Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-24934

ASAN heap-use-after-free in Item_dyncol_get::val_str

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Minor
    • Resolution: Unresolved
    • 5.5(EOL), 10.0(EOL), 10.1(EOL), 10.2(EOL), 10.3(EOL), 10.4(EOL), 10.5, 10.6
    • 10.5
    • Dynamic Columns
    • None

    Description

      Setting to minor, because if no users have complained about it for all these years, probably nobody cares.

      --source include/have_innodb.inc
      		 
       
      		 
      CREATE TABLE t1 (a BLOB) ENGINE=InnoDB;
      		 
      INSERT INTO t1 VALUES (COLUMN_CREATE(1,REPEAT('x',31))),(COLUMN_CREATE(1,100));
      		 
      SELECT COLUMN_GET(a, 1 AS CHAR) = 'foo' FROM t1;
      		 
       
      		 
      # Cleanup
      		 
      DROP TABLE t1;

      10.2 5ecaf52d

      		 
      ==4128049==ERROR: AddressSanitizer: heap-use-after-free on address 0x629000140290 at pc 0x7fc0241fc57d bp 0x7fc00d165e00 sp 0x7fc00d1655a8
      		 
      WRITE of size 3 at 0x629000140290 thread T27
      		 
          #0 0x7fc0241fc57c  (/lib/x86_64-linux-gnu/libasan.so.5+0x9b57c)
      		 
          #1 0x55eee83e7b4e in my_longlong10_to_str_8bit /data/src/10.2/strings/ctype-simple.c:889
      		 
          #2 0x55eee6d45890 in String::set_int(long long, bool, charset_info_st const*) /data/src/10.2/sql/sql_string.cc:130
      		 
          #3 0x55eee735ebe0 in Item_dyncol_get::val_str(String*) /data/src/10.2/sql/item_strfunc.cc:4864
      		 
          #4 0x55eee73f0cae in Item_char_typecast::val_str(String*) /data/src/10.2/sql/item_timefunc.cc:2509
      		 
          #5 0x55eee7234a15 in Arg_comparator::compare_string() /data/src/10.2/sql/item_cmpfunc.cc:825
      		 
          #6 0x55eee72727e1 in Arg_comparator::compare() /data/src/10.2/sql/item_cmpfunc.h:87
      		 
          #7 0x55eee72407a5 in Item_func_eq::val_int() /data/src/10.2/sql/item_cmpfunc.cc:1803
      		 
          #8 0x55eee71f419a in Item::send(Protocol*, String*) /data/src/10.2/sql/item.cc:6938
      		 
          #9 0x55eee692c30f in Protocol::send_result_set_row(List<Item>*) /data/src/10.2/sql/protocol.cc:992
      		 
          #10 0x55eee6a93b3a in select_send::send_data(List<Item>&) /data/src/10.2/sql/sql_class.cc:2734
      		 
          #11 0x55eee6c7c838 in end_send /data/src/10.2/sql/sql_select.cc:20031
      		 
          #12 0x55eee6c75352 in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19079
      		 
          #13 0x55eee6c74355 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18898
      		 
          #14 0x55eee6c71dad in do_select /data/src/10.2/sql/sql_select.cc:18403
      		 
          #15 0x55eee6c0bf40 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3642
      		 
          #16 0x55eee6c09a57 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3437
      		 
          #17 0x55eee6c0d25f in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3837
      		 
          #18 0x55eee6be9d01 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
      		 
          #19 0x55eee6b60bec in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6248
      		 
          #20 0x55eee6b4db91 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3559
      		 
          #21 0x55eee6b6a169 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
      		 
          #22 0x55eee6b431ae in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
      		 
          #23 0x55eee6b3ff6d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
      		 
          #24 0x55eee6ec8924 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
      		 
          #25 0x55eee6ec81e7 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
      		 
          #26 0x55eee8264aab in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
      		 
          #27 0x7fc023d07608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
      		 
          #28 0x7fc0238e1292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
      		 
       
      		 
