Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Duplicate
-
10.2(EOL), 10.3(EOL), 10.4(EOL), 10.5, 10.6
-
None
Description
--source include/have_innodb.inc
|
|
CREATE TABLE t1 (id INT PRIMARY KEY, a VARCHAR(2333), va VARCHAR(171) AS (a)) ENGINE=InnoDB; |
INSERT INTO t1 (id,a) VALUES (1,REPEAT('x',200)); |
SELECT id, va INTO OUTFILE 'load_t1' FROM t1; |
--error ER_DATA_TOO_LONG
|
LOAD DATA INFILE 'load_t1' REPLACE INTO TABLE t1 (id,va); |
SELECT * FROM t1; |
LOAD DATA INFILE 'load_t1' IGNORE INTO TABLE t1 (id,va); |
|
# Cleanup
|
DROP TABLE t1; |
--let $datadir= `select @@datadir`
|
--remove_file $datadir/test/load_t1 |
10.2 29d9897f debug |
2021-01-22 19:42:32 140674636863232 [ERROR] [FATAL] InnoDB: Data field type 0, len 0
|
210122 19:42:32 [ERROR] mysqld got signal 6 ;
|
|
#5 0x00007ff1637ac859 in __GI_abort () at abort.c:79
|
#6 0x0000558a4099b40d in ib::fatal::~fatal (this=0x7ff15dc22a00, __in_chrg=<optimized out>) at /data/src/10.2/storage/innobase/ut/ut0ut.cc:649
|
#7 0x0000558a40a2a3c7 in dfield_check_typed (field=0x7ff10809fd38) at /data/src/10.2/storage/innobase/data/data0data.cc:159
|
#8 0x0000558a40a2a451 in dtuple_check_typed (tuple=0x7ff10809fc70) at /data/src/10.2/storage/innobase/data/data0data.cc:182
|
#9 0x0000558a408ae9a8 in row_ins_index_entry_step (node=0x7ff108039090, thr=0x7ff10809fe10) at /data/src/10.2/storage/innobase/row/row0ins.cc:3400
|
#10 0x0000558a408aee5f in row_ins (node=0x7ff108039090, thr=0x7ff10809fe10) at /data/src/10.2/storage/innobase/row/row0ins.cc:3548
|
#11 0x0000558a408af20a in row_ins_step (thr=0x7ff10809fe10) at /data/src/10.2/storage/innobase/row/row0ins.cc:3668
|
#12 0x0000558a408cd46c in row_insert_for_mysql (mysql_rec=0x7ff108036eb8 "\377", prebuilt=0x7ff108038b30) at /data/src/10.2/storage/innobase/row/row0mysql.cc:1411
|
#13 0x0000558a4078ce04 in ha_innobase::write_row (this=0x7ff108176828, record=0x7ff108036eb8 "\377") at /data/src/10.2/storage/innobase/handler/ha_innodb.cc:8166
|
#14 0x0000558a4058f10b in handler::ha_write_row (this=0x7ff108176828, buf=0x7ff108036eb8 "\377") at /data/src/10.2/sql/handler.cc:6118
|
#15 0x0000558a402da1c3 in write_record (thd=0x7ff108000d90, table=0x7ff108175c20, info=0x7ff15dc234a0) at /data/src/10.2/sql/sql_insert.cc:1939
|
#16 0x0000558a4071ecec in read_sep_field (thd=0x7ff108000d90, info=..., table_list=0x7ff108012860, fields_vars=..., set_fields=..., set_values=..., read_info=..., enclosed=..., skip_lines=0, ignore_check_option_errors=true) at /data/src/10.2/sql/sql_load.cc:1175
|
#17 0x0000558a4071d2fa in mysql_load (thd=0x7ff108000d90, ex=0x7ff1080127d8, table_list=0x7ff108012860, fields_vars=..., set_fields=..., set_values=..., handle_duplicates=DUP_ERROR, ignore=true, read_file_from_client=false) at /data/src/10.2/sql/sql_load.cc:682
|
#18 0x0000558a40300518 in mysql_execute_command (thd=0x7ff108000d90) at /data/src/10.2/sql/sql_parse.cc:4605
|
#19 0x0000558a4030a3bf in mysql_parse (thd=0x7ff108000d90, rawbuf=0x7ff1080126f8 "LOAD DATA INFILE 'load_t1' IGNORE INTO TABLE t1 (id,va)", length=55, parser_state=0x7ff15dc245f0, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7763
|
