Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-25781

ASAN/Valgrind errors in SHA1_Update upon combinations of functions with value truncation in the middle

    XMLWordPrintable

    Details

      Description

      CREATE TABLE t1 (a SET('1','2'), b INT);
      INSERT INTO t1 VALUES ('',1001),('',10001);
       
      SELECT SHA1(GREATEST(CAST(b AS BINARY(4)), a)) AS f FROM t1 GROUP BY f;
       
      # Cleanup
      DROP TABLE t1;
      

      10.2 d8fa71a0 ASAN

      ==1852044==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f0000147e0 at pc 0x7fdeba8bb480 bp 0x7fdeaf40d1e0 sp 0x7fdeaf40c988
      READ of size 4 at 0x60f0000147e0 thread T5
          #0 0x7fdeba8bb47f  (/lib/x86_64-linux-gnu/libasan.so.5+0x9b47f)
          #1 0x7fdeba497052 in SHA1_Update (/lib/x86_64-linux-gnu/libcrypto.so.1.1+0x1c2052)
          #2 0x555ad4a7ba0d in sha_input /data/src/10.2/mysys_ssl/my_sha.ic:94
          #3 0x555ad4a7bb13 in my_sha1 /data/src/10.2/mysys_ssl/my_sha.ic:137
          #4 0x555ad3ace020 in Item_func_sha::val_str_ascii(String*) /data/src/10.2/sql/item_strfunc.cc:176
          #5 0x555ad3accebd in Item_func::val_str_from_val_str_ascii(String*, String*) /data/src/10.2/sql/item_strfunc.cc:82
          #6 0x555ad3856b59 in Item_str_ascii_func::val_str(String*) /data/src/10.2/sql/item_strfunc.h:94
          #7 0x555ad3989c9c in Item::save_in_field(Field*, bool) /data/src/10.2/sql/item.cc:6397
          #8 0x555ad31e58fa in Item_result_field::save_in_result_field(bool) /data/src/10.2/sql/item.h:2564
          #9 0x555ad3431a76 in copy_funcs(Item**, THD const*) /data/src/10.2/sql/sql_select.cc:23923
          #10 0x555ad34173c4 in end_write /data/src/10.2/sql/sql_select.cc:20278
          #11 0x555ad3448124 in AGGR_OP::put_record(bool) /data/src/10.2/sql/sql_select.cc:26819
          #12 0x555ad34565dc in AGGR_OP::put_record() (/mnt-hd8t/bld/10.2-asan-nightly/bin/mysqld+0xfb85dc)
          #13 0x555ad340b109 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18595
          #14 0x555ad340d82a in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19094
          #15 0x555ad340c82d in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18913
          #16 0x555ad340a285 in do_select /data/src/10.2/sql/sql_select.cc:18418
          #17 0x555ad33a40da in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3651
          #18 0x555ad33a1bf1 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3446
          #19 0x555ad33a5474 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3849
          #20 0x555ad3381e4f in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
          #21 0x555ad32f8cbc in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6271
          #22 0x555ad32e6045 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3582
          #23 0x555ad33021d1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793
          #24 0x555ad32db3d6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
          #25 0x555ad32d81a1 in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
          #26 0x555ad3661ed5 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
          #27 0x555ad3661798 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
          #28 0x555ad4a07c51 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
          #29 0x7fdeba2b3608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
          #30 0x7fdeb9e8f292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
       
