Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-26813

ASAN: use-after-poison in wkb_get_double in sql/spatial.cc on SELECT ST_GEOMFROMWKB, UBSAN: runtime error: load of value 2, which is not a valid value for type 'wkbByteOrder', and for type 'Geometry::wkbByteOrder'

Details

    Description

      SELECT ST_GEOMFROMWKB (0x01070000000100000002010000000000000000000000);
      

      Leads to:

      10.7.1 8dd4794c4e11b8790fadf0c203bcd118e7b755e8 (Optimized)

      ==2565397==ERROR: AddressSanitizer: use-after-poison on address 0x629000087a2e at pc 0x5592d62b66f8 bp 0x153438dd7020 sp 0x153438dd7010
      SUMMARY: AddressSanitizer: use-after-poison /test/10.7_opt_san/sql/spatial.cc:432 in wkb_get_double
      

      10.7.1 8dd4794c4e11b8790fadf0c203bcd118e7b755e8 (Optimized)

      ==2565397==ERROR: AddressSanitizer: use-after-poison on address 0x629000087a2e at pc 0x5592d62b66f8 bp 0x153438dd7020 sp 0x153438dd7010
      READ of size 8 at 0x629000087a2e thread T12
          #0 0x5592d62b66f7 in wkb_get_double /test/10.7_opt_san/sql/spatial.cc:432
          #1 0x5592d62b66f7 in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/10.7_opt_san/sql/spatial.cc:935
          #2 0x5592d62ccf7a in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/10.7_opt_san/sql/spatial.cc:3390
          #3 0x5592d62db2f6 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/10.7_opt_san/sql/spatial.cc:483
          #4 0x5592d5b84137 in Item_func_geometry_from_wkb::val_str(String*) /test/10.7_opt_san/sql/item_geofunc.cc:112
          #5 0x5592d4dd42fd in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/10.7_opt_san/sql/sql_type.cc:7455
          #6 0x5592d3a4b791 in Protocol::send_result_set_row(List<Item>*) /test/10.7_opt_san/sql/protocol.cc:1327
          #7 0x5592d3db3839 in select_send::send_data(List<Item>&) /test/10.7_opt_san/sql/sql_class.cc:3072
          #8 0x5592d4479b77 in JOIN::exec_inner() /test/10.7_opt_san/sql/sql_select.cc:4601
          #9 0x5592d447db99 in JOIN::exec() /test/10.7_opt_san/sql/sql_select.cc:4513
          #10 0x5592d446d705 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.7_opt_san/sql/sql_select.cc:4991
          #11 0x5592d44715b3 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.7_opt_san/sql/sql_select.cc:545
          #12 0x5592d40adf4f in execute_sqlcom_select /test/10.7_opt_san/sql/sql_parse.cc:6253
          #13 0x5592d40eda53 in mysql_execute_command(THD*, bool) /test/10.7_opt_san/sql/sql_parse.cc:3944
          #14 0x5592d407dfe8 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.7_opt_san/sql/sql_parse.cc:8028
          #15 0x5592d40d3655 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.7_opt_san/sql/sql_parse.cc:1894
          #16 0x5592d40dee52 in do_command(THD*, bool) /test/10.7_opt_san/sql/sql_parse.cc:1402
          #17 0x5592d498a7bd in do_handle_one_connection(CONNECT*, bool) /test/10.7_opt_san/sql/sql_connect.cc:1418
          #18 0x5592d498d2b4 in handle_one_connection /test/10.7_opt_san/sql/sql_connect.cc:1312
          #19 0x5592d6955ce1 in pfs_spawn_thread /test/10.7_opt_san/storage/perfschema/pfs.cc:2201
          #20 0x15345931e608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
          #21 0x153458594292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
       
      0x629000087a2e is located 2094 bytes inside of 16400-byte region [0x629000087200,0x62900008b210)
      allocated by thread T12 here:
          #0 0x5592d386fab8 in __interceptor_malloc (/test/UBASAN_MD300921-mariadb-10.7.1-linux-x86_64-opt/bin/mariadbd+0x7b60ab8)
          #1 0x5592d81544cb in my_malloc /test/10.7_opt_san/mysys/my_malloc.c:90
          #2 0x5592d812ff30 in root_alloc /test/10.7_opt_san/mysys/my_alloc.c:66
          #3 0x5592d812ff30 in reset_root_defaults /test/10.7_opt_san/mysys/my_alloc.c:243
          #4 0x5592d3d7ae23 in THD::init_for_queries() /test/10.7_opt_san/sql/sql_class.cc:1405
          #5 0x5592d4984695 in prepare_new_connection_state(THD*) /test/10.7_opt_san/sql/sql_connect.cc:1240
          #6 0x5592d4985fd7 in thd_prepare_connection(THD*) /test/10.7_opt_san/sql/sql_connect.cc:1333
          #7 0x5592d4985fd7 in thd_prepare_connection(THD*) /test/10.7_opt_san/sql/sql_connect.cc:1322
          #8 0x5592d4989674 in do_handle_one_connection(CONNECT*, bool) /test/10.7_opt_san/sql/sql_connect.cc:1408
          #9 0x5592d498d2b4 in handle_one_connection /test/10.7_opt_san/sql/sql_connect.cc:1312
          #10 0x5592d6955ce1 in pfs_spawn_thread /test/10.7_opt_san/storage/perfschema/pfs.cc:2201
          #11 0x15345931e608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
      Thread T12 created by T0 here:
          #0 0x5592d379c725 in __interceptor_pthread_create (/test/UBASAN_MD300921-mariadb-10.7.1-linux-x86_64-opt/bin/mariadbd+0x7a8d725)
          #1 0x5592d696e0cf in my_thread_create /test/10.7_opt_san/storage/perfschema/my_thread.h:48
          #2 0x5592d696e0cf in pfs_spawn_thread_v1 /test/10.7_opt_san/storage/perfschema/pfs.cc:2252
          #3 0x5592d38c3805 in inline_mysql_thread_create /test/10.7_opt_san/include/mysql/psi/mysql_thread.h:1139
          #4 0x5592d38c3805 in create_thread_to_handle_connection(CONNECT*) /test/10.7_opt_san/sql/mysqld.cc:5952
          #5 0x5592d38d7510 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/10.7_opt_san/sql/mysqld.cc:6073
          #6 0x5592d38d878b in handle_connections_sockets() /test/10.7_opt_san/sql/mysqld.cc:6197
          #7 0x5592d38dc409 in mysqld_main(int, char**) /test/10.7_opt_san/sql/mysqld.cc:5847
          #8 0x1534584990b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
       
      SUMMARY: AddressSanitizer: use-after-poison /test/10.7_opt_san/sql/spatial.cc:432 in wkb_get_double
      Shadow bytes around the buggy address:
        0x0c5280008ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c5280008f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c5280008f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c5280008f20: 00 00 00 00 00 00 f7 00 00 f7 00 07 f7 00 00 00
        0x0c5280008f30: 00 00 05 f7 00 00 00 00 00 00 00 00 00 00 00 00
      =>0x0c5280008f40: 00 00 f7 00 00[07]f7 00 00 00 00 00 07 f7 00 00
        0x0c5280008f50: 00 f7 00 00 f7 00 00 00 00 00 00 00 00 00 00 00
        0x0c5280008f60: 00 00 00 00 00 00 00 00 00 00 f7 00 00 f7 00 00
        0x0c5280008f70: 00 00 00 00 00 00 f7 00 00 f7 00 00 00 00 00 00
        0x0c5280008f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c5280008f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
        Shadow gap:              cc
      

      Setup:

      Compiled with GCC >=7.5.0 (I use GCC 9.3.0) and:
          -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON
      Set before execution:
          export ASAN_OPTIONS=quarantine_size_mb=512:atexit=1:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1
      

      Bug confirmed present in:
      MariaDB: 10.2.41 (dbg), 10.2.41 (opt), 10.3.32 (dbg), 10.3.32 (opt), 10.4.22 (dbg), 10.4.22 (opt), 10.5.13 (dbg), 10.5.13 (opt), 10.6.5 (dbg), 10.6.5 (opt), 10.7.1 (dbg), 10.7.1 (opt)

      Attachments

        Activity

          Executing this query in a debug UBSAN+ASAN build of 11.0 results in the query thread hanging for quite some time before the server crashes:

          11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug, UBASAN)

          11.0.2-dbg>show processlist;
          +----+------+-----------+------+---------+------+-----------+------------------------------------------------------------------------+----------+
          | Id | User | Host      | db   | Command | Time | State     | Info                                                                   | Progress |
          +----+------+-----------+------+---------+------+-----------+------------------------------------------------------------------------+----------+
          |  4 | root | localhost | test | Query   |   45 | Executing | SELECT ST_GEOMFROMWKB (0x01070000000100000002010000000000000000000000) |    0.000 |
          |  5 | root | localhost | test | Query   |    0 | starting  | show processlist                                                       |    0.000 |
          +----+------+-----------+------+---------+------+-----------+------------------------------------------------------------------------+----------+
          2 rows in set (0.001 sec)
          

          And we see the following ASAN error & stack:

          11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug, UBASAN)

