[MDEV-24934] ASAN heap-use-after-free in Item_dyncol_get::val_str - Jira

Details

Type: Bug
Status: Open (View Workflow)
Priority: Minor
Resolution: Unresolved
Affects Version/s: 5.5(EOL), 10.0(EOL), 10.1(EOL), 10.2(EOL), 10.3(EOL), 10.4(EOL), 10.5, 10.6
Fix Version/s: 10.5
Component/s: Dynamic Columns
Labels:
None

Description

Setting to minor, because if no users have complained about it for all these years, probably nobody cares.

--source include/have_innodb.inc

CREATE TABLE t1 (a BLOB) ENGINE=InnoDB;

INSERT INTO t1 VALUES (COLUMN_CREATE(1,REPEAT('x',31))),(COLUMN_CREATE(1,100));

SELECT COLUMN_GET(a, 1 AS CHAR) = 'foo' FROM t1;

# Cleanup

DROP TABLE t1;

10.2 5ecaf52d
==4128049==ERROR: AddressSanitizer: heap-use-after-free on address 0x629000140290 at pc 0x7fc0241fc57d bp 0x7fc00d165e00 sp 0x7fc00d1655a8
WRITE of size 3 at 0x629000140290 thread T27
#0 0x7fc0241fc57c (/lib/x86_64-linux-gnu/libasan.so.5+0x9b57c)
#1 0x55eee83e7b4e in my_longlong10_to_str_8bit /data/src/10.2/strings/ctype-simple.c:889
#2 0x55eee6d45890 in String::set_int(long long, bool, charset_info_st const*) /data/src/10.2/sql/sql_string.cc:130
#3 0x55eee735ebe0 in Item_dyncol_get::val_str(String*) /data/src/10.2/sql/item_strfunc.cc:4864
#4 0x55eee73f0cae in Item_char_typecast::val_str(String*) /data/src/10.2/sql/item_timefunc.cc:2509
#5 0x55eee7234a15 in Arg_comparator::compare_string() /data/src/10.2/sql/item_cmpfunc.cc:825
#6 0x55eee72727e1 in Arg_comparator::compare() /data/src/10.2/sql/item_cmpfunc.h:87
#7 0x55eee72407a5 in Item_func_eq::val_int() /data/src/10.2/sql/item_cmpfunc.cc:1803
#8 0x55eee71f419a in Item::send(Protocol, String) /data/src/10.2/sql/item.cc:6938
#9 0x55eee692c30f in Protocol::send_result_set_row(List<Item>*) /data/src/10.2/sql/protocol.cc:992
#10 0x55eee6a93b3a in select_send::send_data(List<Item>&) /data/src/10.2/sql/sql_class.cc:2734
#11 0x55eee6c7c838 in end_send /data/src/10.2/sql/sql_select.cc:20031
#12 0x55eee6c75352 in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19079
#13 0x55eee6c74355 in sub_select(JOIN, st_join_table, bool) /data/src/10.2/sql/sql_select.cc:18898
#14 0x55eee6c71dad in do_select /data/src/10.2/sql/sql_select.cc:18403
#15 0x55eee6c0bf40 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3642
#16 0x55eee6c09a57 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3437
#17 0x55eee6c0d25f in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.2/sql/sql_select.cc:3837
#18 0x55eee6be9d01 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
#19 0x55eee6b60bec in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6248
#20 0x55eee6b4db91 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3559
#21 0x55eee6b6a169 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
#22 0x55eee6b431ae in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
#23 0x55eee6b3ff6d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
#24 0x55eee6ec8924 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
#25 0x55eee6ec81e7 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
#26 0x55eee8264aab in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
#27 0x7fc023d07608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
#28 0x7fc0238e1292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x629000140290 is located 144 bytes inside of 16512-byte region [0x629000140200,0x629000144280)
freed by thread T27 here:
#0 0x7fc02426e7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
#1 0x55eee785127f in mem_heap_block_free(mem_block_info_t, mem_block_info_t) /data/src/10.2/storage/innobase/mem/mem0mem.cc:428
#2 0x55eee7979c55 in mem_heap_free /data/src/10.2/storage/innobase/include/mem0mem.ic:416
#3 0x55eee7980d42 in row_mysql_prebuilt_free_blob_heap(row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:164
#4 0x55eee79f2102 in row_sel_store_mysql_rec /data/src/10.2/storage/innobase/row/row0sel.cc:3157
#5 0x55eee79ffab0 in row_search_mvcc(unsigned char, page_cur_mode_t, row_prebuilt_t, unsigned long, unsigned long) /data/src/10.2/storage/innobase/row/row0sel.cc:5623
#6 0x55eee76cb20c in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9659
#7 0x55eee76cc43f in ha_innobase::rnd_next(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9870
#8 0x55eee719904a in handler::ha_rnd_next(unsigned char*) /data/src/10.2/sql/handler.cc:2669
#9 0x55eee7546947 in rr_sequential(READ_RECORD*) /data/src/10.2/sql/records.cc:492
#10 0x55eee6c73f85 in sub_select(JOIN, st_join_table, bool) /data/src/10.2/sql/sql_select.cc:18878
#11 0x55eee6c71dad in do_select /data/src/10.2/sql/sql_select.cc:18403
#12 0x55eee6c0bf40 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3642
#13 0x55eee6c09a57 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3437
#14 0x55eee6c0d25f in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.2/sql/sql_select.cc:3837
#15 0x55eee6be9d01 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
#16 0x55eee6b60bec in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6248
#17 0x55eee6b4db91 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3559
#18 0x55eee6b6a169 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
#19 0x55eee6b431ae in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
#20 0x55eee6b3ff6d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
#21 0x55eee6ec8924 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
#22 0x55eee6ec81e7 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
#23 0x55eee8264aab in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
#24 0x7fc023d07608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

