[MDEV-23443] ASAN heap-use-after-free in my_ci_strnncollsp upon query with EXCEPT ALL - Jira

XML

Word

Printable

Details

Type: Bug
Status: Confirmed (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.5, 10.6, 10.7, 10.8, 10.9, 10.10
Fix Version/s: 10.5, 10.6, 10.11, 11.0, 11.1, 11.2, 11.3, 11.4
Component/s: Optimizer
Labels:
None

Description

CREATE TABLE t1 (f TEXT CHARACTER SET utf8);

INSERT INTO t1 VALUES ('watermelon'),('apple') ,('pear'),('apple');

SELECT f FROM t1 EXCEPT ALL SELECT 'orange';

10.5 ASAN 9b2fe4bd
==23010==ERROR: AddressSanitizer: heap-use-after-free on address 0x61200003aa55 at pc 0x5562a9716edd bp 0x7fc4b23402b0 sp 0x7fc4b23402a8
READ of size 1 at 0x61200003aa55 thread T5
#0 0x5562a9716edc in my_scan_weight_utf8mb3_general_ci /data/src/10.5/strings/strcoll.ic:99
#1 0x5562a971777d in my_strnncollsp_utf8mb3_general_ci /data/src/10.5/strings/strcoll.ic:256
#2 0x5562a963ac73 in my_ci_strnncollsp /data/src/10.5/include/m_ctype.h:1061
#3 0x5562a963acbc in ha_compare_text /data/src/10.5/mysys/my_compare.c:27
#4 0x5562a891b164 in _ma_unique_comp /data/src/10.5/storage/maria/ma_unique.c:243
#5 0x5562a8a777f1 in maria_update /data/src/10.5/storage/maria/ma_update.c:68
#6 0x5562a893d802 in ha_maria::update_row(unsigned char const, unsigned char const) /data/src/10.5/storage/maria/ha_maria.cc:2362
#7 0x5562a7d60fbf in handler::ha_update_tmp_row(unsigned char const, unsigned char) /data/src/10.5/sql/sql_class.h:7027
#8 0x5562a7e789d2 in select_unit_ext::send_eof() /data/src/10.5/sql/sql_union.cc:862
#9 0x5562a7caaa66 in JOIN::exec_inner() /data/src/10.5/sql/sql_select.cc:4329
#10 0x5562a7ca949b in JOIN::exec() /data/src/10.5/sql/sql_select.cc:4231
#11 0x5562a7e8520f in st_select_lex_unit::exec() /data/src/10.5/sql/sql_union.cc:2196
#12 0x5562a7e71267 in mysql_union(THD, LEX, select_result, st_select_lex_unit, unsigned long) /data/src/10.5/sql/sql_union.cc:41
#13 0x5562a7c82ac9 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.5/sql/sql_select.cc:407
#14 0x5562a7c031b6 in execute_sqlcom_select /data/src/10.5/sql/sql_parse.cc:6210
#15 0x5562a7bf3b25 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:3932
#16 0x5562a7c0cf29 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:7994
#17 0x5562a7be778a in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1868
#18 0x5562a7be460d in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1349
#19 0x5562a7fa1ad3 in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1410
#20 0x5562a7fa1542 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312
#21 0x5562a8b93d50 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201
#22 0x7fc4bcba64a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
#23 0x7fc4bacdad0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)