      0x629000140290 is located 144 bytes inside of 16512-byte region [0x629000140200,0x629000144280)
      		 
      freed by thread T27 here:
      		 
          #0 0x7fc02426e7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
      		 
          #1 0x55eee785127f in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /data/src/10.2/storage/innobase/mem/mem0mem.cc:428
      		 
          #2 0x55eee7979c55 in mem_heap_free /data/src/10.2/storage/innobase/include/mem0mem.ic:416
      		 
          #3 0x55eee7980d42 in row_mysql_prebuilt_free_blob_heap(row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:164
      		 
          #4 0x55eee79f2102 in row_sel_store_mysql_rec /data/src/10.2/storage/innobase/row/row0sel.cc:3157
      		 
          #5 0x55eee79ffab0 in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /data/src/10.2/storage/innobase/row/row0sel.cc:5623
      		 
          #6 0x55eee76cb20c in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9659
      		 
          #7 0x55eee76cc43f in ha_innobase::rnd_next(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9870
      		 
          #8 0x55eee719904a in handler::ha_rnd_next(unsigned char*) /data/src/10.2/sql/handler.cc:2669
      		 
          #9 0x55eee7546947 in rr_sequential(READ_RECORD*) /data/src/10.2/sql/records.cc:492
      		 
          #10 0x55eee6c73f85 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18878
      		 
          #11 0x55eee6c71dad in do_select /data/src/10.2/sql/sql_select.cc:18403
      		 
          #12 0x55eee6c0bf40 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3642
      		 
          #13 0x55eee6c09a57 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3437
      		 
          #14 0x55eee6c0d25f in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3837
      		 
          #15 0x55eee6be9d01 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
      		 
          #16 0x55eee6b60bec in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6248
      		 
          #17 0x55eee6b4db91 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3559
      		 
          #18 0x55eee6b6a169 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
      		 
          #19 0x55eee6b431ae in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
      		 
          #20 0x55eee6b3ff6d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
      		 
          #21 0x55eee6ec8924 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
      		 
          #22 0x55eee6ec81e7 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
      		 
          #23 0x55eee8264aab in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
      		 
          #24 0x7fc023d07608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
      		 
       
      		 
      previously allocated by thread T27 here:
      		 
          #0 0x7fc02426ebc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
      		 
          #1 0x55eee78507bc in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /data/src/10.2/storage/innobase/mem/mem0mem.cc:289
      		 
          #2 0x55eee79dd3e8 in mem_heap_create_func /data/src/10.2/storage/innobase/include/mem0mem.ic:374
      		 
          #3 0x55eee79f1abf in row_sel_store_mysql_field_func /data/src/10.2/storage/innobase/row/row0sel.cc:3098
      		 
          #4 0x55eee79f2c28 in row_sel_store_mysql_rec /data/src/10.2/storage/innobase/row/row0sel.cc:3245
      		 
          #5 0x55eee79ffab0 in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /data/src/10.2/storage/innobase/row/row0sel.cc:5623
      		 
          #6 0x55eee76c893c in ha_innobase::index_read(unsigned char*, unsigned char const*, unsigned int, ha_rkey_function) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9392
      		 
          #7 0x55eee76cbce2 in ha_innobase::index_first(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9769
      		 
          #8 0x55eee76cc3b9 in ha_innobase::rnd_next(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9862
      		 
          #9 0x55eee719904a in handler::ha_rnd_next(unsigned char*) /data/src/10.2/sql/handler.cc:2669
      		 
          #10 0x55eee7546947 in rr_sequential(READ_RECORD*) /data/src/10.2/sql/records.cc:492
      		 
          #11 0x55eee6c7a633 in join_init_read_record(st_join_table*) /data/src/10.2/sql/sql_select.cc:19785
      		 