previously allocated by thread T27 here:
#0 0x7fc02426ebc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x55eee78507bc in mem_heap_create_block_func(mem_block_info_t, unsigned long, char const, unsigned int, unsigned long) /data/src/10.2/storage/innobase/mem/mem0mem.cc:289
#2 0x55eee79dd3e8 in mem_heap_create_func /data/src/10.2/storage/innobase/include/mem0mem.ic:374
#3 0x55eee79f1abf in row_sel_store_mysql_field_func /data/src/10.2/storage/innobase/row/row0sel.cc:3098
#4 0x55eee79f2c28 in row_sel_store_mysql_rec /data/src/10.2/storage/innobase/row/row0sel.cc:3245
#5 0x55eee79ffab0 in row_search_mvcc(unsigned char, page_cur_mode_t, row_prebuilt_t, unsigned long, unsigned long) /data/src/10.2/storage/innobase/row/row0sel.cc:5623
#6 0x55eee76c893c in ha_innobase::index_read(unsigned char, unsigned char const, unsigned int, ha_rkey_function) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9392
#7 0x55eee76cbce2 in ha_innobase::index_first(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9769
#8 0x55eee76cc3b9 in ha_innobase::rnd_next(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9862
#9 0x55eee719904a in handler::ha_rnd_next(unsigned char*) /data/src/10.2/sql/handler.cc:2669
#10 0x55eee7546947 in rr_sequential(READ_RECORD*) /data/src/10.2/sql/records.cc:492
#11 0x55eee6c7a633 in join_init_read_record(st_join_table*) /data/src/10.2/sql/sql_select.cc:19785
#12 0x55eee6c73b08 in sub_select(JOIN, st_join_table, bool) /data/src/10.2/sql/sql_select.cc:18856
#13 0x55eee6c71dad in do_select /data/src/10.2/sql/sql_select.cc:18403
#14 0x55eee6c0bf40 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3642
#15 0x55eee6c09a57 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3437
#16 0x55eee6c0d25f in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.2/sql/sql_select.cc:3837
#17 0x55eee6be9d01 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
#18 0x55eee6b60bec in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6248
#19 0x55eee6b4db91 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3559
#20 0x55eee6b6a169 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
#21 0x55eee6b431ae in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
#22 0x55eee6b3ff6d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
#23 0x55eee6ec8924 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
#24 0x55eee6ec81e7 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
#25 0x55eee8264aab in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
#26 0x7fc023d07608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

Thread T27 created by T0 here:
#0 0x7fc02419b805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
#1 0x55eee8264e9c in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
#2 0x55eee68e5083 in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
#3 0x55eee68fcc54 in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6573
#4 0x55eee68fd3ef in create_new_thread /data/src/10.2/sql/mysqld.cc:6643
#5 0x55eee68fe581 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6901
#6 0x55eee68fbfa5 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6192
#7 0x55eee68e393c in main /data/src/10.2/sql/main.cc:25
#8 0x7fc0237e60b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free (/lib/x86_64-linux-gnu/libasan.so.5+0x9b57c)
Shadow bytes around the buggy address:
0x0c5280020000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280020010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280020020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280020030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280020040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c5280020050: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5280020060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5280020070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5280020080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5280020090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c52800200a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==4128049==ABORTING

Reproducible on all of 5.5-10.6.
Couldn't reproduce with MyISAM.
No obvious immediate problem on a non-ASAN build.

