Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-28466

ASAN heap-use-after-free in _mi_make_key or calc_row_difference

    XMLWordPrintable

    Details

      Description

      CREATE TABLE t (a VARCHAR(8), b TEXT AS (a) VIRTUAL, KEY(b(8))) WITH SYSTEM VERSIONING;
      INSERT INTO t (a) VALUES ('foo'),('bar');
      UPDATE t SET a = 'qux';
       
      # Cleanup
      DROP TABLE t;
      

      With MyISAM:

      10.4 6e7c6fcf

      ==929408==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000213b0 at pc 0x00000080ebc7 bp 0x7ff1cd428650 sp 0x7ff1cd427e18
      READ of size 3 at 0x60c0000213b0 thread T5
          #0 0x80ebc6 in __asan_memcpy (/mnt8t/bld/10.4-asan/bin/mysqld+0x80ebc6)
          #1 0x30801a6 in _mi_make_key /data/src/10.4/storage/myisam/mi_key.c:149:9
          #2 0x3104d24 in mi_update /data/src/10.4/storage/myisam/mi_update.c:111:18
          #3 0x2fed7f2 in ha_myisam::update_row(unsigned char const*, unsigned char const*) /data/src/10.4/storage/myisam/ha_myisam.cc:1918:10
          #4 0x172a5ab in handler::ha_update_row(unsigned char const*, unsigned char const*) /data/src/10.4/sql/handler.cc:6834:3
          #5 0x1047e9c in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*) /data/src/10.4/sql/sql_update.cc:1082:31
          #6 0xc724fa in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4450:21
          #7 0xc55486 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8011:18
          #8 0xc4d787 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1873:7
          #9 0xc57cb3 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378:17
          #10 0x11d2205 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420:11
          #11 0x11d1763 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316:3
          #12 0x22f3d11 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869:3
          #13 0x7ff1d6f42ea6 in start_thread nptl/pthread_create.c:477:8
          #14 0x7ff1d6c7adee in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
       
      0x60c0000213b0 is located 112 bytes inside of 124-byte region [0x60c000021340,0x60c0000213bc)
      freed by thread T5 here:
          #0 0x80f4ed in free (/mnt8t/bld/10.4-asan/bin/mysqld+0x80f4ed)
          #1 0x32864f7 in free_memory /data/src/10.4/mysys/safemalloc.c:279:3
          #2 0x328654d in sf_free /data/src/10.4/mysys/safemalloc.c:197:3
          #3 0x323ef5f in my_free /data/src/10.4/mysys/my_malloc.c:222:5
          #4 0x87ad25 in Binary_string::free() /data/src/10.4/sql/sql_string.h:610:7
          #5 0x8dfca3 in Binary_string::set(char const*, unsigned long) /data/src/10.4/sql/sql_string.h:467:5
          #6 0x8de0f9 in String::set(char const*, unsigned long, charset_info_st const*) /data/src/10.4/sql/sql_string.h:769:20
          #7 0x1664cf0 in Field_varstring::val_str(String*, String*) /data/src/10.4/sql/field.cc:7787:12
          #8 0x8aebcc in Field::val_str(String*) /data/src/10.4/sql/field.h:865:48
          #9 0x16a9520 in Field_blob::store_field(Field*) /data/src/10.4/sql/field.h:3950:11
          #10 0x16c0830 in field_conv_incompatible(Field*, Field*) /data/src/10.4/sql/field_conv.cc:851:14
          #11 0x16c062f in field_conv(Field*, Field*) /data/src/10.4/sql/field_conv.cc:864:10
          #12 0x177566d in save_field_in_field(Field*, bool*, Field*, bool) /data/src/10.4/sql/item.cc:6561:8
          #13 0x17978ea in Item_field::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6612:10
          #14 0x10e5b94 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.4/sql/table.cc:8555:24
          #15 0xa7633f in fill_record(THD*, TABLE*, List<Item>&, List<Item>&, bool, bool) /data/src/10.4/sql/sql_base.cc:8591:18
          #16 0xa77253 in fill_record_n_invoke_before_triggers(THD*, TABLE*, List<Item>&, List<Item>&, bool, trg_event_type) /data/src/10.4/sql/sql_base.cc:8719:11
          #17 0x1047907 in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*) /data/src/10.4/sql/sql_update.cc:1017:11
          #18 0xc724fa in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4450:21
          #19 0xc55486 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8011:18
          #20 0xc4d787 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1873:7
          #21 0xc57cb3 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378:17
          #22 0x11d2205 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420:11
          #23 0x11d1763 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316:3
          #24 0x22f3d11 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869:3
          #25 0x7ff1d6f42ea6 in start_thread nptl/pthread_create.c:477:8
       