      0x60f0000147e0 is located 112 bytes inside of 164-byte region [0x60f000014770,0x60f000014814)
      freed by thread T5 here:
          #0 0x7fdeba92d7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
          #1 0x555ad4b25896 in free_memory /data/src/10.2/mysys/safemalloc.c:279
          #2 0x555ad4b24de2 in sf_free /data/src/10.2/mysys/safemalloc.c:197
          #3 0x555ad4af114e in my_free /data/src/10.2/mysys/my_malloc.c:218
          #4 0x555ad30a18ef in String::free() /data/src/10.2/sql/sql_string.h:351
          #5 0x555ad32a217d in String::operator=(String const&) /data/src/10.2/sql/sql_string.h:422
          #6 0x555ad38ea0d5 in Field_set::val_str(String*, String*) /data/src/10.2/sql/field.cc:9281
          #7 0x555ad396f69c in Item_field::val_str(String*) /data/src/10.2/sql/item.cc:2801
          #8 0x555ad3a6ee2f in Item_func_min_max::val_str(String*) /data/src/10.2/sql/item_func.cc:2960
          #9 0x555ad3acdfd5 in Item_func_sha::val_str_ascii(String*) /data/src/10.2/sql/item_strfunc.cc:171
          #10 0x555ad3accebd in Item_func::val_str_from_val_str_ascii(String*, String*) /data/src/10.2/sql/item_strfunc.cc:82
          #11 0x555ad3856b59 in Item_str_ascii_func::val_str(String*) /data/src/10.2/sql/item_strfunc.h:94
          #12 0x555ad3989c9c in Item::save_in_field(Field*, bool) /data/src/10.2/sql/item.cc:6397
          #13 0x555ad31e58fa in Item_result_field::save_in_result_field(bool) /data/src/10.2/sql/item.h:2564
          #14 0x555ad3431a76 in copy_funcs(Item**, THD const*) /data/src/10.2/sql/sql_select.cc:23923
          #15 0x555ad34173c4 in end_write /data/src/10.2/sql/sql_select.cc:20278
          #16 0x555ad3448124 in AGGR_OP::put_record(bool) /data/src/10.2/sql/sql_select.cc:26819
          #17 0x555ad34565dc in AGGR_OP::put_record() (/mnt-hd8t/bld/10.2-asan-nightly/bin/mysqld+0xfb85dc)
          #18 0x555ad340b109 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18595
          #19 0x555ad340d82a in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19094
          #20 0x555ad340c82d in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18913
          #21 0x555ad340a285 in do_select /data/src/10.2/sql/sql_select.cc:18418
          #22 0x555ad33a40da in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3651
          #23 0x555ad33a1bf1 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3446
          #24 0x555ad33a5474 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3849
          #25 0x555ad3381e4f in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
          #26 0x555ad32f8cbc in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6271
          #27 0x555ad32e6045 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3582
          #28 0x555ad33021d1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793
          #29 0x555ad32db3d6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
       
      previously allocated by thread T5 here:
          #0 0x7fdeba92dbc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
          #1 0x555ad4b24754 in sf_malloc /data/src/10.2/mysys/safemalloc.c:118
          #2 0x555ad4af06dd in my_malloc /data/src/10.2/mysys/my_malloc.c:101
          #3 0x555ad34dcdb4 in String::real_alloc(unsigned long) /data/src/10.2/sql/sql_string.cc:45
          #4 0x555ad30c9cbf in String::alloc(unsigned long) /data/src/10.2/sql/sql_string.h:361
          #5 0x555ad3ace034 in Item_func_sha::val_str_ascii(String*) /data/src/10.2/sql/item_strfunc.cc:178
          #6 0x555ad3accebd in Item_func::val_str_from_val_str_ascii(String*, String*) /data/src/10.2/sql/item_strfunc.cc:82
          #7 0x555ad3856b59 in Item_str_ascii_func::val_str(String*) /data/src/10.2/sql/item_strfunc.h:94
          #8 0x555ad3989c9c in Item::save_in_field(Field*, bool) /data/src/10.2/sql/item.cc:6397
          #9 0x555ad31e58fa in Item_result_field::save_in_result_field(bool) /data/src/10.2/sql/item.h:2564
          #10 0x555ad3431a76 in copy_funcs(Item**, THD const*) /data/src/10.2/sql/sql_select.cc:23923
          #11 0x555ad34173c4 in end_write /data/src/10.2/sql/sql_select.cc:20278
          #12 0x555ad3448124 in AGGR_OP::put_record(bool) /data/src/10.2/sql/sql_select.cc:26819
          #13 0x555ad34565dc in AGGR_OP::put_record() (/mnt-hd8t/bld/10.2-asan-nightly/bin/mysqld+0xfb85dc)
          #14 0x555ad340b109 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18595
          #15 0x555ad340d82a in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19094
          #16 0x555ad340c19c in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18874
          #17 0x555ad340a285 in do_select /data/src/10.2/sql/sql_select.cc:18418
          #18 0x555ad33a40da in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3651
          #19 0x555ad33a1bf1 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3446
          #20 0x555ad33a5474 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3849
          #21 0x555ad3381e4f in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
          #22 0x555ad32f8cbc in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6271
          #23 0x555ad32e6045 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3582
          #24 0x555ad33021d1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793
          #25 0x555ad32db3d6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
          #26 0x555ad32d81a1 in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
          #27 0x555ad3661ed5 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
          #28 0x555ad3661798 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
          #29 0x555ad4a07c51 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
       