          ==3609113==ERROR: AddressSanitizer: use-after-poison on address 0x6290000d7a96 at pc 0x5582e74dbed2 bp 0x14e618bba030 sp 0x14e618bba020
          READ of size 8 at 0x6290000d7a96 thread T18
              #0 0x5582e74dbed1 in wkb_get_double /test/11.0_dbg_san/sql/spatial.cc:428
              #1 0x5582e74e5037 in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.0_dbg_san/sql/spatial.cc:936
              #2 0x5582e750c912 in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.0_dbg_san/sql/spatial.cc:3404
              #3 0x5582e7518d03 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/11.0_dbg_san/sql/spatial.cc:483
              #4 0x5582e6cc49d0 in Item_func_geometry_from_wkb::val_str(String*) /test/11.0_dbg_san/sql/item_geofunc.cc:112
              #5 0x5582e5d647af in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7446
              #6 0x5582e57adcf2 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5455
              #7 0x5582e453f888 in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235
              #8 0x5582e46fbe96 in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
              #9 0x5582e4ac74a8 in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
              #10 0x5582e5249e7a in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
              #11 0x5582e5249e7a in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4766
              #12 0x5582e5250916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677
              #13 0x5582e523f0c1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5158
              #14 0x5582e524351c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616
              #15 0x5582e4db5a01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279
              #16 0x5582e4e16ef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
              #17 0x5582e4e46973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
              #18 0x5582e4e56707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
              #19 0x5582e4e64542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
              #20 0x5582e58398b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
              #21 0x5582e583add0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
              #22 0x14e63b894b42 in start_thread nptl/pthread_create.c:442
              #23 0x14e63b9269ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
           
          0x6290000d7a96 is located 2198 bytes inside of 16400-byte region [0x6290000d7200,0x6290000db210)
          allocated by thread T18 here:
              #0 0x5582e44cb337 in __interceptor_malloc (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7964337)
              #1 0x5582e8be2703 in my_malloc /test/11.0_dbg_san/mysys/my_malloc.c:91
              #2 0x5582e8bc0f22 in root_alloc /test/11.0_dbg_san/mysys/my_alloc.c:71
              #3 0x5582e8bc1dec in reset_root_defaults /test/11.0_dbg_san/mysys/my_alloc.c:248
              #4 0x5582e4a76ec1 in THD::init_for_queries() /test/11.0_dbg_san/sql/sql_class.cc:1386
              #5 0x5582e58355cc in prepare_new_connection_state(THD*) /test/11.0_dbg_san/sql/sql_connect.cc:1245
              #6 0x5582e5836d7a in thd_prepare_connection(THD*) /test/11.0_dbg_san/sql/sql_connect.cc:1339
              #7 0x5582e583a134 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1406
              #8 0x5582e583add0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
              #9 0x14e63b894b42 in start_thread nptl/pthread_create.c:442
           
          Thread T18 created by T0 here:
              #0 0x5582e446f175 in pthread_create (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7908175)
              #1 0x5582e452598b in create_thread_to_handle_connection(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6129
              #2 0x5582e4532e67 in create_new_thread(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6191
              #3 0x5582e45336e7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_dbg_san/sql/mysqld.cc:6253
              #4 0x5582e4534738 in handle_connections_sockets() /test/11.0_dbg_san/sql/mysqld.cc:6377
              #5 0x5582e453bee7 in mysqld_main(int, char**) /test/11.0_dbg_san/sql/mysqld.cc:6024
              #6 0x5582e4510eca in main /test/11.0_dbg_san/sql/main.cc:34
              #7 0x14e63b829d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
           
          SUMMARY: AddressSanitizer: use-after-poison /test/11.0_dbg_san/sql/spatial.cc:428 in wkb_get_double
          Shadow bytes around the buggy address:
            0x0c5280012f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x0c5280012f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x0c5280012f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x0c5280012f30: 00 00 f7 00 00 f7 00 07 f7 00 00 00 00 00 05 f7
            0x0c5280012f40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7
          =>0x0c5280012f50: 00 00[07]f7 00 00 00 00 00 00 00 00 00 00 00 00
            0x0c5280012f60: 00 00 00 00 00 03 f7 00 00 00 f7 00 00 f7 00 00
            0x0c5280012f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x0c5280012f80: 00 00 00 00 f7 00 00 f7 00 00 00 00 00 00 00 00
            0x0c5280012f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06
            0x0c5280012fa0: f7 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00
          Shadow byte legend (one shadow byte represents 8 application bytes):
            Addressable:           00
            Partially addressable: 01 02 03 04 05 06 07 
            Heap left redzone:       fa
            Freed heap region:       fd
            Stack left redzone:      f1
            Stack mid redzone:       f2
            Stack right redzone:     f3
            Stack after return:      f5
            Stack use after scope:   f8
            Global redzone:          f9
            Global init order:       f6
            Poisoned by user:        f7
            Container overflow:      fc
            Array cookie:            ac
            Intra object redzone:    bb
            ASan internal:           fe
            Left alloca redzone:     ca
            Right alloca redzone:    cb
            Shadow gap:              cc
          ==3609113==ABORTING
          230513 13:39:01 [ERROR] mysqld got signal 6 ;
          This could be because you hit a bug. It is also possible that this binary
          or one of the libraries it was linked against is corrupt, improperly built,
          or misconfigured. This error can also be caused by malfunctioning hardware.
           
          To report this bug, see https://mariadb.com/kb/en/reporting-bugs
           
          We will try our best to scrape up some info that will hopefully help
          diagnose the problem, but since we have already crashed, 
          something is definitely wrong and this may fail.
           
          Server version: 11.0.2-MariaDB-debug source revision: 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a
          key_buffer_size=134217728
          read_buffer_size=131072
          max_used_connections=1
          max_threads=153
          thread_count=1
          It is possible that mysqld could use up to 
          key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 468071 K  bytes of memory
          Hope that's ok; if not, decrease some variables in the equation.
           
          Thread pointer: 0x62b00015e218
          Attempting backtrace. You can use the following information to find out==3609113==ERROR: AddressSanitizer: use-after-poison on address 0x6290000d7a96 at pc 0x5582e74dbed2 bp 0x14e618bba030 sp 0x14e618bba020
          READ of size 8 at 0x6290000d7a96 thread T18
              #0 0x5582e74dbed1 in wkb_get_double /test/11.0_dbg_san/sql/spatial.cc:428
              #1 0x5582e74e5037 in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.0_dbg_san/sql/spatial.cc:936
              #2 0x5582e750c912 in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.0_dbg_san/sql/spatial.cc:3404
              #3 0x5582e7518d03 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/11.0_dbg_san/sql/spatial.cc:483
              #4 0x5582e6cc49d0 in Item_func_geometry_from_wkb::val_str(String*) /test/11.0_dbg_san/sql/item_geofunc.cc:112
              #5 0x5582e5d647af in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7446
              #6 0x5582e57adcf2 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5455
              #7 0x5582e453f888 in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235
              #8 0x5582e46fbe96 in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
              #9 0x5582e4ac74a8 in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
              #10 0x5582e5249e7a in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
              #11 0x5582e5249e7a in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4766
              #12 0x5582e5250916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677
              #13 0x5582e523f0c1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5158
              #14 0x5582e524351c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616
              #15 0x5582e4db5a01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279
              #16 0x5582e4e16ef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
              #17 0x5582e4e46973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
              #18 0x5582e4e56707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
              #19 0x5582e4e64542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
              #20 0x5582e58398b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
              #21 0x5582e583add0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
              #22 0x14e63b894b42 in start_thread nptl/pthread_create.c:442
              #23 0x14e63b9269ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
           
          0x6290000d7a96 is located 2198 bytes inside of 16400-byte region [0x6290000d7200,0x6290000db210)
          allocated by thread T18 here:
              #0 0x5582e44cb337 in __interceptor_malloc (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7964337)
              #1 0x5582e8be2703 in my_malloc /test/11.0_dbg_san/mysys/my_malloc.c:91
              #2 0x5582e8bc0f22 in root_alloc /test/11.0_dbg_san/mysys/my_alloc.c:71
              #3 0x5582e8bc1dec in reset_root_defaults /test/11.0_dbg_san/mysys/my_alloc.c:248
              #4 0x5582e4a76ec1 in THD::init_for_queries() /test/11.0_dbg_san/sql/sql_class.cc:1386
              #5 0x5582e58355cc in prepare_new_connection_state(THD*) /test/11.0_dbg_san/sql/sql_connect.cc:1245
              #6 0x5582e5836d7a in thd_prepare_connection(THD*) /test/11.0_dbg_san/sql/sql_connect.cc:1339
              #7 0x5582e583a134 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1406
              #8 0x5582e583add0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
              #9 0x14e63b894b42 in start_thread nptl/pthread_create.c:442
           
          Thread T18 created by T0 here:
              #0 0x5582e446f175 in pthread_create (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7908175)
              #1 0x5582e452598b in create_thread_to_handle_connection(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6129
              #2 0x5582e4532e67 in create_new_thread(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6191
              #3 0x5582e45336e7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_dbg_san/sql/mysqld.cc:6253
              #4 0x5582e4534738 in handle_connections_sockets() /test/11.0_dbg_san/sql/mysqld.cc:6377
              #5 0x5582e453bee7 in mysqld_main(int, char**) /test/11.0_dbg_san/sql/mysqld.cc:6024
              #6 0x5582e4510eca in main /test/11.0_dbg_san/sql/main.cc:34
              #7 0x14e63b829d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
           