Other variations of stack traces observed on intermediate versions of the test case:

10.4 901bcde2
==4128679==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290003702e7 at pc 0x55d62f7b0664 bp 0x7f70ae49f970 sp 0x7f70ae49f960
WRITE of size 1 at 0x6290003702e7 thread T30
#0 0x55d62f7b0663 in fmt_number /data/src/10.4/sql-common/my_time.c:1470
#1 0x55d62f7b1007 in my_date_to_str /data/src/10.4/sql-common/my_time.c:1553
#2 0x55d62f7b1515 in my_TIME_to_str /data/src/10.4/sql-common/my_time.c:1600
#3 0x55d62e5a1674 in Item_dyncol_get::val_str(String*) /data/src/10.4/sql/item_strfunc.cc:5002
#4 0x55d62e649e49 in Item_char_typecast::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:2337
#5 0x55d62e459890 in Arg_comparator::compare_string() /data/src/10.4/sql/item_cmpfunc.cc:766
#6 0x55d62e49d6e9 in Arg_comparator::compare() /data/src/10.4/sql/item_cmpfunc.h:104
#7 0x55d62e465b88 in Item_func_eq::val_int() /data/src/10.4/sql/item_cmpfunc.cc:1770
#8 0x55d62e0ec427 in Type_handler_int_result::Item_val_bool(Item*) const /data/src/10.4/sql/sql_type.cc:4514
#9 0x55d62d8e270b in Item::val_bool() /data/src/10.4/sql/item.h:1465
#10 0x55d62e487cd1 in Item_cond_and::val_int() /data/src/10.4/sql/item_cmpfunc.cc:5299
#11 0x55d62de74d2e in SQL_SELECT::skip_record(THD*) /data/src/10.4/sql/opt_range.h:1665
#12 0x55d62e818388 in record_should_be_deleted /data/src/10.4/sql/sql_delete.cc:232
#13 0x55d62e81d135 in mysql_delete(THD, TABLE_LIST, Item, SQL_I_List<st_order>, unsigned long long, unsigned long long, select_result*) /data/src/10.4/sql/sql_delete.cc:787
#14 0x55d62db9e1cf in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4770
#15 0x55d62dbb4442 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7958
#16 0x55d62db8b033 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1855
#17 0x55d62db87ae2 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1373
#18 0x55d62df79f3d in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412
#19 0x55d62df797e1 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316
#20 0x55d62f633c3a in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
#21 0x7f70c56a8608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
#22 0x7f70c4f11292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x6290003702e7 is located 231 bytes inside of 16512-byte region [0x629000370200,0x629000374280)
freed by thread T30 here:
#0 0x7f70c589e7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
#1 0x55d62eb62dca in mem_heap_block_free(mem_block_info_t, mem_block_info_t) /data/src/10.4/storage/innobase/mem/mem0mem.cc:416
#2 0x55d62ecc7ab7 in mem_heap_free /data/src/10.4/storage/innobase/include/mem0mem.ic:417
#3 0x55d62eccf5a1 in row_mysql_prebuilt_free_blob_heap(row_prebuilt_t*) /data/src/10.4/storage/innobase/row/row0mysql.cc:162
#4 0x55d62ed5bc74 in row_sel_store_mysql_rec /data/src/10.4/storage/innobase/row/row0sel.cc:3029
#5 0x55d62ed6be73 in row_search_mvcc(unsigned char, page_cur_mode_t, row_prebuilt_t, unsigned long, unsigned long) /data/src/10.4/storage/innobase/row/row0sel.cc:5533
#6 0x55d62e977e92 in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9510
#7 0x55d62e97871d in ha_innobase::index_next(unsigned char*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9578
#8 0x55d62e3abb3e in handler::ha_index_next(unsigned char*) /data/src/10.4/sql/handler.cc:2972
#9 0x55d62e7d107c in rr_index /data/src/10.4/sql/records.cc:450
#10 0x55d62d9e68eb in READ_RECORD::read_record() /data/src/10.4/sql/records.h:70
#11 0x55d62e81cfd8 in mysql_delete(THD, TABLE_LIST, Item, SQL_I_List<st_order>, unsigned long long, unsigned long long, select_result*) /data/src/10.4/sql/sql_delete.cc:783
#12 0x55d62db9e1cf in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4770
#13 0x55d62dbb4442 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7958
#14 0x55d62db8b033 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1855
#15 0x55d62db87ae2 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1373
#16 0x55d62df79f3d in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412
#17 0x55d62df797e1 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316
#18 0x55d62f633c3a in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
#19 0x7f70c56a8608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

