Details
-
Bug
-
Status: Confirmed (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.2(EOL), 10.3(EOL), 10.4(EOL), 10.5
Description
CREATE TABLE t1 (a SET('1','2'), b INT); |
INSERT INTO t1 VALUES ('',1001),('',10001); |
|
|
SELECT SHA1(GREATEST(CAST(b AS BINARY(4)), a)) AS f FROM t1 GROUP BY f; |
|
|
# Cleanup
|
DROP TABLE t1; |
|
10.2 d8fa71a0 ASAN |
==1852044==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f0000147e0 at pc 0x7fdeba8bb480 bp 0x7fdeaf40d1e0 sp 0x7fdeaf40c988
|
READ of size 4 at 0x60f0000147e0 thread T5
|
#0 0x7fdeba8bb47f (/lib/x86_64-linux-gnu/libasan.so.5+0x9b47f)
|
#1 0x7fdeba497052 in SHA1_Update (/lib/x86_64-linux-gnu/libcrypto.so.1.1+0x1c2052)
|
#2 0x555ad4a7ba0d in sha_input /data/src/10.2/mysys_ssl/my_sha.ic:94
|
#3 0x555ad4a7bb13 in my_sha1 /data/src/10.2/mysys_ssl/my_sha.ic:137
|
#4 0x555ad3ace020 in Item_func_sha::val_str_ascii(String*) /data/src/10.2/sql/item_strfunc.cc:176
|
#5 0x555ad3accebd in Item_func::val_str_from_val_str_ascii(String*, String*) /data/src/10.2/sql/item_strfunc.cc:82
|
#6 0x555ad3856b59 in Item_str_ascii_func::val_str(String*) /data/src/10.2/sql/item_strfunc.h:94
|
#7 0x555ad3989c9c in Item::save_in_field(Field*, bool) /data/src/10.2/sql/item.cc:6397
|
#8 0x555ad31e58fa in Item_result_field::save_in_result_field(bool) /data/src/10.2/sql/item.h:2564
|
#9 0x555ad3431a76 in copy_funcs(Item**, THD const*) /data/src/10.2/sql/sql_select.cc:23923
|
#10 0x555ad34173c4 in end_write /data/src/10.2/sql/sql_select.cc:20278
|
#11 0x555ad3448124 in AGGR_OP::put_record(bool) /data/src/10.2/sql/sql_select.cc:26819
|
#12 0x555ad34565dc in AGGR_OP::put_record() (/mnt-hd8t/bld/10.2-asan-nightly/bin/mysqld+0xfb85dc)
|
#13 0x555ad340b109 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18595
|
#14 0x555ad340d82a in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19094
|
#15 0x555ad340c82d in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18913
|
#16 0x555ad340a285 in do_select /data/src/10.2/sql/sql_select.cc:18418
|
#17 0x555ad33a40da in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3651
|
#18 0x555ad33a1bf1 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3446
|
#19 0x555ad33a5474 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3849
|
#20 0x555ad3381e4f in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
|
#21 0x555ad32f8cbc in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6271
|
#22 0x555ad32e6045 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3582
|
#23 0x555ad33021d1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793
|
#24 0x555ad32db3d6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
|
#25 0x555ad32d81a1 in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
|
#26 0x555ad3661ed5 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
|
#27 0x555ad3661798 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
|
#28 0x555ad4a07c51 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
|
#29 0x7fdeba2b3608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
|
#30 0x7fdeb9e8f292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
|
|
|
0x60f0000147e0 is located 112 bytes inside of 164-byte region [0x60f000014770,0x60f000014814)
|
freed by thread T5 here:
|
#0 0x7fdeba92d7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
|
#1 0x555ad4b25896 in free_memory /data/src/10.2/mysys/safemalloc.c:279
|
#2 0x555ad4b24de2 in sf_free /data/src/10.2/mysys/safemalloc.c:197
|
#3 0x555ad4af114e in my_free /data/src/10.2/mysys/my_malloc.c:218
|
#4 0x555ad30a18ef in String::free() /data/src/10.2/sql/sql_string.h:351
|
#5 0x555ad32a217d in String::operator=(String const&) /data/src/10.2/sql/sql_string.h:422