          SUMMARY: AddressSanitizer: use-after-poison /test/11.0_dbg_san/sql/spatial.cc:428 in wkb_get_double
          Shadow bytes around the buggy address:
            0x0c5280012f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x0c5280012f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x0c5280012f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x0c5280012f30: 00 00 f7 00 00 f7 00 07 f7 00 00 00 00 00 05 f7
            0x0c5280012f40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7
          =>0x0c5280012f50: 00 00[07]f7 00 00 00 00 00 00 00 00 00 00 00 00
            0x0c5280012f60: 00 00 00 00 00 03 f7 00 00 00 f7 00 00 f7 00 00
            0x0c5280012f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x0c5280012f80: 00 00 00 00 f7 00 00 f7 00 00 00 00 00 00 00 00
            0x0c5280012f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06
            0x0c5280012fa0: f7 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00
          Shadow byte legend (one shadow byte represents 8 application bytes):
            Addressable:           00
            Partially addressable: 01 02 03 04 05 06 07 
            Heap left redzone:       fa
            Freed heap region:       fd
            Stack left redzone:      f1
            Stack mid redzone:       f2
            Stack right redzone:     f3
            Stack after return:      f5
            Stack use after scope:   f8
            Global redzone:          f9
            Global init order:       f6
            Poisoned by user:        f7
            Container overflow:      fc
            Array cookie:            ac
            Intra object redzone:    bb
            ASan internal:           fe
            Left alloca redzone:     ca
            Right alloca redzone:    cb
            Shadow gap:              cc
          ==3609113==ABORTING
          230513 13:39:01 [ERROR] mysqld got signal 6 ;
          This could be because you hit a bug. It is also possible that this binary
          or one of the libraries it was linked against is corrupt, improperly built,
          or misconfigured. This error can also be caused by malfunctioning hardware.
           
          To report this bug, see https://mariadb.com/kb/en/reporting-bugs
           
          We will try our best to scrape up some info that will hopefully help
          diagnose the problem, but since we have already crashed, 
          something is definitely wrong and this may fail.
           
          Server version: 11.0.2-MariaDB-debug source revision: 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a
          key_buffer_size=134217728
          read_buffer_size=131072
          max_used_connections=1
          max_threads=153
          thread_count=1
          It is possible that mysqld could use up to 
          key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 468071 K  bytes of memory
          Hope that's ok; if not, decrease some variables in the equation.
           
          Thread pointer: 0x62b00015e218
          Attempting backtrace. You can use the following information to find out
          where mysqld died. If you see no messages after this, something went
          terribly wrong...
          stack_bottom = 0x14e618bbdac0 thread_stack 0x100000
          asan_interceptors.o:0(__interceptor_backtrace.part.0)[0x5582e445c6fe]
          mysys/stacktrace.c:215(my_print_stacktrace)[0x5582e8bef001]
          sql/signal_handler.cc:238(handle_fatal_signal)[0x5582e650a534]
          libc_sigaction.c:0(__restore_rt)[0x14e63b842520]
          nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x14e63b896a7c]
          posix/raise.c:27(__GI_raise)[0x14e63b842476]
          stdlib/abort.c:81(__GI_abort)[0x14e63b8287f3]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x79821c2)[0x5582e44e91c2]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x798dd7c)[0x5582e44f4d7c]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796d22c)[0x5582e44d422c]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796cac5)[0x5582e44d3ac5]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(__asan_report_load_n+0x38)[0x5582e44d50e8]
          sql/spatial.cc:432(wkb_get_double(char const*, Geometry::wkbByteOrder))[0x5582e74dbed2]
          sql/spatial.cc:936(Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*))[0x5582e74e5038]
          sql/spatial.cc:3403(Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*))[0x5582e750c913]
          sql/spatial.cc:484(Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*))[0x5582e7518d04]
          sql/item_geofunc.cc:112(Item_func_geometry_from_wkb::val_str(String*))[0x5582e6cc49d1]
          sql/sql_type.cc:7446(Type_handler::Item_send_str(Item*, Protocol*, st_value*) const)[0x5582e5d647b0]
          sql/sql_type.h:5456(Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const)[0x5582e57adcf3]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x79d8889)[0x5582e453f889]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN8Protocol19send_result_set_rowEP4ListI4ItemE+0xa6b)[0x5582e46fbe97]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN11select_send9send_dataER4ListI4ItemE+0x289)[0x5582e4ac74a9]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN4JOIN10exec_innerEv+0x4607)[0x5582e5249e7b]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN4JOIN4execEv+0x195)[0x5582e5250917]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x844)[0x5582e523f0c2]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0xb00)[0x5582e524351d]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x824ea02)[0x5582e4db5a02]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z21mysql_execute_commandP3THDb+0xb4af)[0x5582e4e16ef6]
          sql/item.h:1236(Item::send(Protocol*, st_value*))[0x5582e4e46974]
          sql/protocol.cc:1332(Protocol::send_result_set_row(List<Item>*))[0x5582e4e56708]
          sql/sql_class.cc:3102(select_send::send_data(List<Item>&))[0x5582e4e64543]
          sql/sql_class.h:5748(select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long))[0x5582e58398b6]
          sql/sql_select.cc:4677(JOIN::exec())[0x5582e583add1]
          nptl/pthread_create.c:442(start_thread)[0x14e63b894b43]
          x86_64/clone3.S:83(__clone3)[0x14e63b926a00]
           
          Trying to get some variables.
          Some pointers may be invalid and cause the dump to abort.
          Query (0x6290000d73f0): SELECT ST_GEOMFROMWKB (0x01070000000100000002010000000000000000000000)
           
          Connection ID (thread ID): 4
          Status: NOT_KILLED
           
          where mysqld died. If you see no messages after this, something went
          terribly wrong...
          stack_bottom = 0x14e618bbdac0 thread_stack 0x100000
          asan_interceptors.o:0(__interceptor_backtrace.part.0)[0x5582e445c6fe]
          mysys/stacktrace.c:215(my_print_stacktrace)[0x5582e8bef001]
          sql/signal_handler.cc:238(handle_fatal_signal)[0x5582e650a534]
          libc_sigaction.c:0(__restore_rt)[0x14e63b842520]
          nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x14e63b896a7c]
          posix/raise.c:27(__GI_raise)[0x14e63b842476]
          stdlib/abort.c:81(__GI_abort)[0x14e63b8287f3]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x79821c2)[0x5582e44e91c2]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x798dd7c)[0x5582e44f4d7c]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796d22c)[0x5582e44d422c]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796cac5)[0x5582e44d3ac5]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(__asan_report_load_n+0x38)[0x5582e44d50e8]
          sql/spatial.cc:432(wkb_get_double(char const*, Geometry::wkbByteOrder))[0x5582e74dbed2]
          sql/spatial.cc:936(Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*))[0x5582e74e5038]
          sql/spatial.cc:3403(Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*))[0x5582e750c913]
          sql/spatial.cc:484(Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*))[0x5582e7518d04]
          sql/item_geofunc.cc:112(Item_func_geometry_from_wkb::val_str(String*))[0x5582e6cc49d1]
          sql/sql_type.cc:7446(Type_handler::Item_send_str(Item*, Protocol*, st_value*) const)[0x5582e5d647b0]
          sql/sql_type.h:5456(Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const)[0x5582e57adcf3]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x79d8889)[0x5582e453f889]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN8Protocol19send_result_set_rowEP4ListI4ItemE+0xa6b)[0x5582e46fbe97]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN11select_send9send_dataER4ListI4ItemE+0x289)[0x5582e4ac74a9]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN4JOIN10exec_innerEv+0x4607)[0x5582e5249e7b]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN4JOIN4execEv+0x195)[0x5582e5250917]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x844)[0x5582e523f0c2]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0xb00)[0x5582e524351d]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x824ea02)[0x5582e4db5a02]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z21mysql_execute_commandP3THDb+0xb4af)[0x5582e4e16ef6]
          sql/item.h:1236(Item::send(Protocol*, st_value*))[0x5582e4e46974]
          sql/protocol.cc:1332(Protocol::send_result_set_row(List<Item>*))[0x5582e4e56708]
          sql/sql_class.cc:3102(select_send::send_data(List<Item>&))[0x5582e4e64543]
          sql/sql_class.h:5748(select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long))[0x5582e58398b6]
          sql/sql_select.cc:4677(JOIN::exec())[0x5582e583add1]
          nptl/pthread_create.c:442(start_thread)[0x14e63b894b43]
          x86_64/clone3.S:83(__clone3)[0x14e63b926a00]
           
          Trying to get some variables.
          Some pointers may be invalid and cause the dump to abort.
          Query (0x6290000d73f0): SELECT ST_GEOMFROMWKB (0x01070000000100000002010000000000000000000000)
           