previously allocated by thread T30 here:
#0 0x7f70c589ebc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x55d62eb621c7 in mem_heap_create_block_func(mem_block_info_t, unsigned long, char const, unsigned int, unsigned long) /data/src/10.4/storage/innobase/mem/mem0mem.cc:277
#2 0x55d62ed44b41 in mem_heap_create_func /data/src/10.4/storage/innobase/include/mem0mem.ic:375
#3 0x55d62ed5b527 in row_sel_store_mysql_field /data/src/10.4/storage/innobase/row/row0sel.cc:2970
#4 0x55d62ed5c92d in row_sel_store_mysql_rec /data/src/10.4/storage/innobase/row/row0sel.cc:3117
#5 0x55d62ed6be73 in row_search_mvcc(unsigned char, page_cur_mode_t, row_prebuilt_t, unsigned long, unsigned long) /data/src/10.4/storage/innobase/row/row0sel.cc:5533
#6 0x55d62e977e92 in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9510
#7 0x55d62e97871d in ha_innobase::index_next(unsigned char*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9578
#8 0x55d62e3abb3e in handler::ha_index_next(unsigned char*) /data/src/10.4/sql/handler.cc:2972
#9 0x55d62e7d107c in rr_index /data/src/10.4/sql/records.cc:450
#10 0x55d62d9e68eb in READ_RECORD::read_record() /data/src/10.4/sql/records.h:70
#11 0x55d62e81cfd8 in mysql_delete(THD, TABLE_LIST, Item, SQL_I_List<st_order>, unsigned long long, unsigned long long, select_result*) /data/src/10.4/sql/sql_delete.cc:783
#12 0x55d62db9e1cf in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4770
#13 0x55d62dbb4442 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7958
#14 0x55d62db8b033 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1855
#15 0x55d62db87ae2 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1373
#16 0x55d62df79f3d in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412
#17 0x55d62df797e1 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316
#18 0x55d62f633c3a in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
#19 0x7f70c56a8608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

Thread T30 created by T0 here:
#0 0x7f70c57cb805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
#1 0x55d62f63402b in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1919
#2 0x55d62d890c78 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1275
#3 0x55d62d8a8851 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6259
#4 0x55d62d8a8fec in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6329
#5 0x55d62d8a94d2 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6427
#6 0x55d62d8aa36b in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6585
#7 0x55d62d8a7f56 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5917
#8 0x55d62d88ebec in main /data/src/10.4/sql/main.cc:25
#9 0x7f70c4e160b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.4/sql-common/my_time.c:1470 in fmt_number
Shadow bytes around the buggy address:
0x0c5280066000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280066010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280066020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280066030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280066040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c5280066050: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
0x0c5280066060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5280066070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5280066080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5280066090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c52800660a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==4128679==ABORTING

Attachments

Activity

Elena Stepanova added a comment - 2023-10-20 18:52

Different data types, fails on the 2nd execution of PS with a bit different stack trace

CREATE TABLE t (f TEXT);

INSERT INTO t VALUES (COLUMN_CREATE(2,10 AS DOUBLE)), (COLUMN_CREATE(2,REPEAT('x',256)));

PREPARE stmt FROM 'SELECT COLUMN_GET(f, 2 AS CHAR) = "foo" FROM t';

EXECUTE stmt;

EXECUTE stmt;