0x61200003aa55 is located 149 bytes inside of 268-byte region [0x61200003a9c0,0x61200003aacc)
freed by thread T5 here:
#0 0x7fc4bce7da10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)
#1 0x5562a9673352 in free_memory /data/src/10.5/mysys/safemalloc.c:279
#2 0x5562a9672a00 in sf_realloc /data/src/10.5/mysys/safemalloc.c:187
#3 0x5562a9643d25 in my_realloc /data/src/10.5/mysys/my_malloc.c:149
#4 0x5562a89e2646 in _ma_alloc_buffer /data/src/10.5/storage/maria/ma_open.c:1247
#5 0x5562a8915be4 in _ma_read_rnd_dynamic_record /data/src/10.5/storage/maria/ma_dynrec.c:1871
#6 0x5562a8a24cca in maria_scan /data/src/10.5/storage/maria/ma_scan.c:54
#7 0x5562a893ef6c in ha_maria::rnd_next(unsigned char*) /data/src/10.5/storage/maria/ha_maria.cc:2508
#8 0x5562a83525da in handler::ha_rnd_next(unsigned char*) /data/src/10.5/sql/handler.cc:3060
#9 0x5562a7e785f3 in select_unit_ext::send_eof() /data/src/10.5/sql/sql_union.cc:832
#10 0x5562a7caaa66 in JOIN::exec_inner() /data/src/10.5/sql/sql_select.cc:4329
#11 0x5562a7ca949b in JOIN::exec() /data/src/10.5/sql/sql_select.cc:4231
#12 0x5562a7e8520f in st_select_lex_unit::exec() /data/src/10.5/sql/sql_union.cc:2196
#13 0x5562a7e71267 in mysql_union(THD, LEX, select_result, st_select_lex_unit, unsigned long) /data/src/10.5/sql/sql_union.cc:41
#14 0x5562a7c82ac9 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.5/sql/sql_select.cc:407
#15 0x5562a7c031b6 in execute_sqlcom_select /data/src/10.5/sql/sql_parse.cc:6210
#16 0x5562a7bf3b25 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:3932
#17 0x5562a7c0cf29 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:7994
#18 0x5562a7be778a in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1868
#19 0x5562a7be460d in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1349
#20 0x5562a7fa1ad3 in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1410
#21 0x5562a7fa1542 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312
#22 0x5562a8b93d50 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201
#23 0x7fc4bcba64a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

previously allocated by thread T5 here:
#0 0x7fc4bce7dd28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
#1 0x5562a9672455 in sf_malloc /data/src/10.5/mysys/safemalloc.c:118
#2 0x5562a96435d8 in my_malloc /data/src/10.5/mysys/my_malloc.c:88
#3 0x5562a9643aed in my_realloc /data/src/10.5/mysys/my_malloc.c:139
#4 0x5562a89e2646 in _ma_alloc_buffer /data/src/10.5/storage/maria/ma_open.c:1247
#5 0x5562a89d98e2 in maria_clone_internal /data/src/10.5/storage/maria/ma_open.c:206
#6 0x5562a89e1f1f in maria_open /data/src/10.5/storage/maria/ma_open.c:1167
#7 0x5562a8932e3b in ha_maria::open(char const*, int, unsigned int) /data/src/10.5/storage/maria/ha_maria.cc:1153
#8 0x5562a83508b4 in handler::ha_open(TABLE, char const, int, unsigned int, st_mem_root, List<String>) /data/src/10.5/sql/handler.cc:2977
#9 0x5562a7d11bc5 in open_tmp_table(TABLE*) /data/src/10.5/sql/sql_select.cc:19398
#10 0x5562a7d17679 in instantiate_tmp_table(TABLE, st_key, st_maria_columndef, st_maria_columndef*, unsigned long long) /data/src/10.5/sql/sql_select.cc:20296
#11 0x5562a7d0e83b in Create_tmp_table::finalize(THD, TABLE, TMP_TABLE_PARAM*, bool, bool) /data/src/10.5/sql/sql_select.cc:19099
#12 0x5562a7d0fa2a in create_tmp_table(THD, TMP_TABLE_PARAM, List<Item>&, st_order, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const, bool, bool) /data/src/10.5/sql/sql_select.cc:19196
#13 0x5562a7e73fe5 in select_unit::create_result_table(THD, List<Item>, bool, unsigned long long, st_mysql_const_lex_string const*, bool, bool, bool, unsigned int) /data/src/10.5/sql/sql_union.cc:329
#14 0x5562a7e7ffec in st_select_lex_unit::prepare(TABLE_LIST, select_result, unsigned long long) /data/src/10.5/sql/sql_union.cc:1722
#15 0x5562a7e71244 in mysql_union(THD, LEX, select_result, st_select_lex_unit, unsigned long) /data/src/10.5/sql/sql_union.cc:39
#16 0x5562a7c82ac9 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.5/sql/sql_select.cc:407
#17 0x5562a7c031b6 in execute_sqlcom_select /data/src/10.5/sql/sql_parse.cc:6210
#18 0x5562a7bf3b25 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:3932
#19 0x5562a7c0cf29 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:7994
#20 0x5562a7be778a in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1868
#21 0x5562a7be460d in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1349
#22 0x5562a7fa1ad3 in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1410
#23 0x5562a7fa1542 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312
#24 0x5562a8b93d50 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201
#25 0x7fc4bcba64a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