          Connection ID (thread ID): 4
          Status: NOT_KILLED
          

          Roel Roel Van de Paar added a comment - Executing this query in a debug UBSAN+ASAN build of 11.0 results in the query thread hanging for quite some time before the server crashes: 11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug, UBASAN) 11.0.2-dbg>show processlist; +----+------+-----------+------+---------+------+-----------+------------------------------------------------------------------------+----------+ | Id | User | Host | db | Command | Time | State | Info | Progress | +----+------+-----------+------+---------+------+-----------+------------------------------------------------------------------------+----------+ | 4 | root | localhost | test | Query | 45 | Executing | SELECT ST_GEOMFROMWKB (0x01070000000100000002010000000000000000000000) | 0.000 | | 5 | root | localhost | test | Query | 0 | starting | show processlist | 0.000 | +----+------+-----------+------+---------+------+-----------+------------------------------------------------------------------------+----------+ 2 rows in set (0.001 sec) And we see the following ASAN error & stack: 11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug, UBASAN) ==3609113==ERROR: AddressSanitizer: use-after-poison on address 0x6290000d7a96 at pc 0x5582e74dbed2 bp 0x14e618bba030 sp 0x14e618bba020 READ of size 8 at 0x6290000d7a96 thread T18 #0 0x5582e74dbed1 in wkb_get_double /test/11.0_dbg_san/sql/spatial.cc:428 #1 0x5582e74e5037 in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.0_dbg_san/sql/spatial.cc:936 #2 0x5582e750c912 in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.0_dbg_san/sql/spatial.cc:3404 #3 0x5582e7518d03 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/11.0_dbg_san/sql/spatial.cc:483 #4 0x5582e6cc49d0 in Item_func_geometry_from_wkb::val_str(String*) /test/11.0_dbg_san/sql/item_geofunc.cc:112 #5 0x5582e5d647af in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7446 #6 0x5582e57adcf2 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5455 #7 0x5582e453f888 in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235 #8 0x5582e46fbe96 in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332 #9 0x5582e4ac74a8 in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102 #10 0x5582e5249e7a in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748 #11 0x5582e5249e7a in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4766 #12 0x5582e5250916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677 #13 0x5582e523f0c1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5158 #14 0x5582e524351c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616 #15 0x5582e4db5a01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279 #16 0x5582e4e16ef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949 #17 0x5582e4e46973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014 #18 0x5582e4e56707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894 #19 0x5582e4e64542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407 #20 0x5582e58398b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416 #21 0x5582e583add0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318 #22 0x14e63b894b42 in start_thread nptl/pthread_create.c:442 #23 0x14e63b9269ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)   0x6290000d7a96 is located 2198 bytes inside of 16400-byte region [0x6290000d7200,0x6290000db210) allocated by thread T18 here: #0 0x5582e44cb337 in __interceptor_malloc (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7964337) #1 0x5582e8be2703 in my_malloc /test/11.0_dbg_san/mysys/my_malloc.c:91 #2 0x5582e8bc0f22 in root_alloc /test/11.0_dbg_san/mysys/my_alloc.c:71 #3 0x5582e8bc1dec in reset_root_defaults /test/11.0_dbg_san/mysys/my_alloc.c:248 #4 0x5582e4a76ec1 in THD::init_for_queries() /test/11.0_dbg_san/sql/sql_class.cc:1386 #5 0x5582e58355cc in prepare_new_connection_state(THD*) /test/11.0_dbg_san/sql/sql_connect.cc:1245 #6 0x5582e5836d7a in thd_prepare_connection(THD*) /test/11.0_dbg_san/sql/sql_connect.cc:1339 #7 0x5582e583a134 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1406 #8 0x5582e583add0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318 #9 0x14e63b894b42 in start_thread nptl/pthread_create.c:442   Thread T18 created by T0 here: #0 0x5582e446f175 in pthread_create (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7908175) #1 0x5582e452598b in create_thread_to_handle_connection(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6129 #2 0x5582e4532e67 in create_new_thread(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6191 #3 0x5582e45336e7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_dbg_san/sql/mysqld.cc:6253 #4 0x5582e4534738 in handle_connections_sockets() /test/11.0_dbg_san/sql/mysqld.cc:6377 #5 0x5582e453bee7 in mysqld_main(int, char**) /test/11.0_dbg_san/sql/mysqld.cc:6024 #6 0x5582e4510eca in main /test/11.0_dbg_san/sql/main.cc:34 #7 0x14e63b829d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58   SUMMARY: AddressSanitizer: use-after-poison /test/11.0_dbg_san/sql/spatial.cc:428 in wkb_get_double Shadow bytes around the buggy address: 0x0c5280012f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c5280012f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c5280012f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c5280012f30: 00 00 f7 00 00 f7 00 07 f7 00 00 00 00 00 05 f7 0x0c5280012f40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 =>0x0c5280012f50: 00 00[07]f7 00 00 00 00 00 00 00 00 00 00 00 00 0x0c5280012f60: 00 00 00 00 00 03 f7 00 00 00 f7 00 00 f7 00 00 0x0c5280012f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c5280012f80: 00 00 00 00 f7 00 00 f7 00 00 00 00 00 00 00 00 0x0c5280012f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 0x0c5280012fa0: f7 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==3609113==ABORTING 230513 13:39:01 [ERROR] mysqld got signal 6 ; This could be because you hit a bug. It is also possible that this binary or one of the libraries it was linked against is corrupt, improperly built, or misconfigured. This error can also be caused by malfunctioning hardware.   To report this bug, see https://mariadb.com/kb/en/reporting-bugs   We will try our best to scrape up some info that will hopefully help diagnose the problem, but since we have already crashed, something is definitely wrong and this may fail.   Server version: 11.0.2-MariaDB-debug source revision: 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a key_buffer_size=134217728 read_buffer_size=131072 max_used_connections=1 max_threads=153 thread_count=1 It is possible that mysqld could use up to key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 468071 K bytes of memory Hope that's ok; if not, decrease some variables in the equation.   Thread pointer: 0x62b00015e218 Attempting backtrace. You can use the following information to find out==3609113==ERROR: AddressSanitizer: use-after-poison on address 0x6290000d7a96 at pc 0x5582e74dbed2 bp 0x14e618bba030 sp 0x14e618bba020 READ of size 8 at 0x6290000d7a96 thread T18 #0 0x5582e74dbed1 in wkb_get_double /test/11.0_dbg_san/sql/spatial.cc:428 #1 0x5582e74e5037 in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.0_dbg_san/sql/spatial.cc:936 #2 0x5582e750c912 in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.0_dbg_san/sql/spatial.cc:3404 #3 0x5582e7518d03 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/11.0_dbg_san/sql/spatial.cc:483 #4 0x5582e6cc49d0 in Item_func_geometry_from_wkb::val_str(String*) /test/11.0_dbg_san/sql/item_geofunc.cc:112 #5 0x5582e5d647af in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7446 #6 0x5582e57adcf2 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5455 #7 0x5582e453f888 in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235 #8 0x5582e46fbe96 in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332 #9 0x5582e4ac74a8 in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102 #10 0x5582e5249e7a in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748 #11 0x5582e5249e7a in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4766 #12 0x5582e5250916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677 #13 0x5582e523f0c1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5158 #14 0x5582e524351c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616 #15 0x5582e4db5a01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279 #16 0x5582e4e16ef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949 #17 0x5582e4e46973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014 #18 0x5582e4e56707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894 #19 0x5582e4e64542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407 #20 0x5582e58398b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416 #21 0x5582e583add0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318 #22 0x14e63b894b42 in start_thread nptl/pthread_create.c:442 #23 0x14e63b9269ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)   0x6290000d7a96 is located 2198 bytes inside of 16400-byte region [0x6290000d7200,0x6290000db210) allocated by thread T18 here: #0 0x5582e44cb337 in __interceptor_malloc (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7964337) #1 0x5582e8be2703 in my_malloc /test/11.0_dbg_san/mysys/my_malloc.c:91 #2 0x5582e8bc0f22 in root_alloc /test/11.0_dbg_san/mysys/my_alloc.c:71 #3 0x5582e8bc1dec in reset_root_defaults /test/11.0_dbg_san/mysys/my_alloc.c:248 #4 0x5582e4a76ec1 in THD::init_for_queries() /test/11.0_dbg_san/sql/sql_class.cc:1386 #5 0x5582e58355cc in prepare_new_connection_state(THD*) /test/11.0_dbg_san/sql/sql_connect.cc:1245 #6 0x5582e5836d7a in thd_prepare_connection(THD*) /test/11.0_dbg_san/sql/sql_connect.cc:1339 #7 0x5582e583a134 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1406 #8 0x5582e583add0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318 #9 0x14e63b894b42 in start_thread nptl/pthread_create.c:442   Thread T18 created by T0 here: #0 0x5582e446f175 in pthread_create (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7908175) #1 0x5582e452598b in create_thread_to_handle_connection(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6129 #2 0x5582e4532e67 in create_new_thread(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6191 #3 0x5582e45336e7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_dbg_san/sql/mysqld.cc:6253 #4 0x5582e4534738 in handle_connections_sockets() /test/11.0_dbg_san/sql/mysqld.cc:6377 #5 0x5582e453bee7 in mysqld_main(int, char**) /test/11.0_dbg_san/sql/mysqld.cc:6024 #6 0x5582e4510eca in main /test/11.0_dbg_san/sql/main.cc:34 #7 0x14e63b829d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58   SUMMARY: AddressSanitizer: use-after-poison /test/11.0_dbg_san/sql/spatial.cc:428 in wkb_get_double Shadow bytes around the buggy address: 0x0c5280012f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c5280012f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c5280012f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c5280012f30: 00 00 f7 00 00 f7 00 07 f7 00 00 00 00 00 05 f7 0x0c5280012f40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 =>0x0c5280012f50: 00 00[07]f7 00 00 00 00 00 00 00 00 00 00 00 00 0x0c5280012f60: 00 00 00 00 00 03 f7 00 00 00 f7 00 00 f7 00 00 0x0c5280012f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c5280012f80: 00 00 00 00 f7 00 00 f7 00 00 00 00 00 00 00 00 0x0c5280012f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 0x0c5280012fa0: f7 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==3609113==ABORTING 230513 13:39:01 [ERROR] mysqld got signal 6 ; This could be because you hit a bug. It is also possible that this binary or one of the libraries it was linked against is corrupt, improperly built, or misconfigured. This error can also be caused by malfunctioning hardware.   To report this bug, see https://mariadb.com/kb/en/reporting-bugs   We will try our best to scrape up some info that will hopefully help diagnose the problem, but since we have already crashed, something is definitely wrong and this may fail.   Server version: 11.0.2-MariaDB-debug source revision: 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a key_buffer_size=134217728 read_buffer_size=131072 max_used_connections=1 max_threads=153 thread_count=1 It is possible that mysqld could use up to key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 468071 K bytes of memory Hope that's ok; if not, decrease some variables in the equation.   Thread pointer: 0x62b00015e218 Attempting backtrace. You can use the following information to find out where mysqld died. If you see no messages after this, something went terribly wrong... stack_bottom = 0x14e618bbdac0 thread_stack 0x100000 asan_interceptors.o:0(__interceptor_backtrace.part.0)[0x5582e445c6fe] mysys/stacktrace.c:215(my_print_stacktrace)[0x5582e8bef001] sql/signal_handler.cc:238(handle_fatal_signal)[0x5582e650a534] libc_sigaction.c:0(__restore_rt)[0x14e63b842520] nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x14e63b896a7c] posix/raise.c:27(__GI_raise)[0x14e63b842476] stdlib/abort.c:81(__GI_abort)[0x14e63b8287f3] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x79821c2)[0x5582e44e91c2] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x798dd7c)[0x5582e44f4d7c] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796d22c)[0x5582e44d422c] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796cac5)[0x5582e44d3ac5] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(__asan_report_load_n+0x38)[0x5582e44d50e8] sql/spatial.cc:432(wkb_get_double(char const*, Geometry::wkbByteOrder))[0x5582e74dbed2] sql/spatial.cc:936(Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*))[0x5582e74e5038] sql/spatial.cc:3403(Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*))[0x5582e750c913] sql/spatial.cc:484(Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*))[0x5582e7518d04] sql/item_geofunc.cc:112(Item_func_geometry_from_wkb::val_str(String*))[0x5582e6cc49d1] sql/sql_type.cc:7446(Type_handler::Item_send_str(Item*, Protocol*, st_value*) const)[0x5582e5d647b0] sql/sql_type.h:5456(Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const)[0x5582e57adcf3] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x79d8889)[0x5582e453f889] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN8Protocol19send_result_set_rowEP4ListI4ItemE+0xa6b)[0x5582e46fbe97] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN11select_send9send_dataER4ListI4ItemE+0x289)[0x5582e4ac74a9] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN4JOIN10exec_innerEv+0x4607)[0x5582e5249e7b] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN4JOIN4execEv+0x195)[0x5582e5250917] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x844)[0x5582e523f0c2] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0xb00)[0x5582e524351d] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x824ea02)[0x5582e4db5a02] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z21mysql_execute_commandP3THDb+0xb4af)[0x5582e4e16ef6] sql/item.h:1236(Item::send(Protocol*, st_value*))[0x5582e4e46974] sql/protocol.cc:1332(Protocol::send_result_set_row(List<Item>*))[0x5582e4e56708] sql/sql_class.cc:3102(select_send::send_data(List<Item>&))[0x5582e4e64543] sql/sql_class.h:5748(select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long))[0x5582e58398b6] sql/sql_select.cc:4677(JOIN::exec())[0x5582e583add1] nptl/pthread_create.c:442(start_thread)[0x14e63b894b43] x86_64/clone3.S:83(__clone3)[0x14e63b926a00]   Trying to get some variables. Some pointers may be invalid and cause the dump to abort. Query (0x6290000d73f0): SELECT ST_GEOMFROMWKB (0x01070000000100000002010000000000000000000000)   Connection ID (thread ID): 4 Status: NOT_KILLED   where mysqld died. If you see no messages after this, something went terribly wrong... stack_bottom = 0x14e618bbdac0 thread_stack 0x100000 asan_interceptors.o:0(__interceptor_backtrace.part.0)[0x5582e445c6fe] mysys/stacktrace.c:215(my_print_stacktrace)[0x5582e8bef001] sql/signal_handler.cc:238(handle_fatal_signal)[0x5582e650a534] libc_sigaction.c:0(__restore_rt)[0x14e63b842520] nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x14e63b896a7c] posix/raise.c:27(__GI_raise)[0x14e63b842476] stdlib/abort.c:81(__GI_abort)[0x14e63b8287f3] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x79821c2)[0x5582e44e91c2] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x798dd7c)[0x5582e44f4d7c] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796d22c)[0x5582e44d422c] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796cac5)[0x5582e44d3ac5] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(__asan_report_load_n+0x38)[0x5582e44d50e8] sql/spatial.cc:432(wkb_get_double(char const*, Geometry::wkbByteOrder))[0x5582e74dbed2] sql/spatial.cc:936(Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*))[0x5582e74e5038] sql/spatial.cc:3403(Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*))[0x5582e750c913] sql/spatial.cc:484(Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*))[0x5582e7518d04] sql/item_geofunc.cc:112(Item_func_geometry_from_wkb::val_str(String*))[0x5582e6cc49d1] sql/sql_type.cc:7446(Type_handler::Item_send_str(Item*, Protocol*, st_value*) const)[0x5582e5d647b0] sql/sql_type.h:5456(Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const)[0x5582e57adcf3] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x79d8889)[0x5582e453f889] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN8Protocol19send_result_set_rowEP4ListI4ItemE+0xa6b)[0x5582e46fbe97] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN11select_send9send_dataER4ListI4ItemE+0x289)[0x5582e4ac74a9] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN4JOIN10exec_innerEv+0x4607)[0x5582e5249e7b] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN4JOIN4execEv+0x195)[0x5582e5250917] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x844)[0x5582e523f0c2] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0xb00)[0x5582e524351d] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x824ea02)[0x5582e4db5a02] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z21mysql_execute_commandP3THDb+0xb4af)[0x5582e4e16ef6] sql/item.h:1236(Item::send(Protocol*, st_value*))[0x5582e4e46974] sql/protocol.cc:1332(Protocol::send_result_set_row(List<Item>*))[0x5582e4e56708] sql/sql_class.cc:3102(select_send::send_data(List<Item>&))[0x5582e4e64543] sql/sql_class.h:5748(select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long))[0x5582e58398b6] sql/sql_select.cc:4677(JOIN::exec())[0x5582e583add1] nptl/pthread_create.c:442(start_thread)[0x14e63b894b43] x86_64/clone3.S:83(__clone3)[0x14e63b926a00]   Trying to get some variables. Some pointers may be invalid and cause the dump to abort. Query (0x6290000d73f0): SELECT ST_GEOMFROMWKB (0x01070000000100000002010000000000000000000000)   Connection ID (thread ID): 4 Status: NOT_KILLED
          Roel Roel Van de Paar added a comment - - edited