#20 0x0000558a402f8698 in dispatch_command (command=COM_QUERY, thd=0x7ff108000d90, packet=0x7ff108008b51 "LOAD DATA INFILE 'load_t1' IGNORE INTO TABLE t1 (id,va)", packet_length=55, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1827
|
#21 0x0000558a402f7193 in do_command (thd=0x7ff108000d90) at /data/src/10.2/sql/sql_parse.cc:1381
|
#22 0x0000558a40451aae in do_handle_one_connection (connect=0x558a444acfa0) at /data/src/10.2/sql/sql_connect.cc:1336
|
#23 0x0000558a40451813 in handle_one_connection (arg=0x558a444acfa0) at /data/src/10.2/sql/sql_connect.cc:1241
|
#24 0x0000558a40c79dd2 in pfs_spawn_thread (arg=0x558a444900d0) at /data/src/10.2/storage/perfschema/pfs.cc:1869
|
#25 0x00007ff163ccd609 in start_thread (arg=<optimized out>) at pthread_create.c:477
|
#26 0x00007ff1638a9293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
10.2 29d9897f non-debug ASAN |
==1685553==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61e00003ca80 at pc 0x5635b74e4a38 bp 0x7f0ff88864b0 sp 0x7f0ff88864a0
|
READ of size 1 at 0x61e00003ca80 thread T27
|
#0 0x5635b74e4a37 in Field::is_null_in_record(unsigned char const*) const /data/src/10.2/sql/field.h:1145
|
#1 0x5635b74e4a37 in TABLE::validate_default_values_of_unset_fields(THD*) const /data/src/10.2/sql/table.cc:7983
|
#2 0x5635b7ca634b in mysql_load(THD*, sql_exchange*, TABLE_LIST*, List<Item>&, List<Item>&, List<Item>&, enum_duplicates, bool, bool) /data/src/10.2/sql/sql_load.cc:668
|
#3 0x5635b723dc3f in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4605
|
#4 0x5635b725033f in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
|
#5 0x5635b72598cb in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
|
#6 0x5635b725e7a5 in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
|
#7 0x5635b755e776 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
|
#8 0x5635b755eebe in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
|
#9 0x5635b882b458 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
|
#10 0x7f100f2ca608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
|
#11 0x7f100eea4292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
|
|
0x61e00003ca80 is located 0 bytes to the right of 2560-byte region [0x61e00003c080,0x61e00003ca80)
|
allocated by thread T27 here:
|
#0 0x7f100f831bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
|
#1 0x5635b88e3d96 in my_malloc /data/src/10.2/mysys/my_malloc.c:101
|
#2 0x5635b88cf5eb in alloc_root /data/src/10.2/mysys/my_alloc.c:243
|
#3 0x5635b74c028c in TABLE_SHARE::init_from_binary_frm_image(THD*, bool, unsigned char const*, unsigned long) /data/src/10.2/sql/table.cc:1621
|
#4 0x5635b74cba30 in open_table_def(THD*, TABLE_SHARE*, unsigned int) /data/src/10.2/sql/table.cc:684
|
#5 0x5635b76e0d24 in tdc_acquire_share(THD*, TABLE_LIST*, unsigned int, TABLE**) /data/src/10.2/sql/table_cache.cc:826
|
#6 0x5635b7135ef6 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.2/sql/sql_base.cc:1797
|
#7 0x5635b7142651 in open_and_process_table /data/src/10.2/sql/sql_base.cc:3614
|
#8 0x5635b7142651 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.2/sql/sql_base.cc:4081
|
#9 0x5635b7143b21 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.2/sql/sql_base.cc:4880
|
#10 0x5635b71ec745 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.2/sql/sql_base.h:507
|