          #12 0x55eee6c73b08 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18856
      		 
          #13 0x55eee6c71dad in do_select /data/src/10.2/sql/sql_select.cc:18403
      		 
          #14 0x55eee6c0bf40 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3642
      		 
          #15 0x55eee6c09a57 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3437
      		 
          #16 0x55eee6c0d25f in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3837
      		 
          #17 0x55eee6be9d01 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
      		 
          #18 0x55eee6b60bec in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6248
      		 
          #19 0x55eee6b4db91 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3559
      		 
          #20 0x55eee6b6a169 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
      		 
          #21 0x55eee6b431ae in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
      		 
          #22 0x55eee6b3ff6d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
      		 
          #23 0x55eee6ec8924 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
      		 
          #24 0x55eee6ec81e7 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
      		 
          #25 0x55eee8264aab in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
      		 
          #26 0x7fc023d07608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
      		 
       
      		 
      Thread T27 created by T0 here:
      		 
          #0 0x7fc02419b805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
      		 
          #1 0x55eee8264e9c in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
      		 
          #2 0x55eee68e5083 in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
      		 
          #3 0x55eee68fcc54 in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6573
      		 
          #4 0x55eee68fd3ef in create_new_thread /data/src/10.2/sql/mysqld.cc:6643
      		 
          #5 0x55eee68fe581 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6901
      		 
          #6 0x55eee68fbfa5 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6192
      		 
          #7 0x55eee68e393c in main /data/src/10.2/sql/main.cc:25
      		 
          #8 0x7fc0237e60b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
      		 
       
      		 
      SUMMARY: AddressSanitizer: heap-use-after-free (/lib/x86_64-linux-gnu/libasan.so.5+0x9b57c) 
      Shadow bytes around the buggy address:
      		 
        0x0c5280020000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      		 
        0x0c5280020010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      		 
        0x0c5280020020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      		 
        0x0c5280020030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      		 
        0x0c5280020040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
      =>0x0c5280020050: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c5280020060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c5280020070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c5280020080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c5280020090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c52800200a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
      Shadow byte legend (one shadow byte represents 8 application bytes):
      		 
        Addressable:           00
      		 
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
      		 
        Freed heap region:       fd
      		 
        Stack left redzone:      f1
      		 
        Stack mid redzone:       f2
      		 
        Stack right redzone:     f3
      		 
        Stack after return:      f5
      		 
        Stack use after scope:   f8
      		 
        Global redzone:          f9
      		 
        Global init order:       f6
      		 
        Poisoned by user:        f7
      		 
        Container overflow:      fc
      		 
        Array cookie:            ac
      		 
        Intra object redzone:    bb
      		 
        ASan internal:           fe
      		 
        Left alloca redzone:     ca
      		 
        Right alloca redzone:    cb
      		 
        Shadow gap:              cc
      		 
      ==4128049==ABORTING

      Reproducible on all of 5.5-10.6.
      Couldn't reproduce with MyISAM.
      No obvious immediate problem on a non-ASAN build.

      Other variations of stack traces observed on intermediate versions of the test case:

      10.4 901bcde2

      		 
      ==4128679==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290003702e7 at pc 0x55d62f7b0664 bp 0x7f70ae49f970 sp 0x7f70ae49f960
      		 
      WRITE of size 1 at 0x6290003702e7 thread T30
      		 
          #0 0x55d62f7b0663 in fmt_number /data/src/10.4/sql-common/my_time.c:1470
      		 
          #1 0x55d62f7b1007 in my_date_to_str /data/src/10.4/sql-common/my_time.c:1553
      		 
          #2 0x55d62f7b1515 in my_TIME_to_str /data/src/10.4/sql-common/my_time.c:1600
      		 
          #3 0x55d62e5a1674 in Item_dyncol_get::val_str(String*) /data/src/10.4/sql/item_strfunc.cc:5002
      		 
          #4 0x55d62e649e49 in Item_char_typecast::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:2337
      		 