          This memory corruption bug regular produces further issues during *SAN testing with for example broken stacks.
          A fix would be great. Thank you

          Roel Roel Van de Paar added a comment - - edited This memory corruption bug regular produces further issues during *SAN testing with for example broken stacks. A fix would be great. Thank you
          Roel Roel Van de Paar added a comment - - edited

          Using an UBASAN Clang build, we see a variety of stacks:

          SELECT ST_GEOMFROMWKB (0x01070000000100000002010000000000000000000000);
          

          Leads to:

          CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Optimized, UBASAN, Clang)

          /test/11.8_opt_san/sql/spatial.cc:933:26: runtime error: load of value 2, which is not a valid value for type 'wkbByteOrder'
              #0 0x55755395fe32 in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:933:26
              #1 0x557553997128 in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:3402:24
              #2 0x557553959957 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/11.8_opt_san/sql/spatial.cc:481:16
              #3 0x557553435587 in Item_func_geometry_from_wkb::val_str(String*) /test/11.8_opt_san/sql/item_geofunc.cc:107:11
              #4 0x557552b47b29 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.8_opt_san/sql/sql_type.cc:7664:19
              #5 0x557551a3ce04 in Protocol::send_result_set_row(List<Item>*) /test/11.8_opt_san/sql/protocol.cc:1353:15
              #6 0x557551d066a3 in select_send::send_data(List<Item>&) /test/11.8_opt_san/sql/sql_class.cc:3275:17
              #7 0x5575521b1648 in JOIN::exec_inner() /test/11.8_opt_san/sql/sql_select.cc:4908:22
              #8 0x5575521ace21 in JOIN::exec() /test/11.8_opt_san/sql/sql_select.cc:4820:8
              #9 0x557552109a2b in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_opt_san/sql/sql_select.cc:5353:21
              #10 0x557552107c4d in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_opt_san/sql/sql_select.cc:633:10
              #11 0x557551fbbdac in execute_sqlcom_select(THD*, TABLE_LIST*) /test/11.8_opt_san/sql/sql_parse.cc:6177:12
              #12 0x557551fa0fc7 in mysql_execute_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:3966:12
              #13 0x557551f69c92 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_opt_san/sql/sql_parse.cc:7901:18
              #14 0x557551f5eb9e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_opt_san/sql/sql_parse.cc:1903:7
              #15 0x557551f6ca6e in do_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:1416:17
              #16 0x55755274de38 in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_san/sql/sql_connect.cc:1415:11
              #17 0x55755274d280 in handle_one_connection /test/11.8_opt_san/sql/sql_connect.cc:1327:5
              #18 0x557551895b0c in asan_thread_start(void*) asan_interceptors.cpp.o
              #19 0x14d64b49ca93 in start_thread nptl/pthread_create.c:447:8
              #20 0x14d64b529c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
           