10.4 b1c8ea83
==1974123==ERROR: AddressSanitizer: heap-use-after-free on address 0x613000050dac at pc 0x7f3e5ac48061 bp 0x7f3e527c54a0 sp 0x7f3e527c4c50
WRITE of size 2 at 0x613000050dac thread T5
#0 0x7f3e5ac48060 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827
#1 0x55d83d88a31f in Binary_string::copy(char const*, unsigned long) /data/src/10.4/sql/sql_string.cc:272
#2 0x55d83d379cd9 in String::copy(char const, unsigned long, charset_info_st const) /data/src/10.4/sql/sql_string.h:931
#3 0x55d83d88add7 in String::copy(char const, unsigned long, charset_info_st const, charset_info_st const, unsigned int) /data/src/10.4/sql/sql_string.cc:457
#4 0x55d83d889d4f in String::set_real(double, unsigned int, charset_info_st const*) /data/src/10.4/sql/sql_string.cc:218
#5 0x55d83e00a59b in Item_dyncol_get::val_str(String*) /data/src/10.4/sql/item_strfunc.cc:4980
#6 0x55d83e0b2262 in Item_char_typecast::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:2347
#7 0x55d83dec27f0 in Arg_comparator::compare_string() /data/src/10.4/sql/item_cmpfunc.cc:777
#8 0x55d83df060bf in Arg_comparator::compare() /data/src/10.4/sql/item_cmpfunc.h:104
#9 0x55d83deceeb5 in Item_func_eq::val_int() /data/src/10.4/sql/item_cmpfunc.cc:1790
#10 0x55d83dbd0f6f in Type_handler::Item_send_long(Item, Protocol, st_value*) const /data/src/10.4/sql/sql_type.cc:7106
#11 0x55d83dbea49f in Type_handler_long::Item_send(Item, Protocol, st_value*) const (/mnt8t/bld/10.4-asan/bin/mysqld+0x18ba49f)
#12 0x55d83d3a490f in Item::send(Protocol, st_value) /data/src/10.4/sql/item.h:1044
#13 0x55d83d3969ac in Protocol::send_result_set_row(List<Item>*) /data/src/10.4/sql/protocol.cc:1038
#14 0x55d83d5419d0 in select_send::send_data(List<Item>&) /data/src/10.4/sql/sql_class.cc:3138
#15 0x55d83d7a91e7 in end_send /data/src/10.4/sql/sql_select.cc:22098
#16 0x55d83d7a165d in evaluate_join_record /data/src/10.4/sql/sql_select.cc:21129
#17 0x55d83d79ff99 in sub_select(JOIN, st_join_table, bool) /data/src/10.4/sql/sql_select.cc:20902
#18 0x55d83d79dd9d in do_select /data/src/10.4/sql/sql_select.cc:20423
#19 0x55d83d72cc18 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4605
#20 0x55d83d72a223 in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4387
#21 0x55d83d72e2b1 in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.4/sql/sql_select.cc:4826
#22 0x55d83d6fee16 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:442
#23 0x55d83d66e338 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6475
#24 0x55d83d65b84d in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3978
#25 0x55d83d6cb6fc in Prepared_statement::execute(String*, bool) /data/src/10.4/sql/sql_prepare.cc:5068
#26 0x55d83d6c6d3c in Prepared_statement::execute_loop(String, bool, unsigned char, unsigned char*) /data/src/10.4/sql/sql_prepare.cc:4515
#27 0x55d83d6c0bae in mysql_sql_stmt_execute(THD*) /data/src/10.4/sql/sql_prepare.cc:3587
#28 0x55d83d65b892 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3994
#29 0x55d83d677588 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8012
#30 0x55d83d64d817 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857
#31 0x55d83d64a386 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378
#32 0x55d83da49dd3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420
#33 0x55d83da496ea in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324
#34 0x55d83e6bb2f7 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
#35 0x7f3e5a5c8fd3 in start_thread nptl/pthread_create.c:442
#36 0x7f3e5a6495bb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x613000050dac is located 44 bytes inside of 384-byte region [0x613000050d80,0x613000050f00)
freed by thread T5 here:
#0 0x7f3e5acb78d5 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:85
#1 0x55d83f205565 in my_realloc /data/src/10.4/mysys/my_malloc.c:165
#2 0x55d83f0ee4fc in mi_alloc_rec_buff /data/src/10.4/storage/myisam/mi_open.c:762
#3 0x55d83f0d2803 in mi_reset /data/src/10.4/storage/myisam/mi_extra.c:476
#4 0x55d83f072673 in ha_myisam::reset() /data/src/10.4/storage/myisam/ha_myisam.cc:2177
#5 0x55d83de2df69 in handler::ha_reset() /data/src/10.4/sql/handler.cc:6621
#6 0x55d83d4c3322 in close_thread_table(THD, TABLE*) /data/src/10.4/sql/sql_base.cc:1086
#7 0x55d83d4c29ac in close_thread_tables(THD*) /data/src/10.4/sql/sql_base.cc:1035
#8 0x55d83d66c513 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:6283
#9 0x55d83d6cb6fc in Prepared_statement::execute(String*, bool) /data/src/10.4/sql/sql_prepare.cc:5068
#10 0x55d83d6c6d3c in Prepared_statement::execute_loop(String, bool, unsigned char, unsigned char*) /data/src/10.4/sql/sql_prepare.cc:4515
#11 0x55d83d6c0bae in mysql_sql_stmt_execute(THD*) /data/src/10.4/sql/sql_prepare.cc:3587
#12 0x55d83d65b892 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3994
#13 0x55d83d677588 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8012
#14 0x55d83d64d817 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857
#15 0x55d83d64a386 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378
#16 0x55d83da49dd3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420
#17 0x55d83da496ea in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324
#18 0x55d83e6bb2f7 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
#19 0x7f3e5a5c8fd3 in start_thread nptl/pthread_create.c:442

