Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Fixed
-
10.3(EOL), 10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL)
Description
Further to MDEV-24511:
SET SESSION sql_mode='ORACLE'; |
CREATE TABLE t (a CHAR,b GEOMETRY) ENGINE InnoDB; |
INSERT INTO t (a) VALUES (uuid_short()); |
UPDATE t SET a=a+12,b=3 LIMIT 3; |
CREATE FULLTEXT INDEX i ON t (s2); |
Leads to:
10.8.1 0c5d1342ae6b5ab3256848be7a83e5c3b1f21566 (Debug) |
mysqld: /test/10.8_dbg/sql/field.h:1159: const uchar* Field::ptr_in_record(const uchar*) const: Assertion `l_offset >= 0 && table->s->rec_buff_length - l_offset > 0' failed.
|
10.8.1 0c5d1342ae6b5ab3256848be7a83e5c3b1f21566 (Debug) |
Core was generated by `/test/MD290122-mariadb-10.8.1-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
|
Program terminated with signal SIGABRT, Aborted.
|
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
|
[Current thread is 1 (Thread 0x154b801ea700 (LWP 3094038))]
|
(gdb) bt
|
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
|
#1 0x0000154ba087d859 in __GI_abort () at abort.c:79
|
#2 0x0000154ba087d729 in __assert_fail_base (fmt=0x154ba0a13588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x562c1958b1d8 "l_offset >= 0 && table->s->rec_buff_length - l_offset > 0", file=0x562c19541190 "/test/10.8_dbg/sql/field.h", line=1159, function=<optimized out>) at assert.c:92
|
#3 0x0000154ba088ef36 in __GI___assert_fail (assertion=assertion@entry=0x562c1958b1d8 "l_offset >= 0 && table->s->rec_buff_length - l_offset > 0", file=file@entry=0x562c19541190 "/test/10.8_dbg/sql/field.h", line=line@entry=1159, function=function@entry=0x562c1958b1a0 "const uchar* Field::ptr_in_record(const uchar*) const") at assert.c:101
|
#4 0x0000562c18b76b93 in Field::ptr_in_record (record=<optimized out>, this=0x154b280285d0) at /test/10.8_dbg/sql/field.h:1159
|
#5 Column_definition::Column_definition (this=0x154b28014930, thd=0x154b28000db8, old_field=<optimized out>, orig_field=0x154b280285d0) at /test/10.8_dbg/sql/field.cc:10872
|
#6 0x0000562c189754d1 in Create_field::Create_field (orig_field=0x154b280285d0, old_field=0x154b280285d0, thd=0x154b28000db8, this=0x154b28014930) at /test/10.8_dbg/sql/field.h:5686
|
#7 mysql_prepare_alter_table (thd=thd@entry=0x154b28000db8, table=table@entry=0x154b28028148, create_info=create_info@entry=0x154b801e8fc0, alter_info=alter_info@entry=0x154b801e8ed0, alter_ctx=alter_ctx@entry=0x154b801e8190) at /test/10.8_dbg/sql/sql_table.cc:8166
|
#8 0x0000562c189855ad in mysql_alter_table (thd=thd@entry=0x154b28000db8, new_db=new_db@entry=0x154b28013ee8, new_name=new_name@entry=0x154b28013ef8, create_info=create_info@entry=0x154b801e8fc0, table_list=<optimized out>, table_list@entry=0x154b28013ed0, alter_info=alter_info@entry=0x154b801e8ed0, order_num=<optimized out>, order=<optimized out>, ignore=<optimized out>, if_exists=<optimized out>) at /test/10.8_dbg/sql/sql_table.cc:10308
|
#9 0x0000562c18895631 in mysql_execute_command (thd=thd@entry=0x154b28000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.8_dbg/sql/structs.h:568
|
#10 0x0000562c18880db7 in mysql_parse (thd=thd@entry=0x154b28000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x154b801e9400) at /test/10.8_dbg/sql/sql_parse.cc:8027
|
#11 0x0000562c1888fa53 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x154b28000db8, packet=packet@entry=0x154b2800b889 "CREATE FULLTEXT INDEX i ON t (s2)", packet_length=packet_length@entry=33, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_class.h:1362
|
#12 0x0000562c18892e9a in do_command (thd=0x154b28000db8, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_parse.cc:1402
|