#11 0x5635b71ec745 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.2/sql/sql_insert.cc:758
|
#12 0x5635b7238319 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4194
|
#13 0x5635b725033f in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
|
#14 0x5635b72598cb in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
|
#15 0x5635b725e7a5 in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
|
#16 0x5635b755e776 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
|
#17 0x5635b755eebe in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
|
#18 0x5635b882b458 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
|
#19 0x7f100f2ca608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
|
|
Thread T27 created by T0 here:
|
#0 0x7f100f75e805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
|
#1 0x5635b883443e in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
|
#2 0x5635b70336e2 in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
|
#3 0x5635b70336e2 in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6567
|
#4 0x5635b7043d43 in create_new_thread /data/src/10.2/sql/mysqld.cc:6637
|
#5 0x5635b7043d43 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6895
|
#6 0x5635b7046257 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6186
|
#7 0x7f100eda90b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
|
|
SUMMARY: AddressSanitizer: heap-buffer-overflow /data/src/10.2/sql/field.h:1145 in Field::is_null_in_record(unsigned char const*) const
|
Shadow bytes around the buggy address:
|
0x0c3c7ffff900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c3c7ffff910: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c3c7ffff920: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c3c7ffff930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c3c7ffff940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7
|
=>0x0c3c7ffff950:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c3c7ffff960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c3c7ffff970: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c3c7ffff980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c3c7ffff990: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c3c7ffff9a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
Shadow gap: cc
|
==1685553==ABORTING
|
Reproducible on 10.2+.
My non-debug non-ASAN builds don't crash, but given the non-debug ASAN failure above, it probably won't end well.
The exact same test case, but with BIGINT instead of INT for the primary key causes differently looking failures:
--source include/have_innodb.inc
|
|
CREATE TABLE t1 (id BIGINT PRIMARY KEY, a VARCHAR(2333), va VARCHAR(171) AS (a)) ENGINE=InnoDB; |
INSERT INTO t1 (id,a) VALUES (1,REPEAT('x',200)); |
SELECT id, va INTO OUTFILE 'load_t1' FROM t1; |
--error ER_DATA_TOO_LONG
|
LOAD DATA INFILE 'load_t1' REPLACE INTO TABLE t1 (id,va); |
SELECT * FROM t1; |
LOAD DATA INFILE 'load_t1' IGNORE INTO TABLE t1 (id,va); |
|
# Cleanup
|
DROP TABLE t1; |
--let $datadir= `select @@datadir`
|
--remove_file $datadir/test/load_t1 |
10.2 29d9897f debug |
mysqld: /data/src/10.2/storage/innobase/include/data0data.h:562: dfield_t* dtuple_get_nth_field(dtuple_t*, ulint): Assertion `n < tuple->n_fields' failed.