previously allocated by thread T5 here:
#0 0x7f3e5acb78d5 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:85
#1 0x55d83f205565 in my_realloc /data/src/10.4/mysys/my_malloc.c:165
#2 0x55d83f0ee4fc in mi_alloc_rec_buff /data/src/10.4/storage/myisam/mi_open.c:762
#3 0x55d83f0cadfe in _mi_read_rnd_dynamic_record /data/src/10.4/storage/myisam/mi_dynrec.c:1811
#4 0x55d83f117109 in mi_scan /data/src/10.4/storage/myisam/mi_scan.c:45
#5 0x55d83f071332 in ha_myisam::rnd_next(unsigned char*) /data/src/10.4/storage/myisam/ha_myisam.cc:2071
#6 0x55d83de0fd5c in handler::ha_rnd_next(unsigned char*) /data/src/10.4/sql/handler.cc:2904
#7 0x55d83e235151 in rr_sequential(READ_RECORD*) /data/src/10.4/sql/records.cc:485
#8 0x55d83d4ab177 in READ_RECORD::read_record() /data/src/10.4/sql/records.h:70
#9 0x55d83d7a01cf in sub_select(JOIN, st_join_table, bool) /data/src/10.4/sql/sql_select.cc:20921
#10 0x55d83d79dd9d in do_select /data/src/10.4/sql/sql_select.cc:20423
#11 0x55d83d72cc18 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4605
#12 0x55d83d72a223 in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4387
#13 0x55d83d72e2b1 in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.4/sql/sql_select.cc:4826
#14 0x55d83d6fee16 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:442
#15 0x55d83d66e338 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6475
#16 0x55d83d65b84d in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3978
#17 0x55d83d6cb6fc in Prepared_statement::execute(String*, bool) /data/src/10.4/sql/sql_prepare.cc:5068
#18 0x55d83d6c6d3c in Prepared_statement::execute_loop(String, bool, unsigned char, unsigned char*) /data/src/10.4/sql/sql_prepare.cc:4515
#19 0x55d83d6c0bae in mysql_sql_stmt_execute(THD*) /data/src/10.4/sql/sql_prepare.cc:3587
#20 0x55d83d65b892 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3994
#21 0x55d83d677588 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8012
#22 0x55d83d64d817 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857
#23 0x55d83d64a386 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378
#24 0x55d83da49dd3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420
#25 0x55d83da496ea in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324
#26 0x55d83e6bb2f7 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
#27 0x7f3e5a5c8fd3 in start_thread nptl/pthread_create.c:442

Thread T5 created by T0 here:
#0 0x7f3e5ac49726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
#1 0x55d83e6bb6e4 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1919
#2 0x55d83d354f89 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1275
#3 0x55d83d36c6b6 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6289
#4 0x55d83d36ce01 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6359
#5 0x55d83d36d2cf in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6457
#6 0x55d83d36e17b in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6615
#7 0x55d83d36be19 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5947
#8 0x55d83d3530b8 in main /data/src/10.4/sql/main.cc:25
#9 0x7f3e5a567189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 in __interceptor_memcpy
Shadow bytes around the buggy address:
0x0c2680002160: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
0x0c2680002170: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c2680002180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2680002190: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c26800021a0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
=>0x0c26800021b0: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
0x0c26800021c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c26800021d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c26800021e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c26800021f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2680002200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1974123==ABORTING

