[MDEV-25638] Assertion `!result' failed in convert_const_to_int - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Blocker
Resolution: Fixed
Affects Version/s: 10.5.9, 10.2(EOL), 10.3(EOL), 10.4(EOL), 10.5, 10.6, 10.7(EOL)
Fix Version/s: 10.2.44, 10.3.35, 10.4.25, 10.5.16, 10.6.8, 10.7.4
Component/s: Data Definition - Create Table, Debug
Labels:
- crash
Environment:
Ubuntu 18.04
MariaDB 10.5.9

Description

I used my fuzzing tool to test Mariadb , and found a bug that can result in an heap-use-after-free (reported by ASAN).

Mariadb installation：
1) cd mariadb-10.5.9
2) mkdir build; cd build
3) cmake -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_DEBUG=ON ../
4) make -j8 && sudo make install

How to Repeat:
export ASAN_OPTIONS=detect_leaks=0
/usr/local/mysql/bin/mysqld_safe &
/usr/local/mysql/bin/mysql -uroot -p123456(your password)
MariaDB> drop database if exists test_db;
MariaDB> create database test_db;
MariaDB> source fuzz.sql;

I have simplified the content of fuzz.sql, and I hope fuzz.sql can help you reproduce the bug and fix it. In addition, I attach the ASAN report.

Attachments

- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

asan_report.txt
12 kB
2021-05-10 09:42
fuzz.sql
0.1 kB
2021-05-10 09:41

Issue Links

blocks

MDEV-24176 Server crashes after insert in the table with virtual column generated using date_format() and if()

Closed

is duplicated by

MDEV-26120 MariaDB server crash at base_ilist::append

Closed

MDEV-26355 heap-use-after-free issue of MariaDB / convert_const_to_int assertion

Closed

MDEV-26413 heap-use-after-free in Parser

Closed

MDEV-26421 use-after-free issue of MariaDB server

Closed

relates to

MDEV-22754 Assertion `!result' failed in convert_const_to_int upon using SEQUENCE in subquery

Confirmed

MDEV-23800 Assertion `!result' failed in convert_const_to_int on SELECT NULL and using subquery

Confirmed

MDEV-21866 Assertion `!result' failed in convert_const_to_int upon 2nd execution of PS

Closed

links to

CVE-2021-46669

(3 relates to, 1 links to)

Activity

Ascending order - Click to sort in descending order

Zuming Jiang created issue - 2021-05-10 09:42

Zuming Jiang made changes - 2021-05-10 09:42

Field	Original Value	New Value
Summary	Bug report: abortion in sql/sql_class.cc:2914	Bug report: heap-use-after-free in sql/sql_class.cc:2914

Zuming Jiang made changes - 2021-05-10 09:43

Description

I used my fuzzing tool to test Mariadb , and found a bug that can result in an use-after-free (reported by ASAN).

*Mariadb installation：*
1) cd mariadb-10.5.9
2) mkdir build; cd build
3) cmake -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_DEBUG=ON ../
4) make -j8 && sudo make install

*How to Repeat:*
export ASAN_OPTIONS=detect_leaks=0
/usr/local/mysql/bin/mysqld_safe &
/usr/local/mysql/bin/mysql -uroot -p123456(your password)
MariaDB> drop database if exists test_db;
MariaDB> create database test_db;
MariaDB> source fuzz.sql;

I have simplified the content of fuzz.sql, and I hope fuzz.sql can help you reproduce the bug and fix it. In addition, I attach the ASAN report.

I used my fuzzing tool to test Mariadb , and found a bug that can result in an heap-use-after-free (reported by ASAN).

*Mariadb installation：*
1) cd mariadb-10.5.9
2) mkdir build; cd build
3) cmake -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_DEBUG=ON ../
4) make -j8 && sudo make install

*How to Repeat:*
export ASAN_OPTIONS=detect_leaks=0
/usr/local/mysql/bin/mysqld_safe &
/usr/local/mysql/bin/mysql -uroot -p123456(your password)
MariaDB> drop database if exists test_db;
MariaDB> create database test_db;
MariaDB> source fuzz.sql;

I have simplified the content of fuzz.sql, and I hope fuzz.sql can help you reproduce the bug and fix it. In addition, I attach the ASAN report.

Alice Sherepa made changes - 2021-05-10 10:40

Link

This issue relates to MDEV-23800 [ MDEV-23800 ]

Alice Sherepa made changes - 2021-05-10 10:40

Link

This issue relates to MDEV-22754 [ MDEV-22754 ]

Alice Sherepa made changes - 2021-05-10 10:50

Affects Version/s		10.2 [ 14601 ]
Affects Version/s		10.3 [ 22126 ]
Affects Version/s		10.4 [ 22408 ]
Affects Version/s		10.5 [ 23123 ]

Alice Sherepa made changes - 2021-05-10 10:50

Fix Version/s		10.2 [ 14601 ]
Fix Version/s		10.3 [ 22126 ]
Fix Version/s		10.4 [ 22408 ]
Fix Version/s		10.5 [ 23123 ]

Alice Sherepa made changes - 2021-05-10 10:51

Assignee

Sergei Petrunia [ psergey ]

Alice Sherepa made changes - 2021-05-10 10:51

Status

Open [ 1 ]