Thread T5 created by T0 here:
#0 0x7fc4bcdecf59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)
#1 0x5562a8b8ee12 in my_thread_create /data/src/10.5/storage/perfschema/my_thread.h:38
#2 0x5562a8b9413f in pfs_spawn_thread_v1 /data/src/10.5/storage/perfschema/pfs.cc:2252
#3 0x5562a792c377 in inline_mysql_thread_create /data/src/10.5/include/mysql/psi/mysql_thread.h:1321
#4 0x5562a793f189 in create_thread_to_handle_connection(CONNECT*) /data/src/10.5/sql/mysqld.cc:6020
#5 0x5562a793f6fe in create_new_thread(CONNECT*) /data/src/10.5/sql/mysqld.cc:6079
#6 0x5562a793f8bb in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.5/sql/mysqld.cc:6144
#7 0x5562a794029e in handle_connections_sockets() /data/src/10.5/sql/mysqld.cc:6271
#8 0x5562a793eaef in mysqld_main(int, char**) /data/src/10.5/sql/mysqld.cc:5666
#9 0x5562a792ab6f in main /data/src/10.5/sql/main.cc:25
#10 0x7fc4bac122e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.5/strings/strcoll.ic:99 in my_scan_weight_utf8mb3_general_ci
Shadow bytes around the buggy address:
0x0c247ffff4f0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x0c247ffff500: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c247ffff510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c247ffff520: 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa
0x0c247ffff530: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c247ffff540: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd
0x0c247ffff550: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
0x0c247ffff560: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c247ffff570: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c247ffff580: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x0c247ffff590: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==23010==ABORTING

A slightly different stack trace with latin1 instead of utf8:

CREATE TABLE t1 (f TEXT CHARACTER SET latin1);

INSERT INTO t1 VALUES ('watermelon'),('apple') ,('pear'),('apple');

SELECT f FROM t1 EXCEPT ALL SELECT 'orange';

==23139==ERROR: AddressSanitizer: heap-use-after-free on address 0x61200003aa54 at pc 0x56024ccd8149 bp 0x7f6d105973a0 sp 0x7f6d10597398

READ of size 1 at 0x61200003aa54 thread T5

    #0 0x56024ccd8148 in my_strnncollsp_simple /data/src/10.5/strings/ctype-simple.c:182

    #1 0x56024cc42c73 in my_ci_strnncollsp /data/src/10.5/include/m_ctype.h:1061

    #2 0x56024cc42cbc in ha_compare_text /data/src/10.5/mysys/my_compare.c:27

    #3 0x56024bf23164 in _ma_unique_comp /data/src/10.5/storage/maria/ma_unique.c:243

    #4 0x56024c07f7f1 in maria_update /data/src/10.5/storage/maria/ma_update.c:68

    #5 0x56024bf45802 in ha_maria::update_row(unsigned char const*, unsigned char const*) /data/src/10.5/storage/maria/ha_maria.cc:2362

    #6 0x56024b368fbf in handler::ha_update_tmp_row(unsigned char const*, unsigned char*) /data/src/10.5/sql/sql_class.h:7027

    #7 0x56024b4809d2 in select_unit_ext::send_eof() /data/src/10.5/sql/sql_union.cc:862