Elena Stepanova added a comment - 2023-10-20 18:52 Different data types, fails on the 2nd execution of PS with a bit different stack trace CREATE TABLE t (f TEXT); INSERT INTO t VALUES (COLUMN_CREATE(2,10 AS DOUBLE )), (COLUMN_CREATE(2,REPEAT( 'x' ,256))); PREPARE stmt FROM 'SELECT COLUMN_GET(f, 2 AS CHAR) = "foo" FROM t' ; EXECUTE stmt; EXECUTE stmt; 10.4 b1c8ea83 ==1974123==ERROR: AddressSanitizer: heap-use-after-free on address 0x613000050dac at pc 0x7f3e5ac48061 bp 0x7f3e527c54a0 sp 0x7f3e527c4c50 WRITE of size 2 at 0x613000050dac thread T5 #0 0x7f3e5ac48060 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 #1 0x55d83d88a31f in Binary_string::copy(char const*, unsigned long) /data/src/10.4/sql/sql_string.cc:272 #2 0x55d83d379cd9 in String::copy(char const*, unsigned long, charset_info_st const*) /data/src/10.4/sql/sql_string.h:931 #3 0x55d83d88add7 in String::copy(char const*, unsigned long, charset_info_st const*, charset_info_st const*, unsigned int*) /data/src/10.4/sql/sql_string.cc:457 #4 0x55d83d889d4f in String::set_real(double, unsigned int, charset_info_st const*) /data/src/10.4/sql/sql_string.cc:218 #5 0x55d83e00a59b in Item_dyncol_get::val_str(String*) /data/src/10.4/sql/item_strfunc.cc:4980 #6 0x55d83e0b2262 in Item_char_typecast::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:2347 #7 0x55d83dec27f0 in Arg_comparator::compare_string() /data/src/10.4/sql/item_cmpfunc.cc:777 #8 0x55d83df060bf in Arg_comparator::compare() /data/src/10.4/sql/item_cmpfunc.h:104 #9 0x55d83deceeb5 in Item_func_eq::val_int() /data/src/10.4/sql/item_cmpfunc.cc:1790 #10 0x55d83dbd0f6f in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /data/src/10.4/sql/sql_type.cc:7106 #11 0x55d83dbea49f in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const (/mnt8t/bld/10.4-asan/bin/mysqld+0x18ba49f) #12 0x55d83d3a490f in Item::send(Protocol*, st_value*) /data/src/10.4/sql/item.h:1044 #13 0x55d83d3969ac in Protocol::send_result_set_row(List<Item>*) /data/src/10.4/sql/protocol.cc:1038 #14 0x55d83d5419d0 in select_send::send_data(List<Item>&) /data/src/10.4/sql/sql_class.cc:3138 #15 0x55d83d7a91e7 in end_send /data/src/10.4/sql/sql_select.cc:22098 #16 0x55d83d7a165d in evaluate_join_record /data/src/10.4/sql/sql_select.cc:21129 #17 0x55d83d79ff99 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:20902 #18 0x55d83d79dd9d in do_select /data/src/10.4/sql/sql_select.cc:20423 #19 0x55d83d72cc18 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4605 #20 0x55d83d72a223 in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4387 #21 0x55d83d72e2b1 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4826 #22 0x55d83d6fee16 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:442 #23 0x55d83d66e338 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6475 #24 0x55d83d65b84d in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3978 #25 0x55d83d6cb6fc in Prepared_statement::execute(String*, bool) /data/src/10.4/sql/sql_prepare.cc:5068 #26 0x55d83d6c6d3c in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/src/10.4/sql/sql_prepare.cc:4515 #27 0x55d83d6c0bae in mysql_sql_stmt_execute(THD*) /data/src/10.4/sql/sql_prepare.cc:3587 #28 0x55d83d65b892 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3994 #29 0x55d83d677588 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8012 #30 0x55d83d64d817 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857 #31 0x55d83d64a386 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378 #32 0x55d83da49dd3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420 #33 0x55d83da496ea in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324 #34 0x55d83e6bb2f7 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869 #35 0x7f3e5a5c8fd3 in start_thread nptl/pthread_create.c:442 #36 0x7f3e5a6495bb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 0x613000050dac is located 44 bytes inside of 384-byte region [0x613000050d80,0x613000050f00) freed by thread T5 here: #0 0x7f3e5acb78d5 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:85 #1 0x55d83f205565 in my_realloc /data/src/10.4/mysys/my_malloc.c:165 #2 0x55d83f0ee4fc in mi_alloc_rec_buff /data/src/10.4/storage/myisam/mi_open.c:762 #3 0x55d83f0d2803 in mi_reset /data/src/10.4/storage/myisam/mi_extra.c:476 #4 0x55d83f072673 in ha_myisam::reset() /data/src/10.4/storage/myisam/ha_myisam.cc:2177 #5 0x55d83de2df69 in handler::ha_reset() /data/src/10.4/sql/handler.cc:6621 #6 0x55d83d4c3322 in close_thread_table(THD*, TABLE**) /data/src/10.4/sql/sql_base.cc:1086 #7 0x55d83d4c29ac in close_thread_tables(THD*) /data/src/10.4/sql/sql_base.cc:1035 #8 0x55d83d66c513 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:6283 #9 0x55d83d6cb6fc in Prepared_statement::execute(String*, bool) /data/src/10.4/sql/sql_prepare.cc:5068 #10 0x55d83d6c6d3c in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/src/10.4/sql/sql_prepare.cc:4515 #11 