      Thread T5 created by T0 here:
          #0 0x7fdeba85a805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
          #1 0x555ad4a08042 in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
          #2 0x555ad307c243 in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
          #3 0x555ad309419a in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6573
          #4 0x555ad3094935 in create_new_thread /data/src/10.2/sql/mysqld.cc:6643
          #5 0x555ad3095ad8 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6901
          #6 0x555ad30934eb in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6192
          #7 0x555ad307aafc in main /data/src/10.2/sql/main.cc:25
          #8 0x7fdeb9d940b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
       
      SUMMARY: AddressSanitizer: heap-use-after-free (/lib/x86_64-linux-gnu/libasan.so.5+0x9b47f) 
      Shadow bytes around the buggy address:
        0x0c1e7fffa8a0: 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa
        0x0c1e7fffa8b0: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c1e7fffa8c0: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
        0x0c1e7fffa8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c1e7fffa8e0: 00 00 00 00 00 04 fa fa fa fa fa fa fa fa fd fd
      =>0x0c1e7fffa8f0: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
        0x0c1e7fffa900: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c1e7fffa910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c1e7fffa920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c1e7fffa930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c1e7fffa940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
        Shadow gap:              cc
      ==1852044==ABORTING
      

      10.2 d8fa71a0 valgrind

      ==1852169== Thread 6:
      ==1852169== Invalid read of size 2
      ==1852169==    at 0x4842B30: memmove (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==1852169==    by 0x4C9C052: SHA1_Update (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1)
      ==1852169==    by 0x11057A3: sha_input(SHAstate_st*, unsigned char const*, unsigned int) (my_sha.ic:94)
      ==1852169==    by 0x110580D: my_sha1 (my_sha.ic:137)
      ==1852169==    by 0xA42CDB: Item_func_sha::val_str_ascii(String*) (item_strfunc.cc:176)
      ==1852169==    by 0xA42634: Item_func::val_str_from_val_str_ascii(String*, String*) (item_strfunc.cc:82)
      ==1852169==    by 0x9449D9: Item_str_ascii_func::val_str(String*) (item_strfunc.h:94)
      ==1852169==    by 0x9BA664: Item::save_in_field(Field*, bool) (item.cc:6397)
      ==1852169==    by 0x69C8DD: Item_result_field::save_in_result_field(bool) (item.h:2564)
      ==1852169==    by 0x780B37: copy_funcs(Item**, THD const*) (sql_select.cc:23923)
      ==1852169==    by 0x77780A: end_write(JOIN*, st_join_table*, bool) (sql_select.cc:20278)
      ==1852169==    by 0x788F3E: AGGR_OP::put_record(bool) (sql_select.cc:26819)
      ==1852169==    by 0x78F2C2: AGGR_OP::put_record() (sql_select.h:973)
      ==1852169==    by 0x773A87: sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) (sql_select.cc:18595)
      ==1852169==    by 0x7746C3: evaluate_join_record(JOIN*, st_join_table*, int) (sql_select.cc:19094)
      ==1852169==    by 0x77415D: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:18913)
      ==1852169==  Address 0xbfdd668 is 8 bytes inside a block of size 56 free'd