      previously allocated by thread T5 here:
          #0 0x80f76d in malloc (/mnt8t/bld/10.4-asan/bin/mysqld+0x80f76d)
          #1 0x32854b0 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118:28
          #2 0x323e9df in my_malloc /data/src/10.4/mysys/my_malloc.c:101:10
          #3 0xf64d72 in Binary_string::realloc_raw(unsigned long) /data/src/10.4/sql/sql_string.cc:101:32
          #4 0x87aec3 in Binary_string::realloc(unsigned long) /data/src/10.4/sql/sql_string.h:625:9
          #5 0xf667cd in Binary_string::copy() /data/src/10.4/sql/sql_string.cc:220:12
          #6 0x16b4b6d in String::copy() /data/src/10.4/sql/sql_string.h:823:27
          #7 0x16a9649 in Field_blob::store_field(Field*) /data/src/10.4/sql/field.h:3953:13
          #8 0x16c0830 in field_conv_incompatible(Field*, Field*) /data/src/10.4/sql/field_conv.cc:851:14
          #9 0x16c062f in field_conv(Field*, Field*) /data/src/10.4/sql/field_conv.cc:864:10
          #10 0x177566d in save_field_in_field(Field*, bool*, Field*, bool) /data/src/10.4/sql/item.cc:6561:8
          #11 0x17978ea in Item_field::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6612:10
          #12 0x10e5b94 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.4/sql/table.cc:8555:24
          #13 0x16fd7b9 in handler::ha_rnd_next(unsigned char*) /data/src/10.4/sql/handler.cc:2906:16
          #14 0x1ca5062 in rr_sequential(READ_RECORD*) /data/src/10.4/sql/records.cc:485:35
          #15 0xa2ac08 in READ_RECORD::read_record() /data/src/10.4/sql/records.h:70:30
          #16 0x104751c in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*) /data/src/10.4/sql/sql_update.cc:1001:23
          #17 0xc724fa in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4450:21
          #18 0xc55486 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8011:18
          #19 0xc4d787 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1873:7
          #20 0xc57cb3 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378:17
          #21 0x11d2205 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420:11
          #22 0x11d1763 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316:3
          #23 0x22f3d11 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869:3
          #24 0x7ff1d6f42ea6 in start_thread nptl/pthread_create.c:477:8
       
      Thread T5 created by T0 here:
          #0 0x7fa19a in pthread_create (/mnt8t/bld/10.4-asan/bin/mysqld+0x7fa19a)
          #1 0x22f9fb9 in spawn_thread_v1(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.4/storage/perfschema/pfs.cc:1919:15
          #2 0x84a79a in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.4/include/mysql/psi/mysql_thread.h:1275:11
          #3 0x85d363 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6280:15
          #4 0x85deaa in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6350:3
          #5 0x85ed0e in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6448:3
          #6 0x85b702 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6606:5
          #7 0x84eaa7 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5938:3
          #8 0x841d11 in main /data/src/10.4/sql/main.cc:25:10
          #9 0x7ff1d6ba3d09 in __libc_start_main csu/../csu/libc-start.c:308:16
       
      SUMMARY: AddressSanitizer: heap-use-after-free (/mnt8t/bld/10.4-asan/bin/mysqld+0x80ebc6) in __asan_memcpy
      Shadow bytes around the buggy address:
        0x0c187fffc220: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c187fffc230: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
        0x0c187fffc240: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
        0x0c187fffc250: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c187fffc260: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
      =>0x0c187fffc270: fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa fa fa
        0x0c187fffc280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
        0x0c187fffc290: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
        0x0c187fffc2a0: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
        0x0c187fffc2b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c187fffc2c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
        Shadow gap:              cc
      ==929408==ABORTING
      

      With InnoDB --mysqld=--innodb --mysqld=--default-storage-engine=InnoDB:

      ==929547==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c00004e230 at pc 0x0000007ac2d6 bp 0x7f397a345920 sp 0x7f397a3450c8
      READ of size 3 at 0x60c00004e230 thread T27
          #0 0x7ac2d5 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) (/mnt8t/bld/10.4-asan/bin/mysqld+0x7ac2d5)
          #1 0x7ac7ca in memcmp (/mnt8t/bld/10.4-asan/bin/mysqld+0x7ac7ca)
          #2 0x2442b17 in calc_row_difference(upd_t*, unsigned char const*, unsigned char const*, TABLE*, unsigned char*, unsigned long, row_prebuilt_t*, unsigned long&) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:8562:20
          #3 0x2440108 in ha_innobase::update_row(unsigned char const*, unsigned char const*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:8900:10
          #4 0x172a5ab in handler::ha_update_row(unsigned char const*, unsigned char const*) /data/src/10.4/sql/handler.cc:6834:3
          #5 0x1047e9c in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*) /data/src/10.4/sql/sql_update.cc:1082:31
          #6 0xc724fa in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4450:21
          #7 0xc55486 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8011:18
          #8 0xc4d787 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1873:7
          #9 0xc57cb3 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378:17
          #10 0x11d2205 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420:11
          #11 0x11d1763 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316:3
          #12 0x22f3d11 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869:3
          #13 0x7f3990d6bea6 in start_thread nptl/pthread_create.c:477:8
          #14 0x7f3990aa3dee in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
       