|
210122 20:31:35 [ERROR] mysqld got signal 6 ;
|
|
#7 0x00007efc3c60df36 in __GI___assert_fail (assertion=0x559087e58361 "n < tuple->n_fields", file=0x559087e58278 "/data/src/10.2/storage/innobase/include/data0data.h", line=562, function=0x559087e58330 "dfield_t* dtuple_get_nth_field(dtuple_t*, ulint)") at assert.c:101
|
#8 0x000055908777aac0 in dtuple_get_nth_field (tuple=0x7efbe009fc78, n=1) at /data/src/10.2/storage/innobase/include/data0data.h:562
|
#9 0x000055908789c5d2 in row_mysql_convert_row_to_innobase (row=0x7efbe009fc78, prebuilt=0x7efbe0038b30, mysql_rec=0x7efbe0036eb8 "\377", blob_heap=0x7efc36a72d08) at /data/src/10.2/storage/innobase/row/row0mysql.cc:604
|
#10 0x000055908789e3ad in row_insert_for_mysql (mysql_rec=0x7efbe0036eb8 "\377", prebuilt=0x7efbe0038b30) at /data/src/10.2/storage/innobase/row/row0mysql.cc:1391
|
#11 0x000055908775de04 in ha_innobase::write_row (this=0x7efbe0176828, record=0x7efbe0036eb8 "\377") at /data/src/10.2/storage/innobase/handler/ha_innodb.cc:8166
|
#12 0x000055908756010b in handler::ha_write_row (this=0x7efbe0176828, buf=0x7efbe0036eb8 "\377") at /data/src/10.2/sql/handler.cc:6118
|
#13 0x00005590872ab1c3 in write_record (thd=0x7efbe0000d90, table=0x7efbe0175c20, info=0x7efc36a734a0) at /data/src/10.2/sql/sql_insert.cc:1939
|
#14 0x00005590876efcec in read_sep_field (thd=0x7efbe0000d90, info=..., table_list=0x7efbe0012860, fields_vars=..., set_fields=..., set_values=..., read_info=..., enclosed=..., skip_lines=0, ignore_check_option_errors=true) at /data/src/10.2/sql/sql_load.cc:1175
|
#15 0x00005590876ee2fa in mysql_load (thd=0x7efbe0000d90, ex=0x7efbe00127d8, table_list=0x7efbe0012860, fields_vars=..., set_fields=..., set_values=..., handle_duplicates=DUP_ERROR, ignore=true, read_file_from_client=false) at /data/src/10.2/sql/sql_load.cc:682
|
#16 0x00005590872d1518 in mysql_execute_command (thd=0x7efbe0000d90) at /data/src/10.2/sql/sql_parse.cc:4605
|
#17 0x00005590872db3bf in mysql_parse (thd=0x7efbe0000d90, rawbuf=0x7efbe00126f8 "LOAD DATA INFILE 'load_t1' IGNORE INTO TABLE t1 (id,va)", length=55, parser_state=0x7efc36a745f0, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7763
|
#18 0x00005590872c9698 in dispatch_command (command=COM_QUERY, thd=0x7efbe0000d90, packet=0x7efbe0008b51 "LOAD DATA INFILE 'load_t1' IGNORE INTO TABLE t1 (id,va)", packet_length=55, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1827
|
#19 0x00005590872c8193 in do_command (thd=0x7efbe0000d90) at /data/src/10.2/sql/sql_parse.cc:1381
|
#20 0x0000559087422aae in do_handle_one_connection (connect=0x5590898dbfa0) at /data/src/10.2/sql/sql_connect.cc:1336
|
#21 0x0000559087422813 in handle_one_connection (arg=0x5590898dbfa0) at /data/src/10.2/sql/sql_connect.cc:1241
|
#22 0x0000559087c4add2 in pfs_spawn_thread (arg=0x5590898bf0d0) at /data/src/10.2/storage/perfschema/pfs.cc:1869
|
#23 0x00007efc3cb1d609 in start_thread (arg=<optimized out>) at pthread_create.c:477
|
#24 0x00007efc3c6f9293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
10.2 29d9897f debug+ASAN |
==1688464==ERROR: AddressSanitizer: use-after-poison on address 0x6250000f5b67 at pc 0x557392b089da bp 0x7f19d74399f0 sp 0x7f19d74399e0
|
WRITE of size 1 at 0x6250000f5b67 thread T27
|
#0 0x557392b089d9 in row_mysql_store_col_in_innobase_format(dfield_t*, unsigned char*, unsigned long, unsigned char const*, unsigned long, unsigned long) /data/src/10.2/storage/innobase/row/row0mysql.cc:436
|
#1 0x557392b09659 in row_mysql_convert_row_to_innobase /data/src/10.2/storage/innobase/row/row0mysql.cc:622
|
#2 0x557392b0ea35 in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1391
|
#3 0x55739284844a in ha_innobase::write_row(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:8166
|
#4 0x557392338e89 in handler::ha_write_row(unsigned char*) /data/src/10.2/sql/handler.cc:6118
|
#5 0x557391c7840c in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1939
|
#6 0x55739272c48e in read_sep_field /data/src/10.2/sql/sql_load.cc:1175
|
#7 0x55739272871a in mysql_load(THD*, sql_exchange*, TABLE_LIST*, List<Item>&, List<Item>&, List<Item>&, enum_duplicates, bool, bool) /data/src/10.2/sql/sql_load.cc:682
|
#8 0x557391cdc1f7 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4605
|
#9 0x557391cf17eb in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