          SUMMARY: UndefinedBehaviorSanitizer: invalid-enum-load /test/11.8_opt_san/sql/spatial.cc:933:26 
          

          CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Optimized, UBASAN, Clang)

          /test/11.8_opt_san/sql/spatial.cc:428:7: runtime error: load of value 2, which is not a valid value for type 'Geometry::wkbByteOrder'
              #0 0x557553960592 in wkb_get_double(char const*, Geometry::wkbByteOrder) /test/11.8_opt_san/sql/spatial.cc:428:7
              #1 0x55755395fa91 in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:933:6
              #2 0x557553997128 in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:3402:24
              #3 0x557553959957 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/11.8_opt_san/sql/spatial.cc:481:16
              #4 0x557553435587 in Item_func_geometry_from_wkb::val_str(String*) /test/11.8_opt_san/sql/item_geofunc.cc:107:11
              #5 0x557552b47b29 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.8_opt_san/sql/sql_type.cc:7664:19
              #6 0x557551a3ce04 in Protocol::send_result_set_row(List<Item>*) /test/11.8_opt_san/sql/protocol.cc:1353:15
              #7 0x557551d066a3 in select_send::send_data(List<Item>&) /test/11.8_opt_san/sql/sql_class.cc:3275:17
              #8 0x5575521b1648 in JOIN::exec_inner() /test/11.8_opt_san/sql/sql_select.cc:4908:22
              #9 0x5575521ace21 in JOIN::exec() /test/11.8_opt_san/sql/sql_select.cc:4820:8
              #10 0x557552109a2b in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_opt_san/sql/sql_select.cc:5353:21
              #11 0x557552107c4d in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_opt_san/sql/sql_select.cc:633:10
              #12 0x557551fbbdac in execute_sqlcom_select(THD*, TABLE_LIST*) /test/11.8_opt_san/sql/sql_parse.cc:6177:12
              #13 0x557551fa0fc7 in mysql_execute_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:3966:12
              #14 0x557551f69c92 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_opt_san/sql/sql_parse.cc:7901:18
              #15 0x557551f5eb9e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_opt_san/sql/sql_parse.cc:1903:7
              #16 0x557551f6ca6e in do_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:1416:17
              #17 0x55755274de38 in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_san/sql/sql_connect.cc:1415:11
              #18 0x55755274d280 in handle_one_connection /test/11.8_opt_san/sql/sql_connect.cc:1327:5
              #19 0x557551895b0c in asan_thread_start(void*) asan_interceptors.cpp.o
              #20 0x14d64b49ca93 in start_thread nptl/pthread_create.c:447:8
              #21 0x14d64b529c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
           
          SUMMARY: UndefinedBehaviorSanitizer: invalid-enum-load /test/11.8_opt_san/sql/spatial.cc:428:7 
          

          CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Optimized, UBASAN, Clang)

          /test/11.8_opt_san/sql/spatial.cc:934:49: runtime error: load of value 2, which is not a valid value for type 'wkbByteOrder'
              #0 0x55755395fd38 in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:934:49
              #1 0x557553997128 in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:3402:24
              #2 0x557553959957 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/11.8_opt_san/sql/spatial.cc:481:16
              #3 0x557553435587 in Item_func_geometry_from_wkb::val_str(String*) /test/11.8_opt_san/sql/item_geofunc.cc:107:11
              #4 0x557552b47b29 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.8_opt_san/sql/sql_type.cc:7664:19
              #5 0x557551a3ce04 in Protocol::send_result_set_row(List<Item>*) /test/11.8_opt_san/sql/protocol.cc:1353:15
              #6 0x557551d066a3 in select_send::send_data(List<Item>&) /test/11.8_opt_san/sql/sql_class.cc:3275:17
              #7 0x5575521b1648 in JOIN::exec_inner() /test/11.8_opt_san/sql/sql_select.cc:4908:22
              #8 0x5575521ace21 in JOIN::exec() /test/11.8_opt_san/sql/sql_select.cc:4820:8
              #9 0x557552109a2b in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_opt_san/sql/sql_select.cc:5353:21
              #10 0x557552107c4d in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_opt_san/sql/sql_select.cc:633:10
              #11 0x557551fbbdac in execute_sqlcom_select(THD*, TABLE_LIST*) /test/11.8_opt_san/sql/sql_parse.cc:6177:12
              #12 0x557551fa0fc7 in mysql_execute_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:3966:12
              #13 0x557551f69c92 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_opt_san/sql/sql_parse.cc:7901:18
              #14 0x557551f5eb9e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_opt_san/sql/sql_parse.cc:1903:7
              #15 0x557551f6ca6e in do_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:1416:17
              #16 0x55755274de38 in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_san/sql/sql_connect.cc:1415:11
              #17 0x55755274d280 in handle_one_connection /test/11.8_opt_san/sql/sql_connect.cc:1327:5
              #18 0x557551895b0c in asan_thread_start(void*) asan_interceptors.cpp.o
              #19 0x14d64b49ca93 in start_thread nptl/pthread_create.c:447:8
              #20 0x14d64b529c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
           
          SUMMARY: UndefinedBehaviorSanitizer: invalid-enum-load /test/11.8_opt_san/sql/spatial.cc:934:49 
          

          CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Optimized, UBASAN, Clang)

          ==3853377==ERROR: AddressSanitizer: use-after-poison on address 0x52900009ba9d at pc 0x5575539604c9 bp 0x14d61f2fff60 sp 0x14d61f2fff58
          READ of size 8 at 0x52900009ba9d thread T12
              #0 0x5575539604c8 in wkb_get_double(char const*, Geometry::wkbByteOrder) /test/11.8_opt_san/sql/spatial.cc:430:5
              #1 0x55755395fb0e in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:934:6
              #2 0x557553997128 in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:3402:24
              #3 0x557553959957 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/11.8_opt_san/sql/spatial.cc:481:16
              #4 0x557553435587 in Item_func_geometry_from_wkb::val_str(String*) /test/11.8_opt_san/sql/item_geofunc.cc:107:11
              #5 0x557552b47b29 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.8_opt_san/sql/sql_type.cc:7664:19
              #6 0x557551a3ce04 in Protocol::send_result_set_row(List<Item>*) /test/11.8_opt_san/sql/protocol.cc:1353:15
              #7 0x557551d066a3 in select_send::send_data(List<Item>&) /test/11.8_opt_san/sql/sql_class.cc:3275:17
              #8 0x5575521b1648 in JOIN::exec_inner() /test/11.8_opt_san/sql/sql_select.cc:4908:22
              #9 0x5575521ace21 in JOIN::exec() /test/11.8_opt_san/sql/sql_select.cc:4820:8
              #10 0x557552109a2b in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_opt_san/sql/sql_select.cc:5353:21
              #11 0x557552107c4d in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_opt_san/sql/sql_select.cc:633:10
              #12 0x557551fbbdac in execute_sqlcom_select(THD*, TABLE_LIST*) /test/11.8_opt_san/sql/sql_parse.cc:6177:12
              #13 0x557551fa0fc7 in mysql_execute_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:3966:12
              #14 0x557551f69c92 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_opt_san/sql/sql_parse.cc:7901:18
              #15 0x557551f5eb9e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_opt_san/sql/sql_parse.cc:1903:7
              #16 0x557551f6ca6e in do_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:1416:17
              #17 0x55755274de38 in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_san/sql/sql_connect.cc:1415:11
              #18 0x55755274d280 in handle_one_connection /test/11.8_opt_san/sql/sql_connect.cc:1327:5
              #19 0x557551895b0c in asan_thread_start(void*) asan_interceptors.cpp.o
              #20 0x14d64b49ca93 in start_thread nptl/pthread_create.c:447:8
              #21 0x14d64b529c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
           
          0x52900009ba9d is located 2205 bytes inside of 16400-byte region [0x52900009b200,0x52900009f210)
          allocated by thread T12 here:
              #0 0x557551898023 in malloc (/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-opt/bin/mariadbd+0x1e9f023) (BuildId: d6d823bd2afe91e8ccd044c6ac5d703cff561672)
              #1 0x557554aab972 in my_malloc /test/11.8_opt_san/mysys/my_malloc.c:93:29
              #2 0x557554a875f3 in reset_root_defaults /test/11.8_opt_san/mysys/my_alloc.c:244:30
              #3 0x557551ce5769 in THD::init_for_queries() /test/11.8_opt_san/sql/sql_class.cc:1510:3
              #4 0x55755274bd36 in prepare_new_connection_state(THD*) /test/11.8_opt_san/sql/sql_connect.cc:1253:8
              #5 0x55755275069d in thd_prepare_connection(THD*) /test/11.8_opt_san/sql/sql_connect.cc:1348:3
              #6 0x55755274dcaa in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_san/sql/sql_connect.cc:1405:9
              #7 0x55755274d280 in handle_one_connection /test/11.8_opt_san/sql/sql_connect.cc:1327:5
              #8 0x557551895b0c in asan_thread_start(void*) asan_interceptors.cpp.o
           