          #5 0x55d62e459890 in Arg_comparator::compare_string() /data/src/10.4/sql/item_cmpfunc.cc:766
      		 
          #6 0x55d62e49d6e9 in Arg_comparator::compare() /data/src/10.4/sql/item_cmpfunc.h:104
      		 
          #7 0x55d62e465b88 in Item_func_eq::val_int() /data/src/10.4/sql/item_cmpfunc.cc:1770
      		 
          #8 0x55d62e0ec427 in Type_handler_int_result::Item_val_bool(Item*) const /data/src/10.4/sql/sql_type.cc:4514
      		 
          #9 0x55d62d8e270b in Item::val_bool() /data/src/10.4/sql/item.h:1465
      		 
          #10 0x55d62e487cd1 in Item_cond_and::val_int() /data/src/10.4/sql/item_cmpfunc.cc:5299
      		 
          #11 0x55d62de74d2e in SQL_SELECT::skip_record(THD*) /data/src/10.4/sql/opt_range.h:1665
      		 
          #12 0x55d62e818388 in record_should_be_deleted /data/src/10.4/sql/sql_delete.cc:232
      		 
          #13 0x55d62e81d135 in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /data/src/10.4/sql/sql_delete.cc:787
      		 
          #14 0x55d62db9e1cf in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4770
      		 
          #15 0x55d62dbb4442 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7958
      		 
          #16 0x55d62db8b033 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1855
      		 
          #17 0x55d62db87ae2 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1373
      		 
          #18 0x55d62df79f3d in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412
      		 
          #19 0x55d62df797e1 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316
      		 
          #20 0x55d62f633c3a in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
      		 
          #21 0x7f70c56a8608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
      		 
          #22 0x7f70c4f11292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
      		 
       
      		 
      0x6290003702e7 is located 231 bytes inside of 16512-byte region [0x629000370200,0x629000374280)
      		 
      freed by thread T30 here:
      		 
          #0 0x7f70c589e7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
      		 
          #1 0x55d62eb62dca in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /data/src/10.4/storage/innobase/mem/mem0mem.cc:416
      		 
          #2 0x55d62ecc7ab7 in mem_heap_free /data/src/10.4/storage/innobase/include/mem0mem.ic:417
      		 
          #3 0x55d62eccf5a1 in row_mysql_prebuilt_free_blob_heap(row_prebuilt_t*) /data/src/10.4/storage/innobase/row/row0mysql.cc:162
      		 
          #4 0x55d62ed5bc74 in row_sel_store_mysql_rec /data/src/10.4/storage/innobase/row/row0sel.cc:3029
      		 
          #5 0x55d62ed6be73 in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /data/src/10.4/storage/innobase/row/row0sel.cc:5533
      		 
          #6 0x55d62e977e92 in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9510
      		 
          #7 0x55d62e97871d in ha_innobase::index_next(unsigned char*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9578
      		 
          #8 0x55d62e3abb3e in handler::ha_index_next(unsigned char*) /data/src/10.4/sql/handler.cc:2972
      		 
          #9 0x55d62e7d107c in rr_index /data/src/10.4/sql/records.cc:450
      		 
          #10 0x55d62d9e68eb in READ_RECORD::read_record() /data/src/10.4/sql/records.h:70
      		 
          #11 0x55d62e81cfd8 in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /data/src/10.4/sql/sql_delete.cc:783
      		 
          #12 0x55d62db9e1cf in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4770
      		 
          #13 0x55d62dbb4442 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7958
      		 
          #14 0x55d62db8b033 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1855
      		 
          #15 0x55d62db87ae2 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1373
      		 
          #16 0x55d62df79f3d in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412
      		 
          #17 0x55d62df797e1 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316
      		 
          #18 0x55d62f633c3a in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
      		 
          #19 0x7f70c56a8608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
      		 
       
      		 
      previously allocated by thread T30 here:
      		 