      ==1852169==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==1852169==    by 0x1138959: my_free (my_malloc.c:218)
      ==1852169==    by 0x6119C1: String::free() (sql_string.h:351)
      ==1852169==    by 0x6E68CC: String::operator=(String const&) (sql_string.h:422)
      ==1852169==    by 0x97C50F: Field_set::val_str(String*, String*) (field.cc:9281)
      ==1852169==    by 0x9B08EC: Item_field::val_str(String*) (item.cc:2801)
      ==1852169==    by 0xA19B64: Item_func_min_max::val_str(String*) (item_func.cc:2960)
      ==1852169==    by 0xA42C9D: Item_func_sha::val_str_ascii(String*) (item_strfunc.cc:171)
      ==1852169==    by 0xA42634: Item_func::val_str_from_val_str_ascii(String*, String*) (item_strfunc.cc:82)
      ==1852169==    by 0x9449D9: Item_str_ascii_func::val_str(String*) (item_strfunc.h:94)
      ==1852169==    by 0x9BA664: Item::save_in_field(Field*, bool) (item.cc:6397)
      ==1852169==    by 0x69C8DD: Item_result_field::save_in_result_field(bool) (item.h:2564)
      ==1852169==    by 0x780B37: copy_funcs(Item**, THD const*) (sql_select.cc:23923)
      ==1852169==    by 0x77780A: end_write(JOIN*, st_join_table*, bool) (sql_select.cc:20278)
      ==1852169==    by 0x788F3E: AGGR_OP::put_record(bool) (sql_select.cc:26819)
      ==1852169==    by 0x78F2C2: AGGR_OP::put_record() (sql_select.h:973)
      ==1852169==  Block was alloc'd at
      ==1852169==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==1852169==    by 0x113835A: my_malloc (my_malloc.c:101)
      ==1852169==    by 0x7C26B5: String::real_alloc(unsigned long) (sql_string.cc:45)
      ==1852169==    by 0x62149E: String::alloc(unsigned long) (sql_string.h:361)
      ==1852169==    by 0xA42CEC: Item_func_sha::val_str_ascii(String*) (item_strfunc.cc:178)
      ==1852169==    by 0xA42634: Item_func::val_str_from_val_str_ascii(String*, String*) (item_strfunc.cc:82)
      ==1852169==    by 0x9449D9: Item_str_ascii_func::val_str(String*) (item_strfunc.h:94)
      ==1852169==    by 0x9BA664: Item::save_in_field(Field*, bool) (item.cc:6397)
      ==1852169==    by 0x69C8DD: Item_result_field::save_in_result_field(bool) (item.h:2564)
      ==1852169==    by 0x780B37: copy_funcs(Item**, THD const*) (sql_select.cc:23923)
      ==1852169==    by 0x77780A: end_write(JOIN*, st_join_table*, bool) (sql_select.cc:20278)
      ==1852169==    by 0x788F3E: AGGR_OP::put_record(bool) (sql_select.cc:26819)
      ==1852169==    by 0x78F2C2: AGGR_OP::put_record() (sql_select.h:973)
      ==1852169==    by 0x773A87: sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) (sql_select.cc:18595)
      ==1852169==    by 0x7746C3: evaluate_join_record(JOIN*, st_join_table*, int) (sql_select.cc:19094)
      ==1852169==    by 0x773FAA: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:18874)
      

      Reproducible on 10.2-10.6.
      No obvious problem on a non-instrumented build – SELECT returns a result set with a warning:

      SELECT SHA1(GREATEST(CAST(b AS BINARY(4)), a)) AS f FROM t1 GROUP BY f;
      f
      328773d12eb25541474aad19d682b234a4268d0e
      dd01903921ea24941c26a48f2cec24e0bb0e8cc7
      Warnings:
      Warning	1292	Truncated incorrect BINARY(4) value: '10001'
      

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              sanja Oleksandr Byelkin
              Reporter:
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Dates

                Created:
                Updated:

                  Git Integration