    #8 0x56024b2b2a66 in JOIN::exec_inner() /data/src/10.5/sql/sql_select.cc:4329

    #9 0x56024b2b149b in JOIN::exec() /data/src/10.5/sql/sql_select.cc:4231

    #10 0x56024b48d20f in st_select_lex_unit::exec() /data/src/10.5/sql/sql_union.cc:2196

    #11 0x56024b479267 in mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long) /data/src/10.5/sql/sql_union.cc:41

    #12 0x56024b28aac9 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.5/sql/sql_select.cc:407

    #13 0x56024b20b1b6 in execute_sqlcom_select /data/src/10.5/sql/sql_parse.cc:6210

    #14 0x56024b1fbb25 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:3932

    #15 0x56024b214f29 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:7994

    #16 0x56024b1ef78a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1868

    #17 0x56024b1ec60d in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1349

    #18 0x56024b5a9ad3 in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1410

    #19 0x56024b5a9542 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312

    #20 0x56024c19bd50 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201

    #21 0x7f6d1adfb4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

    #22 0x7f6d18f2fd0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)

0x61200003aa54 is located 148 bytes inside of 260-byte region [0x61200003a9c0,0x61200003aac4)

freed by thread T5 here:

    #0 0x7f6d1b0d2a10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)

    #1 0x56024cc7b352 in free_memory /data/src/10.5/mysys/safemalloc.c:279

    #2 0x56024cc7aa00 in sf_realloc /data/src/10.5/mysys/safemalloc.c:187

    #3 0x56024cc4bd25 in my_realloc /data/src/10.5/mysys/my_malloc.c:149

    #4 0x56024bfea646 in _ma_alloc_buffer /data/src/10.5/storage/maria/ma_open.c:1247

    #5 0x56024bf1dbe4 in _ma_read_rnd_dynamic_record /data/src/10.5/storage/maria/ma_dynrec.c:1871

    #6 0x56024c02ccca in maria_scan /data/src/10.5/storage/maria/ma_scan.c:54

    #7 0x56024bf46f6c in ha_maria::rnd_next(unsigned char*) /data/src/10.5/storage/maria/ha_maria.cc:2508

    #8 0x56024b95a5da in handler::ha_rnd_next(unsigned char*) /data/src/10.5/sql/handler.cc:3060

    #9 0x56024b4805f3 in select_unit_ext::send_eof() /data/src/10.5/sql/sql_union.cc:832

    #10 0x56024b2b2a66 in JOIN::exec_inner() /data/src/10.5/sql/sql_select.cc:4329

    #11 0x56024b2b149b in JOIN::exec() /data/src/10.5/sql/sql_select.cc:4231

    #12 0x56024b48d20f in st_select_lex_unit::exec() /data/src/10.5/sql/sql_union.cc:2196

    #13 0x56024b479267 in mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long) /data/src/10.5/sql/sql_union.cc:41

    #14 0x56024b28aac9 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.5/sql/sql_select.cc:407

    #15 0x56024b20b1b6 in execute_sqlcom_select /data/src/10.5/sql/sql_parse.cc:6210

    #16 0x56024b1fbb25 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:3932

    #17 0x56024b214f29 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:7994

    #18 0x56024b1ef78a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1868

    #19 0x56024b1ec60d in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1349

    #20 0x56024b5a9ad3 in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1410

    #21 0x56024b5a9542 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312

    #22 0x56024c19bd50 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201

    #23 0x7f6d1adfb4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

previously allocated by thread T5 here:

    #0 0x7f6d1b0d2d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)

    #1 0x56024cc7a455 in sf_malloc /data/src/10.5/mysys/safemalloc.c:118

    #2 0x56024cc4b5d8 in my_malloc /data/src/10.5/mysys/my_malloc.c:88

    #3 0x56024cc4baed in my_realloc /data/src/10.5/mysys/my_malloc.c:139

    #4 0x56024bfea646 in _ma_alloc_buffer /data/src/10.5/storage/maria/ma_open.c:1247

    #5 0x56024bfe18e2 in maria_clone_internal /data/src/10.5/storage/maria/ma_open.c:206