Confirmed [ 10101 ]

Sergei Golubchik made changes - 2021-05-14 11:52

Component/s		Data Definition - Create Table [ 14503 ]
Component/s	Query Cache [ 10120 ]

Sergei Golubchik made changes - 2021-05-14 11:52

Assignee

Sergei Petrunia [ psergey ]

Oleksandr Byelkin [ sanja ]

Sergei Golubchik made changes - 2021-05-14 11:52

Epic/Theme

server

Sergei Golubchik made changes - 2021-05-14 11:52

Priority

Critical [ 2 ]

Major [ 3 ]

Alice Sherepa made changes - 2021-07-12 07:40

Link

This issue is duplicated by ~~MDEV-26120~~ [ ~~MDEV-26120~~ ]

Alice Sherepa made changes - 2021-08-26 15:50

Link

This issue is duplicated by ~~MDEV-26421~~ [ ~~MDEV-26421~~ ]

Alice Sherepa made changes - 2021-08-26 15:51

Summary

Bug report: heap-use-after-free in sql/sql_class.cc:2914

Assertion `!result' failed in convert_const_to_int

Alice Sherepa made changes - 2021-08-26 15:51

Affects Version/s

10.6 [ 24028 ]

Alice Sherepa made changes - 2021-08-26 15:51

Fix Version/s

10.6 [ 24028 ]

Alice Sherepa made changes - 2021-08-26 15:55

Link

This issue relates to ~~MDEV-21866~~ [ ~~MDEV-21866~~ ]

Alice Sherepa made changes - 2021-08-27 12:14

Link

This issue is duplicated by ~~MDEV-26413~~ [ ~~MDEV-26413~~ ]

Alice Sherepa made changes - 2021-08-27 13:24

Link

This issue is duplicated by ~~MDEV-26355~~ [ ~~MDEV-26355~~ ]

Sergei Golubchik made changes - 2021-12-06 21:36

Workflow

MariaDB v3 [ 121717 ]

MariaDB v4 [ 144360 ]

Alice Sherepa made changes - 2022-01-25 16:39

Affects Version/s

10.7 [ 24805 ]

Alice Sherepa made changes - 2022-01-25 16:39

Fix Version/s

10.7 [ 24805 ]

Sergei Golubchik made changes - 2022-02-09 19:21

Remote Link

This issue links to "CVE-2021-46669 (Web Link)" [ 33009 ]

Sergei Golubchik made changes - 2022-02-09 19:57

Priority

Major [ 3 ]

Blocker [ 1 ]

Sergei Golubchik made changes - 2022-02-10 12:46

Component/s

Debug [ 14208 ]

Oleksandr Byelkin made changes - 2022-03-18 14:05

Status

Confirmed [ 10101 ]

In Progress [ 3 ]

Oleksandr Byelkin made changes - 2022-04-06 07:45

Assignee	Oleksandr Byelkin [ sanja ]	Dmitry Shulga [ JIRAUSER47315 ]
Status	In Progress [ 3 ]	In Review [ 10002 ]

Oleksandr Byelkin made changes - 2022-04-06 14:23

Assignee

Dmitry Shulga [ JIRAUSER47315 ]

Oleksandr Byelkin [ sanja ]

Oleksandr Byelkin made changes - 2022-04-06 14:23

Status

In Review [ 10002 ]

Stalled [ 10000 ]

Oleksandr Byelkin made changes - 2022-04-06 14:23

Status

Stalled [ 10000 ]

In Progress [ 3 ]

Sergei Golubchik made changes - 2022-04-13 17:11

Link

This issue blocks ~~MDEV-24176~~ [ ~~MDEV-24176~~ ]

Sergei Golubchik made changes - 2022-04-14 13:27

Assignee

Oleksandr Byelkin [ sanja ]

Sergei Golubchik [ serg ]

Sergei Golubchik made changes - 2022-04-14 19:55

Status

In Progress [ 3 ]

In Testing [ 10301 ]

Sergei Golubchik made changes - 2022-04-15 07:52

Fix Version/s		10.2.44 [ 27514 ]
Fix Version/s		10.3.35 [ 27512 ]
Fix Version/s		10.4.25 [ 27510 ]
Fix Version/s		10.5.16 [ 27508 ]
Fix Version/s		10.6.8 [ 27506 ]
Fix Version/s		10.7.4 [ 27504 ]
Fix Version/s	10.2 [ 14601 ]
Fix Version/s	10.3 [ 22126 ]
Fix Version/s	10.4 [ 22408 ]
Fix Version/s	10.5 [ 23123 ]
Fix Version/s	10.6 [ 24028 ]
Fix Version/s	10.7 [ 24805 ]
Resolution		Fixed [ 1 ]
Status	In Testing [ 10301 ]	Closed [ 6 ]

People

Assignee:: Sergei Golubchik

Reporter:: Zuming Jiang

Votes:: 0 Vote for this issue

Watchers:: 6 Start watching this issue

Dates

Created:: 2021-05-10 09:42

Updated:: 2022-04-15 14:49

Resolved:: 2022-04-15 07:52

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server

Details

Description

Attachments

Attachments

Issue Links

Activity

People

Dates

Git Integration