#13 0x0000562c18a0e110 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x562c1ca0d208, put_in_cache=put_in_cache@entry=true) at /test/10.8_dbg/sql/sql_connect.cc:1418
|
#14 0x0000562c18a0e715 in handle_one_connection (arg=arg@entry=0x562c1ca0d208) at /test/10.8_dbg/sql/sql_connect.cc:1312
|
#15 0x0000562c18e97c8e in pfs_spawn_thread (arg=0x562c1c920348) at /test/10.8_dbg/storage/perfschema/pfs.cc:2201
|
#16 0x0000154ba0d8c609 in start_thread (arg=<optimized out>) at pthread_create.c:477
|
#17 0x0000154ba097a293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
Bug confirmed present in:
MariaDB: 10.3.33 (dbg), 10.4.23 (dbg), 10.5.14 (dbg), 10.6.6 (dbg), 10.7.2 (dbg), 10.8.1 (dbg)
Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.42 (dbg), 10.2.42 (opt), 10.3.33 (opt), 10.4.23 (opt), 10.5.14 (opt), 10.6.6 (opt), 10.7.2 (opt), 10.8.1 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.36 (dbg), 5.7.36 (opt), 8.0.27 (dbg), 8.0.27 (opt)
Attachments
Issue Links
- is duplicated by
-
MDEV-35404 Assertion `l_offset >= 0 && table->s->rec_buff_length - l_offset > 0' failed in Field::ptr_in_record
-
- Closed
-
- relates to
-
MDEV-24511 null field is created with CREATE..SELECT
-
- Closed
-
-
MDEV-35404 Assertion `l_offset >= 0 && table->s->rec_buff_length - l_offset > 0' failed in Field::ptr_in_record
-
- Closed
-
Version: '11.6.2-MariaDB-debug-log' d8dad8c3b54cd09fefce7bc3b9749f427eed9709
=================================================================
==314680==ERROR: AddressSanitizer: use-after-poison on address 0x61a0000d9378 at pc 0x55bfc5b9ce6d bp 0x7f0057232e90 sp 0x7f0057232e80
READ of size 1 at 0x61a0000d9378 thread T9 (one_connection)
#0 0x55bfc5b9ce6c in Field::is_null_in_record(unsigned char const*) const /11.6/src/sql/field.h:1435
#1 0x55bfc63216b2 in Column_definition::Column_definition(THD*, Field*, Field*) /11.6/src/sql/field.cc:11047
#2 0x55bfc58f7f51 in Create_field::Create_field(THD*, Field*, Field*) /11.6/src/sql/field.h:5774
#3 0x55bfc5cc44ed in mysql_prepare_alter_table(THD*, TABLE*, Table_specification_st*, Alter_info*, Alter_table_ctx*) /11.6/src/sql/sql_table.cc:8451
#4 0x55bfc5cd7d3a in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /11.6/src/sql/sql_table.cc:10922
#5 0x55bfc59a2711 in mysql_execute_command(THD*, bool) /11.6/src/sql/sql_parse.cc:4230
#6 0x55bfc59bc35b in mysql_parse(THD*, char*, unsigned int, Parser_state*) /11.6/src/sql/sql_parse.cc:7898
#7 0x55bfc5992a7b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.6/src/sql/sql_parse.cc:1903
#8 0x55bfc598f71e in do_command(THD*, bool) /11.6/src/sql/sql_parse.cc:1416
#9 0x55bfc5e9b039 in do_handle_one_connection(CONNECT*, bool) /11.6/src/sql/sql_connect.cc:1438
#10 0x55bfc5e9ab8c in handle_one_connection /11.6/src/sql/sql_connect.cc:1350
#11 0x55bfc6b8e885 in pfs_spawn_thread /11.6/src/storage/perfschema/pfs.cc:2198
#12 0x7f006bfd3608 in start_thread /build/glibc-LcI20x/glibc-2.31/nptl/pthread_create.c:477
#13 0x7f006bb0e352 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f352) (BuildId: 0702430aef5fa3dda43986563e9ffcc47efbd75e)
0x61a0000d9378 is located 248 bytes inside of 1156-byte region [0x61a0000d9280,0x61a0000d9704)
allocated by thread T9 (one_connection) here:
#0 0x7f006c5318ff in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x55bfc79a5887 in sf_malloc /11.6/src/mysys/safemalloc.c:126
#2 0x55bfc7974711 in my_malloc /11.6/src/mysys/my_malloc.c:93
#3 0x55bfc794669b in root_alloc /11.6/src/mysys/my_alloc.c:66
#4 0x55bfc7948082 in alloc_root /11.6/src/mysys/my_alloc.c:332
#5 0x55bfc7949e05 in memdup_root /11.6/src/mysys/my_alloc.c:665