|
#10 0x557391cca830 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
|
#11 0x557391cc75ef in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
|
#12 0x55739204fb1e in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
|
#13 0x55739204f3e1 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
|
#14 0x5573933eb5d9 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
|
#15 0x7f19edfdb608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
|
#16 0x7f19edbb5292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
|
|
0x6250000f5b67 is located 2663 bytes inside of 7984-byte region [0x6250000f5100,0x6250000f7030)
|
allocated by thread T27 here:
|
#0 0x7f19ee542bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
|
#1 0x5573929d7302 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /data/src/10.2/storage/innobase/mem/mem0mem.cc:289
|
#2 0x5573929d7b99 in mem_heap_add_block(mem_block_info_t*, unsigned long) /data/src/10.2/storage/innobase/mem/mem0mem.cc:390
|
#3 0x557392b00222 in mem_heap_alloc /data/src/10.2/storage/innobase/include/mem0mem.ic:191
|
#4 0x557392b0ce82 in row_get_prebuilt_insert_row /data/src/10.2/storage/innobase/row/row0mysql.cc:1115
|
#5 0x557392b0e9ab in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1388
|
#6 0x55739284844a in ha_innobase::write_row(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:8166
|
#7 0x557392338e89 in handler::ha_write_row(unsigned char*) /data/src/10.2/sql/handler.cc:6118
|
#8 0x557391c7840c in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1939
|
#9 0x557391c71f8c in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.2/sql/sql_insert.cc:1066
|
#10 0x557391cd8b91 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4194
|
#11 0x557391cf17eb in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
|
#12 0x557391cca830 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
|
#13 0x557391cc75ef in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
|
#14 0x55739204fb1e in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
|
#15 0x55739204f3e1 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
|
#16 0x5573933eb5d9 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
|
#17 0x7f19edfdb608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
|
|
Thread T27 created by T0 here:
|
#0 0x7f19ee46f805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
|
#1 0x5573933eb9ca in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
|
#2 0x557391a6c083 in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
|
#3 0x557391a83c2b in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6567
|
#4 0x557391a843c6 in create_new_thread /data/src/10.2/sql/mysqld.cc:6637
|
#5 0x557391a85558 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6895
|
#6 0x557391a82f7c in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6186
|
#7 0x557391a6a93c in main /data/src/10.2/sql/main.cc:25
|
#8 0x7f19edaba0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
|
|
SUMMARY: AddressSanitizer: use-after-poison /data/src/10.2/storage/innobase/row/row0mysql.cc:436 in row_mysql_store_col_in_innobase_format(dfield_t*, unsigned char*, unsigned long, unsigned char const*, unsigned long, unsigned long)
|
Shadow bytes around the buggy address:
|
0x0c4a80016b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c4a80016b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c4a80016b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c4a80016b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c4a80016b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
=>0x0c4a80016b60: 00 00 00 00 00 00 00 00 00 00 00 04[f7]00 00 00
|
0x0c4a80016b70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c4a80016b80: 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00
|
0x0c4a80016b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c4a80016ba0: 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c4a80016bb0: 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
Shadow gap: cc
|
==1688464==ABORTING
|
Attachments
Issue Links
- duplicates
-
MDEV-24583 ASAN use-after-poison in create_tmp_table or assertion failures after failed REPLACE into table with virtual/stored column
- Closed
- relates to
-
MDEV-24665 ASAN errors, assertion failures, corrupt values after failed LOAD DATA into table with virtual/stored column
- Closed