          Thread T12 created by T0 here:
              #0 0x55755187d995 in pthread_create (/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-opt/bin/mariadbd+0x1e84995) (BuildId: d6d823bd2afe91e8ccd044c6ac5d703cff561672)
              #1 0x5575518efe13 in create_thread_to_handle_connection(CONNECT*) /test/11.8_opt_san/sql/mysqld.cc:6266:19
              #2 0x5575518f1807 in handle_connections_sockets() /test/11.8_opt_san/sql/mysqld.cc:6502:9
              #3 0x5575518ee9dc in run_main_loop() /test/11.8_opt_san/sql/mysqld.cc:5744:3
              #4 0x5575518e3641 in mysqld_main(int, char**) /test/11.8_opt_san/sql/mysqld.cc:6167:3
              #5 0x14d64b42a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
              #6 0x14d64b42a28a in __libc_start_main csu/../csu/libc-start.c:360:3
              #7 0x5575517fd1d4 in _start (/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-opt/bin/mariadbd+0x1e041d4) (BuildId: d6d823bd2afe91e8ccd044c6ac5d703cff561672)
           
          SUMMARY: AddressSanitizer: use-after-poison /test/11.8_opt_san/sql/spatial.cc:430:5 in wkb_get_double(char const*, Geometry::wkbByteOrder)
          Shadow bytes around the buggy address:
            0x52900009b800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x52900009b880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x52900009b900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x52900009b980: 00 00 f7 00 00 f7 00 07 f7 00 00 00 00 00 05 f7
            0x52900009ba00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7
          =>0x52900009ba80: 00 00 07[f7]00 00 00 00 00 00 00 00 00 00 00 00
            0x52900009bb00: 00 00 00 00 00 03 f7 00 00 00 f7 00 00 f7 00 00
            0x52900009bb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x52900009bc00: 00 00 00 00 f7 00 00 f7 00 00 00 00 00 00 00 00
            0x52900009bc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06
            0x52900009bd00: f7 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00
          Shadow byte legend (one shadow byte represents 8 application bytes):
            Addressable:           00
            Partially addressable: 01 02 03 04 05 06 07 
            Heap left redzone:       fa
            Freed heap region:       fd
            Stack left redzone:      f1
            Stack mid redzone:       f2
            Stack right redzone:     f3
            Stack after return:      f5
            Stack use after scope:   f8
            Global redzone:          f9
            Global init order:       f6
            Poisoned by user:        f7
            Container overflow:      fc
            Array cookie:            ac
            Intra object redzone:    bb
            ASan internal:           fe
            Left alloca redzone:     ca
            Right alloca redzone:    cb
          ==3853377==ABORTING
          241227 13:28:11 [ERROR] mysqld got signal 6 ;
          

          Setup:

          Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18:
               # Note: llvm-17-linker-tools installs /usr/lib/llvm-17/lib/LLVMgold.so, which is needed for compilation, and LLVMgold.so is no longer included in LLVM 18
               sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev llvm-17-linker-tools
               sudo ln -s /usr/lib/llvm-17/lib/LLVMgold.so /usr/lib/llvm-18/lib/LLVMgold.so
          Compiled with: '-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++' and:
              -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
          Set before execution:
              export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter'. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter
          

          Bug confirmed present in:
          MariaDB: 10.5.28 (dbg), 10.5.28 (opt), 10.6.21 (dbg), 10.6.21 (opt), 10.11.11 (dbg), 10.11.11 (opt), 11.4.5 (dbg), 11.4.5 (opt), 11.7.1 (dbg), 11.7.1 (opt), 11.8.0 (dbg), 11.8.0 (opt)