    #6 0x56024bfe9f1f in maria_open /data/src/10.5/storage/maria/ma_open.c:1167

    #7 0x56024bf3ae3b in ha_maria::open(char const*, int, unsigned int) /data/src/10.5/storage/maria/ha_maria.cc:1153

    #8 0x56024b9588b4 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.5/sql/handler.cc:2977

    #9 0x56024b319bc5 in open_tmp_table(TABLE*) /data/src/10.5/sql/sql_select.cc:19398

    #10 0x56024b31f679 in instantiate_tmp_table(TABLE*, st_key*, st_maria_columndef*, st_maria_columndef**, unsigned long long) /data/src/10.5/sql/sql_select.cc:20296

    #11 0x56024b31683b in Create_tmp_table::finalize(THD*, TABLE*, TMP_TABLE_PARAM*, bool, bool) /data/src/10.5/sql/sql_select.cc:19099

    #12 0x56024b317a2a in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool) /data/src/10.5/sql/sql_select.cc:19196

    #13 0x56024b47bfe5 in select_unit::create_result_table(THD*, List<Item>*, bool, unsigned long long, st_mysql_const_lex_string const*, bool, bool, bool, unsigned int) /data/src/10.5/sql/sql_union.cc:329

    #14 0x56024b487fec in st_select_lex_unit::prepare(TABLE_LIST*, select_result*, unsigned long long) /data/src/10.5/sql/sql_union.cc:1722

    #15 0x56024b479244 in mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long) /data/src/10.5/sql/sql_union.cc:39

    #16 0x56024b28aac9 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.5/sql/sql_select.cc:407

    #17 0x56024b20b1b6 in execute_sqlcom_select /data/src/10.5/sql/sql_parse.cc:6210

    #18 0x56024b1fbb25 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:3932

    #19 0x56024b214f29 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:7994

    #20 0x56024b1ef78a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1868

    #21 0x56024b1ec60d in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1349

    #22 0x56024b5a9ad3 in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1410

    #23 0x56024b5a9542 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312

    #24 0x56024c19bd50 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201

    #25 0x7f6d1adfb4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

Thread T5 created by T0 here:

    #0 0x7f6d1b041f59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)

    #1 0x56024c196e12 in my_thread_create /data/src/10.5/storage/perfschema/my_thread.h:38

    #2 0x56024c19c13f in pfs_spawn_thread_v1 /data/src/10.5/storage/perfschema/pfs.cc:2252

    #3 0x56024af34377 in inline_mysql_thread_create /data/src/10.5/include/mysql/psi/mysql_thread.h:1321

    #4 0x56024af47189 in create_thread_to_handle_connection(CONNECT*) /data/src/10.5/sql/mysqld.cc:6020

    #5 0x56024af476fe in create_new_thread(CONNECT*) /data/src/10.5/sql/mysqld.cc:6079

    #6 0x56024af478bb in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.5/sql/mysqld.cc:6144

    #7 0x56024af4829e in handle_connections_sockets() /data/src/10.5/sql/mysqld.cc:6271

    #8 0x56024af46aef in mysqld_main(int, char**) /data/src/10.5/sql/mysqld.cc:5666

    #9 0x56024af32b6f in main /data/src/10.5/sql/main.cc:25

    #10 0x7f6d18e672e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.5/strings/ctype-simple.c:182 in my_strnncollsp_simple

Shadow bytes around the buggy address:

  0x0c247ffff4f0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa

  0x0c247ffff500: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00

  0x0c247ffff510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c247ffff520: 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa

  0x0c247ffff530: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

=>0x0c247ffff540: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd

  0x0c247ffff550: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa

  0x0c247ffff560: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c247ffff570: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c247ffff580: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa

  0x0c247ffff590: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==23139==ABORTING

Reproducible with at least MyISAM, InnoDB, Aria.
No obvious problem on my non-ASAN builds, but ASAN non-debug fails the same way as above, so it's probably not just a debug issue.

Attachments

Activity

People

Assignee:: Oleksandr Byelkin

Reporter:: Elena Stepanova

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2020-08-10 15:19

Updated:: 2024-02-01 09:55

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.