|
#6 0x555ad38ea0d5 in Field_set::val_str(String*, String*) /data/src/10.2/sql/field.cc:9281
|
#7 0x555ad396f69c in Item_field::val_str(String*) /data/src/10.2/sql/item.cc:2801
|
#8 0x555ad3a6ee2f in Item_func_min_max::val_str(String*) /data/src/10.2/sql/item_func.cc:2960
|
#9 0x555ad3acdfd5 in Item_func_sha::val_str_ascii(String*) /data/src/10.2/sql/item_strfunc.cc:171
|
#10 0x555ad3accebd in Item_func::val_str_from_val_str_ascii(String*, String*) /data/src/10.2/sql/item_strfunc.cc:82
|
#11 0x555ad3856b59 in Item_str_ascii_func::val_str(String*) /data/src/10.2/sql/item_strfunc.h:94
|
#12 0x555ad3989c9c in Item::save_in_field(Field*, bool) /data/src/10.2/sql/item.cc:6397
|
#13 0x555ad31e58fa in Item_result_field::save_in_result_field(bool) /data/src/10.2/sql/item.h:2564
|
#14 0x555ad3431a76 in copy_funcs(Item**, THD const*) /data/src/10.2/sql/sql_select.cc:23923
|
#15 0x555ad34173c4 in end_write /data/src/10.2/sql/sql_select.cc:20278
|
#16 0x555ad3448124 in AGGR_OP::put_record(bool) /data/src/10.2/sql/sql_select.cc:26819
|
#17 0x555ad34565dc in AGGR_OP::put_record() (/mnt-hd8t/bld/10.2-asan-nightly/bin/mysqld+0xfb85dc)
|
#18 0x555ad340b109 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18595
|
#19 0x555ad340d82a in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19094
|
#20 0x555ad340c82d in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18913
|
#21 0x555ad340a285 in do_select /data/src/10.2/sql/sql_select.cc:18418
|
#22 0x555ad33a40da in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3651
|
#23 0x555ad33a1bf1 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3446
|
#24 0x555ad33a5474 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3849
|
#25 0x555ad3381e4f in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
|
#26 0x555ad32f8cbc in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6271
|
#27 0x555ad32e6045 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3582
|
#28 0x555ad33021d1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793
|
#29 0x555ad32db3d6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
|
|
|
previously allocated by thread T5 here:
|
#0 0x7fdeba92dbc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
|
#1 0x555ad4b24754 in sf_malloc /data/src/10.2/mysys/safemalloc.c:118
|
#2 0x555ad4af06dd in my_malloc /data/src/10.2/mysys/my_malloc.c:101
|
#3 0x555ad34dcdb4 in String::real_alloc(unsigned long) /data/src/10.2/sql/sql_string.cc:45
|
#4 0x555ad30c9cbf in String::alloc(unsigned long) /data/src/10.2/sql/sql_string.h:361
|
#5 0x555ad3ace034 in Item_func_sha::val_str_ascii(String*) /data/src/10.2/sql/item_strfunc.cc:178
|
#6 0x555ad3accebd in Item_func::val_str_from_val_str_ascii(String*, String*) /data/src/10.2/sql/item_strfunc.cc:82
|
#7 0x555ad3856b59 in Item_str_ascii_func::val_str(String*) /data/src/10.2/sql/item_strfunc.h:94
|
#8 0x555ad3989c9c in Item::save_in_field(Field*, bool) /data/src/10.2/sql/item.cc:6397
|
#9 0x555ad31e58fa in Item_result_field::save_in_result_field(bool) /data/src/10.2/sql/item.h:2564
|
#10 0x555ad3431a76 in copy_funcs(Item**, THD const*) /data/src/10.2/sql/sql_select.cc:23923
|
#11 0x555ad34173c4 in end_write /data/src/10.2/sql/sql_select.cc:20278
|
#12 0x555ad3448124 in AGGR_OP::put_record(bool) /data/src/10.2/sql/sql_select.cc:26819
|
#13 0x555ad34565dc in AGGR_OP::put_record() (/mnt-hd8t/bld/10.2-asan-nightly/bin/mysqld+0xfb85dc)
|
#14 0x555ad340b109 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18595
|
#15 0x555ad340d82a in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19094
|