#6 0x55bfc5d90a4a in TABLE_SHARE::init_from_binary_frm_image(THD*, bool, unsigned char const*, unsigned long, unsigned char const*, unsigned long) /11.6/src/sql/table.cc:1888
#7 0x55bfc5d88a34 in open_table_def(THD*, TABLE_SHARE*, unsigned int) /11.6/src/sql/table.cc:765
#8 0x55bfc61969f1 in tdc_acquire_share(THD*, TABLE_LIST*, unsigned int, TABLE**) /11.6/src/sql/table_cache.cc:857
#9 0x55bfc57d2554 in open_table(THD*, TABLE_LIST*, Open_table_context*) /11.6/src/sql/sql_base.cc:2088
#10 0x55bfc57deb21 in open_and_process_table /11.6/src/sql/sql_base.cc:4172
#11 0x55bfc57e176e in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /11.6/src/sql/sql_base.cc:4658
#12 0x55bfc57e6855 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /11.6/src/sql/sql_base.cc:5632
#13 0x55bfc580b16b in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /11.6/src/sql/sql_base.h:533
#14 0x55bfc58cc8e3 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /11.6/src/sql/sql_insert.cc:784
#15 0x55bfc59a421c in mysql_execute_command(THD*, bool) /11.6/src/sql/sql_parse.cc:4470
#16 0x55bfc59bc35b in mysql_parse(THD*, char*, unsigned int, Parser_state*) /11.6/src/sql/sql_parse.cc:7898
#17 0x55bfc5992a7b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.6/src/sql/sql_parse.cc:1903
#18 0x55bfc598f71e in do_command(THD*, bool) /11.6/src/sql/sql_parse.cc:1416
#19 0x55bfc5e9b039 in do_handle_one_connection(CONNECT*, bool) /11.6/src/sql/sql_connect.cc:1438
#20 0x55bfc5e9ab8c in handle_one_connection /11.6/src/sql/sql_connect.cc:1350
#21 0x55bfc6b8e885 in pfs_spawn_thread /11.6/src/storage/perfschema/pfs.cc:2198
#22 0x7f006bfd3608 in start_thread /build/glibc-LcI20x/glibc-2.31/nptl/pthread_create.c:477
Thread T9 (one_connection) created by T0 here:
#0 0x7f006c49d175 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:208
#1 0x55bfc6b8a4a9 in my_thread_create /11.6/src/storage/perfschema/my_thread.h:38
#2 0x55bfc6b8ec78 in pfs_spawn_thread_v1 /11.6/src/storage/perfschema/pfs.cc:2249
#3 0x55bfc55910bb in inline_mysql_thread_create /11.6/src/include/mysql/psi/mysql_thread.h:1139
#4 0x55bfc55aaa87 in create_thread_to_handle_connection(CONNECT*) /11.6/src/sql/mysqld.cc:6272
#5 0x55bfc55ab0f2 in create_new_thread(CONNECT*) /11.6/src/sql/mysqld.cc:6334
#6 0x55bfc55ab41f in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /11.6/src/sql/mysqld.cc:6396
#7 0x55bfc55ac11c in handle_connections_sockets() /11.6/src/sql/mysqld.cc:6509
#8 0x55bfc55a8aea in run_main_loop /11.6/src/sql/mysqld.cc:5750
#9 0x55bfc55aa2d1 in mysqld_main(int, char**) /11.6/src/sql/mysqld.cc:6173
#10 0x55bfc559035c in main /11.6/src/sql/main.cc:34
#11 0x7f006ba13082 in __libc_start_main ../csu/libc-start.c:308
SUMMARY: AddressSanitizer: use-after-poison /11.6/src/sql/field.h:1435 in Field::is_null_in_record(unsigned char const*) const
Shadow bytes around the buggy address:
0x61a0000d9080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x61a0000d9100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x61a0000d9180: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x61a0000d9200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x61a0000d9280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x61a0000d9300: 00 00 00 00 f7 00 00 f7 01 f7 02 f7 00 00 01[f7]
0x61a0000d9380: 01 f7 00 00 00 f7 f7 f7 00 00 00 00 00 f7 00 00
0x61a0000d9400: 00 00 f7 00 f7 f7 f7 f7 00 00 00 00 00 00 00 00
0x61a0000d9480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x61a0000d9500: 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00 00
0x61a0000d9580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==314680==ABORTING
MDEV-35404is probably a duplicate of this issue