ASAN unknown-crash in QUICK_GROUP_MIN_MAX_SELECT::next_min_in_range, dynamic-stack-buffer-overflow in key_restore

CREATE TABLE t1 (a INT, b VARCHAR(1), KEY(b,a)) ENGINE=MyISAM;

INSERT INTO t1 VALUES (8,'o'),(5,'g'),(8,'f'),(3,'g'),(4,'j'),(NULL,'j'),(0,'i'),(124,'j'),(6,'l'),(5,'f');

SELECT MIN(a), b FROM t1 WHERE a IS NULL GROUP BY b;

# Cleanup

DROP TABLE t1;

==3283520==ERROR: AddressSanitizer: unknown-crash on address 0x619000087627 at pc 0x7f150ee52480 bp 0x7f1503bfc9e0 sp 0x7f1503bfc188

READ of size 8 at 0x619000087627 thread T5

    #0 0x7f150ee5247f  (/lib/x86_64-linux-gnu/libasan.so.5+0x9b47f)

    #1 0x56481f1abd7e in QUICK_GROUP_MIN_MAX_SELECT::next_min_in_range() /data/src/10.2/sql/opt_range.cc:14496

    #2 0x56481f1a9ce3 in QUICK_GROUP_MIN_MAX_SELECT::next_min() /data/src/10.2/sql/opt_range.cc:14172

    #3 0x56481f1a94fa in QUICK_GROUP_MIN_MAX_SELECT::get_next() /data/src/10.2/sql/opt_range.cc:14105

    #4 0x56481f1c8397 in rr_quick /data/src/10.2/sql/records.cc:373

    #5 0x56481e8fc633 in join_init_read_record(st_join_table*) /data/src/10.2/sql/sql_select.cc:19785

    #6 0x56481e8f5b08 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18856

    #7 0x56481e8f3dad in do_select /data/src/10.2/sql/sql_select.cc:18403

    #8 0x56481e88df40 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3642

    #9 0x56481e88ba57 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3437

    #10 0x56481e88f25f in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3837

    #11 0x56481e86bd01 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361

    #12 0x56481e7e2bec in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6248

    #13 0x56481e7cfb91 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3559

    #14 0x56481e7ec169 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763

    #15 0x56481e7c51ae in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827

    #16 0x56481e7c1f6d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381

    #17 0x56481eb4a924 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336

    #18 0x56481eb4a1e7 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241

    #19 0x56481fee6aab in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869

    #20 0x7f150e95d608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

    #21 0x7f150e537292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x619000087627 is located 167 bytes inside of 1100-byte region [0x619000087580,0x6190000879cc)

allocated by thread T5 here:

    #0 0x7f150eec4bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)

    #1 0x564820003606 in sf_malloc /data/src/10.2/mysys/safemalloc.c:118

    #2 0x56481ffcf56b in my_malloc /data/src/10.2/mysys/my_malloc.c:101

    #3 0x56481ffacbdd in alloc_root /data/src/10.2/mysys/my_alloc.c:243

    #4 0x56481ffae576 in strmake_root /data/src/10.2/mysys/my_alloc.c:451

    #5 0x56481ea90e57 in open_table_from_share(THD*, TABLE_SHARE*, char const*, unsigned int, unsigned int, unsigned int, TABLE*, bool) /data/src/10.2/sql/table.cc:3103

    #6 0x56481e6a6cfd in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.2/sql/sql_base.cc:1934

    #7 0x56481e6aec82 in open_and_process_table /data/src/10.2/sql/sql_base.cc:3614

    #8 0x56481e6b105c in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.2/sql/sql_base.cc:4081

    #9 0x56481e6b4be2 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.2/sql/sql_base.cc:4880

    #10 0x56481e62bdb1 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.2/sql/sql_base.h:507

    #11 0x56481e76aabd in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.2/sql/sql_insert.cc:758

    #12 0x56481e7d350f in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4194

    #13 0x56481e7ec169 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763

    #14 0x56481e7c51ae in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827

    #15 0x56481e7c1f6d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381

    #16 0x56481eb4a924 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336

    #17 0x56481eb4a1e7 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241

    #18 0x56481fee6aab in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869

    #19 0x7f150e95d608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

Thread T5 created by T0 here:

    #0 0x7f150edf1805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)

    #1 0x56481fee6e9c in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919

    #2 0x56481e567083 in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246

    #3 0x56481e57ec54 in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6573

    #4 0x56481e57f3ef in create_new_thread /data/src/10.2/sql/mysqld.cc:6643

    #5 0x56481e580581 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6901

    #6 0x56481e57dfa5 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6192

    #7 0x56481e56593c in main /data/src/10.2/sql/main.cc:25

    #8 0x7f150e43c0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: unknown-crash (/lib/x86_64-linux-gnu/libasan.so.5+0x9b47f) 

Shadow bytes around the buggy address:

  0x0c3280008e70: 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00

  0x0c3280008e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c3280008e90: 00 00 f7 00 02 f7 04 f7 f7 04 fa fa fa fa fa fa

  0x0c3280008ea0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c3280008eb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

=>0x0c3280008ec0: 00 f7 03 f7[07]07 f7 00 00 00 f7 00 00 00 00 00

  0x0c3280008ed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c3280008ee0: 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00 00

  0x0c3280008ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c3280008f00: f7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c3280008f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==3283520==ABORTING

id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra

1	SIMPLE	t1	range	NULL	b	9	NULL	6	100.00	Using where; Using index for group-by

Warnings:

Note	1003	select min(`test`.`t1`.`a`) AS `MIN(a)`,`test`.`t1`.`b` AS `b` from `test`.`t1` where `test`.`t1`.`a` is null group by `test`.`t1`.`b`

id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra

1	SIMPLE	t1	index	NULL	b	9	NULL	10	100.00	Using where; Using index

Warnings:

Note	1003	select min(`test`.`t1`.`a`) AS `MIN(a)`,`test`.`t1`.`b` AS `b` from `test`.`t1` where `test`.`t1`.`a` is null group by `test`.`t1`.`b`