0x55d83d6c0bae in mysql_sql_stmt_execute(THD*) /data/src/10.4/sql/sql_prepare.cc:3587 #12 0x55d83d65b892 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3994 #13 0x55d83d677588 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8012 #14 0x55d83d64d817 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857 #15 0x55d83d64a386 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378 #16 0x55d83da49dd3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420 #17 0x55d83da496ea in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324 #18 0x55d83e6bb2f7 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869 #19 0x7f3e5a5c8fd3 in start_thread nptl/pthread_create.c:442 previously allocated by thread T5 here: #0 0x7f3e5acb78d5 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:85 #1 0x55d83f205565 in my_realloc /data/src/10.4/mysys/my_malloc.c:165 #2 0x55d83f0ee4fc in mi_alloc_rec_buff /data/src/10.4/storage/myisam/mi_open.c:762 #3 0x55d83f0cadfe in _mi_read_rnd_dynamic_record /data/src/10.4/storage/myisam/mi_dynrec.c:1811 #4 0x55d83f117109 in mi_scan /data/src/10.4/storage/myisam/mi_scan.c:45 #5 0x55d83f071332 in ha_myisam::rnd_next(unsigned char*) /data/src/10.4/storage/myisam/ha_myisam.cc:2071 #6 0x55d83de0fd5c in handler::ha_rnd_next(unsigned char*) /data/src/10.4/sql/handler.cc:2904 #7 0x55d83e235151 in rr_sequential(READ_RECORD*) /data/src/10.4/sql/records.cc:485 #8 0x55d83d4ab177 in READ_RECORD::read_record() /data/src/10.4/sql/records.h:70 #9 0x55d83d7a01cf in sub_select(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:20921 #10 0x55d83d79dd9d in do_select /data/src/10.4/sql/sql_select.cc:20423 #11 0x55d83d72cc18 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4605 #12 0x55d83d72a223 in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4387 #13 0x55d83d72e2b1 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4826 #14 0x55d83d6fee16 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:442 #15 0x55d83d66e338 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6475 #16 0x55d83d65b84d in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3978 #17 0x55d83d6cb6fc in Prepared_statement::execute(String*, bool) /data/src/10.4/sql/sql_prepare.cc:5068 #18 0x55d83d6c6d3c in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/src/10.4/sql/sql_prepare.cc:4515 #19 0x55d83d6c0bae in mysql_sql_stmt_execute(THD*) /data/src/10.4/sql/sql_prepare.cc:3587 #20 0x55d83d65b892 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3994 #21 0x55d83d677588 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8012 #22 0x55d83d64d817 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857 #23 0x55d83d64a386 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378 #24 0x55d83da49dd3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420 #25 0x55d83da496ea in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324 #26 0x55d83e6bb2f7 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869 #27 0x7f3e5a5c8fd3 in start_thread nptl/pthread_create.c:442 Thread T5 created by T0 here: #0 0x7f3e5ac49726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207 #1 0x55d83e6bb6e4 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1919 #2 0x55d83d354f89 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1275 #3 0x55d83d36c6b6 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6289 #4 0x55d83d36ce01 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6359 #5 0x55d83d36d2cf in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6457 #6 0x55d83d36e17b in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6615 #7 0x55d83d36be19 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5947 #8 0x55d83d3530b8 in main /data/src/10.4/sql/main.cc:25 #9 0x7f3e5a567189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 SUMMARY: AddressSanitizer: heap-use-after-free ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 in __interceptor_memcpy Shadow bytes around the buggy address: 0x0c2680002160: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa 0x0c2680002170: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c2680002180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2680002190: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c26800021a0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa =>0x0c26800021b0: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd 0x0c26800021c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c26800021d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c26800021e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c26800021f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2680002200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1974123==ABORTING

People

Assignee:: Oleksandr Byelkin

Reporter:: Elena Stepanova

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2021-02-21 13:17

Updated:: 2024-09-10 15:04

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server