          Roel Roel Van de Paar added a comment - - edited Using an UBASAN Clang build, we see a variety of stacks: SELECT ST_GEOMFROMWKB (0x01070000000100000002010000000000000000000000); Leads to: CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Optimized, UBASAN, Clang) /test/11.8_opt_san/sql/spatial.cc:933:26: runtime error: load of value 2, which is not a valid value for type 'wkbByteOrder' #0 0x55755395fe32 in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:933:26 #1 0x557553997128 in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:3402:24 #2 0x557553959957 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/11.8_opt_san/sql/spatial.cc:481:16 #3 0x557553435587 in Item_func_geometry_from_wkb::val_str(String*) /test/11.8_opt_san/sql/item_geofunc.cc:107:11 #4 0x557552b47b29 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.8_opt_san/sql/sql_type.cc:7664:19 #5 0x557551a3ce04 in Protocol::send_result_set_row(List<Item>*) /test/11.8_opt_san/sql/protocol.cc:1353:15 #6 0x557551d066a3 in select_send::send_data(List<Item>&) /test/11.8_opt_san/sql/sql_class.cc:3275:17 #7 0x5575521b1648 in JOIN::exec_inner() /test/11.8_opt_san/sql/sql_select.cc:4908:22 #8 0x5575521ace21 in JOIN::exec() /test/11.8_opt_san/sql/sql_select.cc:4820:8 #9 0x557552109a2b in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_opt_san/sql/sql_select.cc:5353:21 #10 0x557552107c4d in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_opt_san/sql/sql_select.cc:633:10 #11 0x557551fbbdac in execute_sqlcom_select(THD*, TABLE_LIST*) /test/11.8_opt_san/sql/sql_parse.cc:6177:12 #12 0x557551fa0fc7 in mysql_execute_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:3966:12 #13 0x557551f69c92 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_opt_san/sql/sql_parse.cc:7901:18 #14 0x557551f5eb9e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_opt_san/sql/sql_parse.cc:1903:7 #15 0x557551f6ca6e in do_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:1416:17 #16 0x55755274de38 in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_san/sql/sql_connect.cc:1415:11 #17 0x55755274d280 in handle_one_connection /test/11.8_opt_san/sql/sql_connect.cc:1327:5 #18 0x557551895b0c in asan_thread_start(void*) asan_interceptors.cpp.o #19 0x14d64b49ca93 in start_thread nptl/pthread_create.c:447:8 #20 0x14d64b529c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78   SUMMARY: UndefinedBehaviorSanitizer: invalid-enum-load /test/11.8_opt_san/sql/spatial.cc:933:26 CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Optimized, UBASAN, Clang) /test/11.8_opt_san/sql/spatial.cc:428:7: runtime error: load of value 2, which is not a valid value for type 'Geometry::wkbByteOrder' #0 0x557553960592 in wkb_get_double(char const*, Geometry::wkbByteOrder) /test/11.8_opt_san/sql/spatial.cc:428:7 #1 0x55755395fa91 in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:933:6 #2 0x557553997128 in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:3402:24 #3 0x557553959957 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/11.8_opt_san/sql/spatial.cc:481:16 #4 0x557553435587 in Item_func_geometry_from_wkb::val_str(String*) /test/11.8_opt_san/sql/item_geofunc.cc:107:11 #5 0x557552b47b29 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.8_opt_san/sql/sql_type.cc:7664:19 #6 0x557551a3ce04 in Protocol::send_result_set_row(List<Item>*) /test/11.8_opt_san/sql/protocol.cc:1353:15 #7 0x557551d066a3 in select_send::send_data(List<Item>&) /test/11.8_opt_san/sql/sql_class.cc:3275:17 #8 0x5575521b1648 in JOIN::exec_inner() /test/11.8_opt_san/sql/sql_select.cc:4908:22 #9 0x5575521ace21 in JOIN::exec() /test/11.8_opt_san/sql/sql_select.cc:4820:8 #10 0x557552109a2b in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_opt_san/sql/sql_select.cc:5353:21 #11 0x557552107c4d in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_opt_san/sql/sql_select.cc:633:10 #12 0x557551fbbdac in execute_sqlcom_select(THD*, TABLE_LIST*) /test/11.8_opt_san/sql/sql_parse.cc:6177:12 #13 0x557551fa0fc7 in mysql_execute_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:3966:12 #14 0x557551f69c92 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_opt_san/sql/sql_parse.cc:7901:18 #15 0x557551f5eb9e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_opt_san/sql/sql_parse.cc:1903:7 #16 0x557551f6ca6e in do_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:1416:17 #17 0x55755274de38 in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_san/sql/sql_connect.cc:1415:11 #18 0x55755274d280 in handle_one_connection /test/11.8_opt_san/sql/sql_connect.cc:1327:5 #19 0x557551895b0c in asan_thread_start(void*) asan_interceptors.cpp.o #20 0x14d64b49ca93 in start_thread nptl/pthread_create.c:447:8 #21 0x14d64b529c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78   SUMMARY: UndefinedBehaviorSanitizer: invalid-enum-load /test/11.8_opt_san/sql/spatial.cc:428:7 CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Optimized, UBASAN, Clang) /test/11.8_opt_san/sql/spatial.cc:934:49: runtime error: load of value 2, which is not a valid value for type 'wkbByteOrder' #0 0x55755395fd38 in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:934:49 #1 0x557553997128 in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:3402:24 #2 0x557553959957 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/11.8_opt_san/sql/spatial.cc:481:16 #3 0x557553435587 in Item_func_geometry_from_wkb::val_str(String*) /test/11.8_opt_san/sql/item_geofunc.cc:107:11 #4 0x557552b47b29 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.8_opt_san/sql/sql_type.cc:7664:19 #5 0x557551a3ce04 in Protocol::send_result_set_row(List<Item>*) /test/11.8_opt_san/sql/protocol.cc:1353:15 #6 0x557551d066a3 in select_send::send_data(List<Item>&) /test/11.8_opt_san/sql/sql_class.cc:3275:17 #7 0x5575521b1648 in JOIN::exec_inner() /test/11.8_opt_san/sql/sql_select.cc:4908:22 #8 0x5575521ace21 in JOIN::exec() /test/11.8_opt_san/sql/sql_select.cc:4820:8 #9 0x557552109a2b in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_opt_san/sql/sql_select.cc:5353:21 #10 0x557552107c4d in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_opt_san/sql/sql_select.cc:633:10 #11 0x557551fbbdac in execute_sqlcom_select(THD*, TABLE_LIST*) /test/11.8_opt_san/sql/sql_parse.cc:6177:12 #12 0x557551fa0fc7 in mysql_execute_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:3966:12 #13 0x557551f69c92 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_opt_san/sql/sql_parse.cc:7901:18 #14 0x557551f5eb9e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_opt_san/sql/sql_parse.cc:1903:7 #15 0x557551f6ca6e in do_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:1416:17 #16 0x55755274de38 in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_san/sql/sql_connect.cc:1415:11 #17 0x55755274d280 in handle_one_connection /test/11.8_opt_san/sql/sql_connect.cc:1327:5 #18 0x557551895b0c in asan_thread_start(void*) asan_interceptors.cpp.o #19 0x14d64b49ca93 in start_thread nptl/pthread_create.c:447:8 #20 0x14d64b529c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78   SUMMARY: UndefinedBehaviorSanitizer: invalid-enum-load /test/11.8_opt_san/sql/spatial.cc:934:49 CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Optimized, UBASAN, Clang) ==3853377==ERROR: AddressSanitizer: use-after-poison on address 0x52900009ba9d at pc 0x5575539604c9 bp 0x14d61f2fff60 sp 0x14d61f2fff58 READ of size 8 at 0x52900009ba9d thread T12 #0 0x5575539604c8 in wkb_get_double(char const*, Geometry::wkbByteOrder) /test/11.8_opt_san/sql/spatial.cc:430:5 #1 0x55755395fb0e in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:934:6 #2 0x557553997128 in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.8_opt_san/sql/spatial.cc:3402:24 #3 0x557553959957 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/11.8_opt_san/sql/spatial.cc:481:16 #4 0x557553435587 in Item_func_geometry_from_wkb::val_str(String*) /test/11.8_opt_san/sql/item_geofunc.cc:107:11 #5 0x557552b47b29 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.8_opt_san/sql/sql_type.cc:7664:19 #6 0x557551a3ce04 in Protocol::send_result_set_row(List<Item>*) /test/11.8_opt_san/sql/protocol.cc:1353:15 #7 0x557551d066a3 in select_send::send_data(List<Item>&) /test/11.8_opt_san/sql/sql_class.cc:3275:17 #8 0x5575521b1648 in JOIN::exec_inner() /test/11.8_opt_san/sql/sql_select.cc:4908:22 #9 0x5575521ace21 in JOIN::exec() /test/11.8_opt_san/sql/sql_select.cc:4820:8 #10 0x557552109a2b in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_opt_san/sql/sql_select.cc:5353:21 #11 0x557552107c4d in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_opt_san/sql/sql_select.cc:633:10 #12 0x557551fbbdac in execute_sqlcom_select(THD*, TABLE_LIST*) /test/11.8_opt_san/sql/sql_parse.cc:6177:12 #13 0x557551fa0fc7 in mysql_execute_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:3966:12 #14 0x557551f69c92 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_opt_san/sql/sql_parse.cc:7901:18 #15 0x557551f5eb9e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_opt_san/sql/sql_parse.cc:1903:7 #16 0x557551f6ca6e in do_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:1416:17 #17 0x55755274de38 in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_san/sql/sql_connect.cc:1415:11 #18 0x55755274d280 in handle_one_connection /test/11.8_opt_san/sql/sql_connect.cc:1327:5 #19 0x557551895b0c in asan_thread_start(void*) asan_interceptors.cpp.o #20 0x14d64b49ca93 in start_thread nptl/pthread_create.c:447:8 #21 0x14d64b529c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78   0x52900009ba9d is located 2205 bytes inside of 16400-byte region [0x52900009b200,0x52900009f210) allocated by thread T12 here: #0 0x557551898023 in malloc (/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-opt/bin/mariadbd+0x1e9f023) (BuildId: d6d823bd2afe91e8ccd044c6ac5d703cff561672) #1 0x557554aab972 in my_malloc /test/11.8_opt_san/mysys/my_malloc.c:93:29 #2 0x557554a875f3 in reset_root_defaults /test/11.8_opt_san/mysys/my_alloc.c:244:30 #3 0x557551ce5769 in THD::init_for_queries() /test/11.8_opt_san/sql/sql_class.cc:1510:3 #4 0x55755274bd36 in prepare_new_connection_state(THD*) /test/11.8_opt_san/sql/sql_connect.cc:1253:8 #5 0x55755275069d in thd_prepare_connection(THD*) /test/11.8_opt_san/sql/sql_connect.cc:1348:3 #6 0x55755274dcaa in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_san/sql/sql_connect.cc:1405:9 #7 0x55755274d280 in handle_one_connection /test/11.8_opt_san/sql/sql_connect.cc:1327:5 #8 0x557551895b0c in asan_thread_start(void*) asan_interceptors.cpp.o   Thread T12 created by T0 here: #0 0x55755187d995 in pthread_create (/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-opt/bin/mariadbd+0x1e84995) (BuildId: d6d823bd2afe91e8ccd044c6ac5d703cff561672) #1 0x5575518efe13 in create_thread_to_handle_connection(CONNECT*) /test/11.8_opt_san/sql/mysqld.cc:6266:19 #2 0x5575518f1807 in handle_connections_sockets() /test/11.8_opt_san/sql/mysqld.cc:6502:9 #3 0x5575518ee9dc in run_main_loop() /test/11.8_opt_san/sql/mysqld.cc:5744:3 #4 0x5575518e3641 in mysqld_main(int, char**) /test/11.8_opt_san/sql/mysqld.cc:6167:3 #5 0x14d64b42a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #6 0x14d64b42a28a in __libc_start_main csu/../csu/libc-start.c:360:3 #7 0x5575517fd1d4 in _start (/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-opt/bin/mariadbd+0x1e041d4) (BuildId: d6d823bd2afe91e8ccd044c6ac5d703cff561672)   SUMMARY: AddressSanitizer: use-after-poison /test/11.8_opt_san/sql/spatial.cc:430:5 in wkb_get_double(char const*, Geometry::wkbByteOrder) Shadow bytes around the buggy address: 0x52900009b800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x52900009b880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x52900009b900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x52900009b980: 00 00 f7 00 00 f7 00 07 f7 00 00 00 00 00 05 f7 0x52900009ba00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 =>0x52900009ba80: 00 00 07[f7]00 00 00 00 00 00 00 00 00 00 00 00 0x52900009bb00: 00 00 00 00 00 03 f7 00 00 00 f7 00 00 f7 00 00 0x52900009bb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x52900009bc00: 00 00 00 00 f7 00 00 f7 00 00 00 00 00 00 00 00 0x52900009bc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 0x52900009bd00: f7 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==3853377==ABORTING 241227 13:28:11 [ERROR] mysqld got signal 6 ; Setup: Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18: # Note: llvm-17-linker-tools installs /usr/lib/llvm-17/lib/LLVMgold.so, which is needed for compilation, and LLVMgold.so is no longer included in LLVM 18 sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev llvm-17-linker-tools sudo ln -s /usr/lib/llvm-17/lib/LLVMgold.so /usr/lib/llvm-18/lib/LLVMgold.so Compiled with: '-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++' and: -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON Set before execution: export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1 # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter'. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter Bug confirmed present in: MariaDB: 10.5.28 (dbg), 10.5.28 (opt), 10.6.21 (dbg), 10.6.21 (opt), 10.11.11 (dbg), 10.11.11 (opt), 11.4.5 (dbg), 11.4.5 (opt), 11.7.1 (dbg), 11.7.1 (opt), 11.8.0 (dbg), 11.8.0 (opt)
          Roel Roel Van de Paar added a comment - - edited

          From an older run, I see:

          SELECT ST_GEOMFROMWKB (0x01050000000100000002040000000100000000000000000000000000000000000000);
          

          Lead to a few additional stacks:

          UBSAN|load of value X, which is not a valid value for type 'wkbByteOrder'|sql/spatial.cc|Gis_point::init_from_wkb|Gis_line_string::init_from_wkb|Gis_multi_line_string::init_from_wkb|Geometry::create_from_wkb
          UBSAN|load of value X, which is not a valid value for type 'Geometry::wkbByteOrder'|sql/spatial.cc|wkb_get_double|Gis_point::init_from_wkb|Gis_line_string::init_from_wkb|Gis_multi_line_string::init_from_wkb
          

          Roel Roel Van de Paar added a comment - - edited From an older run, I see: SELECT ST_GEOMFROMWKB (0x01050000000100000002040000000100000000000000000000000000000000000000); Lead to a few additional stacks: UBSAN|load of value X, which is not a valid value for type 'wkbByteOrder'|sql/spatial.cc|Gis_point::init_from_wkb|Gis_line_string::init_from_wkb|Gis_multi_line_string::init_from_wkb|Geometry::create_from_wkb UBSAN|load of value X, which is not a valid value for type 'Geometry::wkbByteOrder'|sql/spatial.cc|wkb_get_double|Gis_point::init_from_wkb|Gis_line_string::init_from_wkb|Gis_multi_line_string::init_from_wkb

          People

            Gosselin Dave Gosselin
            Roel Roel Van de Paar
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.