c67f80d3 in handler::ha_write_row(unsigned char*) /data/src/10.2/sql/handler.cc:6095

    #14 0x5630c61a83ea in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1941

    #15 0x5630c61a2816 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.2/sql/sql_insert.cc:1066

    #16 0x5630c620246f in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4167

    #17 0x5630c62199af in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7740

    #18 0x5630c61f5b08 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1832

    #19 0x5630c61f2bad in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1385

    #20 0x5630c652be31 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336

    #21 0x5630c652b801 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241

    #22 0x5630c7731aec in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869

    #23 0x7fd3c52a54a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

    #24 0x7fd3c33d9d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)

0x60e000097090 is located 112 bytes inside of 148-byte region [0x60e000097020,0x60e0000970b4)

freed by thread T27 here:

    #0 0x7fd3c557ca10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)

    #1 0x5630c7837c4f in free_memory /data/src/10.2/mysys/safemalloc.c:279

    #2 0x5630c78372c9 in sf_free /data/src/10.2/mysys/safemalloc.c:197

    #3 0x5630c7807de3 in my_free /data/src/10.2/mysys/my_malloc.c:218

    #4 0x5630c5ff2c87 in String::free() /data/src/10.2/sql/sql_string.h:351

    #5 0x5630c5ff2a6f in String::~String() /data/src/10.2/sql/sql_string.h:187

    #6 0x5630c67b3ee2 in Field_blob::~Field_blob() /data/src/10.2/sql/field.h:3299

    #7 0x5630c67b7786 in Field_geom::~Field_geom() /data/src/10.2/sql/field.h:3523

    #8 0x5630c67b77a1 in Field_geom::~Field_geom() /data/src/10.2/sql/field.h:3523

    #9 0x5630c6849e7b in Item_default_value::cleanup() /data/src/10.2/sql/item.cc:9004

    #10 0x5630c61703f7 in Item::delete_self() /data/src/10.2/sql/item.h:1931

    #11 0x5630c615b1a9 in Query_arena::free_items() /data/src/10.2/sql/sql_class.cc:3499

    #12 0x5630c614ee30 in THD::cleanup_after_query() /data/src/10.2/sql/sql_class.cc:2095

    #13 0x5630c6219c66 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7761

    #14 0x5630c61f5b08 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1832

    #15 0x5630c61f2bad in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1385

    #16 0x5630c652be31 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336

    #17 0x5630c652b801 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241

    #18 0x5630c7731aec in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869

    #19 0x7fd3c52a54a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

previously allocated by thread T27 here:

    #0 0x7fd3c557cd28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)

    #1 0x5630c7836ca0 in sf_malloc /data/src/10.2/mysys/safemalloc.c:118

    #2 0x5630c7807546 in my_malloc /data/src/10.2/mysys/my_malloc.c:101

    #3 0x5630c63cf3dc in String::real_alloc(unsigned long) /data/src/10.2/sql/sql_string.cc:45

    #4 0x5630c6013dbb in String::alloc(unsigned long) /data/src/10.2/sql/sql_string.h:361

    #5 0x5630c63d0123 in String::copy(char const*, unsigned long, charset_info_st const*) /data/src/10.2/sql/sql_string.cc:188

    #6 0x5630c67999dd in Field_geom::store(char const*, unsigned int, charset_info_st const*) /data/src/10.2/sql/field.cc:8880

    #7 0x5630c6832bc6 in Item::save_in_field(Field*, bool) /data/src/10.2/sql/item.cc:6420

    #8 0x5630c6754bf7 in Field::set_default() /data/src/10.2/sql/field.cc:2457

    #9 0x5630c684a0c6 in Item_default_value::calculate() /data/src/10.2/sql/item.cc:9030

    #10 0x5630c684a2b1 in Item_default_value::send(Protocol*, String*) /data/src/10.2/sql/item.cc:9066

    #11 0x5630c600da52 in Protocol::send_result_set_row(List<Item>*) /data/src/10.2/sql/protocol.cc:990

    #12 0x5630c61537b9 in select_send::send_data(List<Item>&) /data/src/10.2/sql/sql_class.cc:2731

    #13 0x5630c6313c42 in end_send /data/src/10.2/sql/sql_select.cc:20039

    #14 0x5630c630ca16 in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19087

    #15 0x5630c630b5bd in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18867

    #16 0x5630c63099d7 in do_select /data/src/10.2/sql/sql_select.cc:18411

    #17 0x5630c62aa368 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3633

    #18 0x5630c62a8135 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3428

    #19 0x5630c62ab3ab in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3828

    #20 0x5630c628a61b in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361

    #21 0x5630c6211055 in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6225

    #22 0x5630c61ff337 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3532

    #23 0x5630c62199af in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7740

    #24 0x5630c61f5b08 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1832

    #25 0x5630c61f2bad in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1385

    #26 0x5630c652be31 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336

    #27 0x5630c652b801 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241

    #28 0x5630c7731aec in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869

    #29 0x7fd3c52a54a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

Thread T27 created by T0 here:

    #0 0x7fd3c54ebf59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)

    #1 0x5630c7731f28 in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919

    #2 0x5630c5fd1492 in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246

    #3 0x5630c5fe5c78 in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6515

    #4 0x5630c5fe635b in create_new_thread /data/src/10.2/sql/mysqld.cc:6585

    #5 0x5630c5fe7373 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6860

    #6 0x5630c5fe51b7 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6134

    #7 0x5630c5fcfe1f in main /data/src/10.2/sql/main.cc:25

    #8 0x7fd3c33112e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)

SUMMARY: AddressSanitizer: heap-use-after-free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cf7e) 

Shadow bytes around the buggy address:

  0x0c1c8000adc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c1c8000add0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c1c8000ade0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00

  0x0c1c8000adf0: 00 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa

  0x0c1c8000ae00: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c1c8000ae10: fd fd[fd]fd fd fd fd fa fa fa fa fa fa fa fa fa

  0x0c1c8000ae20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c1c8000ae30: 00 00 00 04 fa fa fa fa fa fa fa fa 00 00 00 00

  0x0c1c8000ae40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa

  0x0c1c8000ae50: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00

  0x0c1c8000ae60: 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==14461==ABORTING