#16 0x555ad340c19c in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18874
|
#17 0x555ad340a285 in do_select /data/src/10.2/sql/sql_select.cc:18418
|
#18 0x555ad33a40da in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3651
|
#19 0x555ad33a1bf1 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3446
|
#20 0x555ad33a5474 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3849
|
#21 0x555ad3381e4f in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
|
#22 0x555ad32f8cbc in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6271
|
#23 0x555ad32e6045 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3582
|
#24 0x555ad33021d1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793
|
#25 0x555ad32db3d6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
|
#26 0x555ad32d81a1 in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
|
#27 0x555ad3661ed5 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
|
#28 0x555ad3661798 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
|
#29 0x555ad4a07c51 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
|
|
|
Thread T5 created by T0 here:
|
#0 0x7fdeba85a805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
|
#1 0x555ad4a08042 in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
|
#2 0x555ad307c243 in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
|
#3 0x555ad309419a in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6573
|
#4 0x555ad3094935 in create_new_thread /data/src/10.2/sql/mysqld.cc:6643
|
#5 0x555ad3095ad8 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6901
|
#6 0x555ad30934eb in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6192
|
#7 0x555ad307aafc in main /data/src/10.2/sql/main.cc:25
|
#8 0x7fdeb9d940b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
|
|
|
SUMMARY: AddressSanitizer: heap-use-after-free (/lib/x86_64-linux-gnu/libasan.so.5+0x9b47f)
|
Shadow bytes around the buggy address:
|
0x0c1e7fffa8a0: 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa
|
0x0c1e7fffa8b0: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c1e7fffa8c0: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
|
0x0c1e7fffa8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c1e7fffa8e0: 00 00 00 00 00 04 fa fa fa fa fa fa fa fa fd fd
|
=>0x0c1e7fffa8f0: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
|
0x0c1e7fffa900: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c1e7fffa910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c1e7fffa920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c1e7fffa930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c1e7fffa940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
Shadow gap: cc
|
==1852044==ABORTING
|
|
10.2 d8fa71a0 valgrind |
==1852169== Thread 6:
|
==1852169== Invalid read of size 2
|
==1852169== at 0x4842B30: memmove (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
|
==1852169== by 0x4C9C052: SHA1_Update (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1)
|
==1852169== by 0x11057A3: sha_input(SHAstate_st*, unsigned char const*, unsigned int) (my_sha.ic:94)
|
==1852169== by 0x110580D: my_sha1 (my_sha.ic:137)
|
==1852169== by 0xA42CDB: Item_func_sha::val_str_ascii(String*) (item_strfunc.cc:176)
|
==1852169== by 0xA42634: Item_func::val_str_from_val_str_ascii(String*, String*) (item_strfunc.cc:82)
|
==1852169== by 0x9449D9: Item_str_ascii_func::val_str(String*) (item_strfunc.h:94)
|
==1852169== by 0x9BA664: Item::save_in_field(Field*, bool) (item.cc:6397)
|
==1852169== by 0x69C8DD: Item_result_field::save_in_result_field(bool) (item.h:2564)
|
==1852169== by 0x780B37: copy_funcs(Item**, THD const*) (sql_select.cc:23923)