          #0 0x7f70c589ebc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
      		 
          #1 0x55d62eb621c7 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /data/src/10.4/storage/innobase/mem/mem0mem.cc:277
      		 
          #2 0x55d62ed44b41 in mem_heap_create_func /data/src/10.4/storage/innobase/include/mem0mem.ic:375
      		 
          #3 0x55d62ed5b527 in row_sel_store_mysql_field /data/src/10.4/storage/innobase/row/row0sel.cc:2970
      		 
          #4 0x55d62ed5c92d in row_sel_store_mysql_rec /data/src/10.4/storage/innobase/row/row0sel.cc:3117
      		 
          #5 0x55d62ed6be73 in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /data/src/10.4/storage/innobase/row/row0sel.cc:5533
      		 
          #6 0x55d62e977e92 in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9510
      		 
          #7 0x55d62e97871d in ha_innobase::index_next(unsigned char*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9578
      		 
          #8 0x55d62e3abb3e in handler::ha_index_next(unsigned char*) /data/src/10.4/sql/handler.cc:2972
      		 
          #9 0x55d62e7d107c in rr_index /data/src/10.4/sql/records.cc:450
      		 
          #10 0x55d62d9e68eb in READ_RECORD::read_record() /data/src/10.4/sql/records.h:70
      		 
          #11 0x55d62e81cfd8 in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /data/src/10.4/sql/sql_delete.cc:783
      		 
          #12 0x55d62db9e1cf in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4770
      		 
          #13 0x55d62dbb4442 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7958
      		 
          #14 0x55d62db8b033 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1855
      		 
          #15 0x55d62db87ae2 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1373
      		 
          #16 0x55d62df79f3d in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412
      		 
          #17 0x55d62df797e1 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316
      		 
          #18 0x55d62f633c3a in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
      		 
          #19 0x7f70c56a8608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
      		 
       
      		 
      Thread T30 created by T0 here:
      		 
          #0 0x7f70c57cb805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
      		 
          #1 0x55d62f63402b in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1919
      		 
          #2 0x55d62d890c78 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1275
      		 
          #3 0x55d62d8a8851 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6259
      		 
          #4 0x55d62d8a8fec in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6329
      		 
          #5 0x55d62d8a94d2 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6427
      		 
          #6 0x55d62d8aa36b in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6585
      		 
          #7 0x55d62d8a7f56 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5917
      		 
          #8 0x55d62d88ebec in main /data/src/10.4/sql/main.cc:25
      		 
          #9 0x7f70c4e160b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
      		 
       
      		 
      SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.4/sql-common/my_time.c:1470 in fmt_number
      		 
      Shadow bytes around the buggy address:
      		 
        0x0c5280066000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      		 
        0x0c5280066010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      		 
        0x0c5280066020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      		 
        0x0c5280066030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      		 
        0x0c5280066040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
      =>0x0c5280066050: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
      		 
        0x0c5280066060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c5280066070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c5280066080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c5280066090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c52800660a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
      Shadow byte legend (one shadow byte represents 8 application bytes):
      		 
        Addressable:           00
      		 
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
      		 
        Freed heap region:       fd
      		 
        Stack left redzone:      f1
      		 
        Stack mid redzone:       f2
      		 
        Stack right redzone:     f3
      		 
        Stack after return:      f5
      		 
        Stack use after scope:   f8
      		 
        Global redzone:          f9
      		 
        Global init order:       f6
      		 
        Poisoned by user:        f7
      		 
        Container overflow:      fc
      		 
        Array cookie:            ac
      		 
        Intra object redzone:    bb
      		 
        ASan internal:           fe
      		 
        Left alloca redzone:     ca
      		 
        Right alloca redzone:    cb
      		 
        Shadow gap:              cc
      		 
      ==4128679==ABORTING

      Attachments

        Activity

          People

            sanja Oleksandr Byelkin
            elenst Elena Stepanova
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.