|
==1852169== by 0x77780A: end_write(JOIN*, st_join_table*, bool) (sql_select.cc:20278)
|
==1852169== by 0x788F3E: AGGR_OP::put_record(bool) (sql_select.cc:26819)
|
==1852169== by 0x78F2C2: AGGR_OP::put_record() (sql_select.h:973)
|
==1852169== by 0x773A87: sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) (sql_select.cc:18595)
|
==1852169== by 0x7746C3: evaluate_join_record(JOIN*, st_join_table*, int) (sql_select.cc:19094)
|
==1852169== by 0x77415D: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:18913)
|
==1852169== Address 0xbfdd668 is 8 bytes inside a block of size 56 free'd
|
==1852169== at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
|
==1852169== by 0x1138959: my_free (my_malloc.c:218)
|
==1852169== by 0x6119C1: String::free() (sql_string.h:351)
|
==1852169== by 0x6E68CC: String::operator=(String const&) (sql_string.h:422)
|
==1852169== by 0x97C50F: Field_set::val_str(String*, String*) (field.cc:9281)
|
==1852169== by 0x9B08EC: Item_field::val_str(String*) (item.cc:2801)
|
==1852169== by 0xA19B64: Item_func_min_max::val_str(String*) (item_func.cc:2960)
|
==1852169== by 0xA42C9D: Item_func_sha::val_str_ascii(String*) (item_strfunc.cc:171)
|
==1852169== by 0xA42634: Item_func::val_str_from_val_str_ascii(String*, String*) (item_strfunc.cc:82)
|
==1852169== by 0x9449D9: Item_str_ascii_func::val_str(String*) (item_strfunc.h:94)
|
==1852169== by 0x9BA664: Item::save_in_field(Field*, bool) (item.cc:6397)
|
==1852169== by 0x69C8DD: Item_result_field::save_in_result_field(bool) (item.h:2564)
|
==1852169== by 0x780B37: copy_funcs(Item**, THD const*) (sql_select.cc:23923)
|
==1852169== by 0x77780A: end_write(JOIN*, st_join_table*, bool) (sql_select.cc:20278)
|
==1852169== by 0x788F3E: AGGR_OP::put_record(bool) (sql_select.cc:26819)
|
==1852169== by 0x78F2C2: AGGR_OP::put_record() (sql_select.h:973)
|
==1852169== Block was alloc'd at
|
==1852169== at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
|
==1852169== by 0x113835A: my_malloc (my_malloc.c:101)
|
==1852169== by 0x7C26B5: String::real_alloc(unsigned long) (sql_string.cc:45)
|
==1852169== by 0x62149E: String::alloc(unsigned long) (sql_string.h:361)
|
==1852169== by 0xA42CEC: Item_func_sha::val_str_ascii(String*) (item_strfunc.cc:178)
|
==1852169== by 0xA42634: Item_func::val_str_from_val_str_ascii(String*, String*) (item_strfunc.cc:82)
|
==1852169== by 0x9449D9: Item_str_ascii_func::val_str(String*) (item_strfunc.h:94)
|
==1852169== by 0x9BA664: Item::save_in_field(Field*, bool) (item.cc:6397)
|
==1852169== by 0x69C8DD: Item_result_field::save_in_result_field(bool) (item.h:2564)
|
==1852169== by 0x780B37: copy_funcs(Item**, THD const*) (sql_select.cc:23923)
|
==1852169== by 0x77780A: end_write(JOIN*, st_join_table*, bool) (sql_select.cc:20278)
|
==1852169== by 0x788F3E: AGGR_OP::put_record(bool) (sql_select.cc:26819)
|
==1852169== by 0x78F2C2: AGGR_OP::put_record() (sql_select.h:973)
|
==1852169== by 0x773A87: sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) (sql_select.cc:18595)
|
==1852169== by 0x7746C3: evaluate_join_record(JOIN*, st_join_table*, int) (sql_select.cc:19094)
|
==1852169== by 0x773FAA: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:18874)
|
Reproducible on 10.2-10.6.
No obvious problem on a non-instrumented build – SELECT returns a result set with a warning:
SELECT SHA1(GREATEST(CAST(b AS BINARY(4)), a)) AS f FROM t1 GROUP BY f; |
f
|
328773d12eb25541474aad19d682b234a4268d0e
|
dd01903921ea24941c26a48f2cec24e0bb0e8cc7
|
Warnings:
|
Warning 1292 Truncated incorrect BINARY(4) value: '10001' |
Attachments
Issue Links
- relates to
-
-
- Closed
-