      0x60c00004e230 is located 112 bytes inside of 124-byte region [0x60c00004e1c0,0x60c00004e23c)
      freed by thread T27 here:
          #0 0x80f4ed in free (/mnt8t/bld/10.4-asan/bin/mysqld+0x80f4ed)
          #1 0x32864f7 in free_memory /data/src/10.4/mysys/safemalloc.c:279:3
          #2 0x328654d in sf_free /data/src/10.4/mysys/safemalloc.c:197:3
          #3 0x323ef5f in my_free /data/src/10.4/mysys/my_malloc.c:222:5
          #4 0x87ad25 in Binary_string::free() /data/src/10.4/sql/sql_string.h:610:7
          #5 0x8dfca3 in Binary_string::set(char const*, unsigned long) /data/src/10.4/sql/sql_string.h:467:5
          #6 0x8de0f9 in String::set(char const*, unsigned long, charset_info_st const*) /data/src/10.4/sql/sql_string.h:769:20
          #7 0x1664cf0 in Field_varstring::val_str(String*, String*) /data/src/10.4/sql/field.cc:7787:12
          #8 0x8aebcc in Field::val_str(String*) /data/src/10.4/sql/field.h:865:48
          #9 0x16a9520 in Field_blob::store_field(Field*) /data/src/10.4/sql/field.h:3950:11
          #10 0x16c0830 in field_conv_incompatible(Field*, Field*) /data/src/10.4/sql/field_conv.cc:851:14
          #11 0x16c062f in field_conv(Field*, Field*) /data/src/10.4/sql/field_conv.cc:864:10
          #12 0x177566d in save_field_in_field(Field*, bool*, Field*, bool) /data/src/10.4/sql/item.cc:6561:8
          #13 0x17978ea in Item_field::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6612:10
          #14 0x10e5b94 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.4/sql/table.cc:8555:24
          #15 0xa7633f in fill_record(THD*, TABLE*, List<Item>&, List<Item>&, bool, bool) /data/src/10.4/sql/sql_base.cc:8591:18
          #16 0xa77253 in fill_record_n_invoke_before_triggers(THD*, TABLE*, List<Item>&, List<Item>&, bool, trg_event_type) /data/src/10.4/sql/sql_base.cc:8719:11
          #17 0x1047907 in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*) /data/src/10.4/sql/sql_update.cc:1017:11
          #18 0xc724fa in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4450:21
          #19 0xc55486 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8011:18
          #20 0xc4d787 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1873:7
          #21 0xc57cb3 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378:17
          #22 0x11d2205 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420:11
          #23 0x11d1763 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316:3
          #24 0x22f3d11 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869:3
          #25 0x7f3990d6bea6 in start_thread nptl/pthread_create.c:477:8
       
      previously allocated by thread T27 here:
          #0 0x80f76d in malloc (/mnt8t/bld/10.4-asan/bin/mysqld+0x80f76d)
          #1 0x32854b0 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118:28
          #2 0x323e9df in my_malloc /data/src/10.4/mysys/my_malloc.c:101:10
          #3 0xf64d72 in Binary_string::realloc_raw(unsigned long) /data/src/10.4/sql/sql_string.cc:101:32
          #4 0x87aec3 in Binary_string::realloc(unsigned long) /data/src/10.4/sql/sql_string.h:625:9
          #5 0xf667cd in Binary_string::copy() /data/src/10.4/sql/sql_string.cc:220:12
          #6 0x16b4b6d in String::copy() /data/src/10.4/sql/sql_string.h:823:27
          #7 0x16a9649 in Field_blob::store_field(Field*) /data/src/10.4/sql/field.h:3953:13
          #8 0x16c0830 in field_conv_incompatible(Field*, Field*) /data/src/10.4/sql/field_conv.cc:851:14
          #9 0x16c062f in field_conv(Field*, Field*) /data/src/10.4/sql/field_conv.cc:864:10
          #10 0x177566d in save_field_in_field(Field*, bool*, Field*, bool) /data/src/10.4/sql/item.cc:6561:8
          #11 0x17978ea in Item_field::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6612:10
          #12 0x10e5b94 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.4/sql/table.cc:8555:24
          #13 0x16fd7b9 in handler::ha_rnd_next(unsigned char*) /data/src/10.4/sql/handler.cc:2906:16
          #14 0x1ca5062 in rr_sequential(READ_RECORD*) /data/src/10.4/sql/records.cc:485:35
          #15 0xa2ac08 in READ_RECORD::read_record() /data/src/10.4/sql/records.h:70:30
          #16 0x104751c in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*) /data/src/10.4/sql/sql_update.cc:1001:23
          #17 0xc724fa in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4450:21
          #18 0xc55486 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8011:18
          #19 0xc4d787 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1873:7
          #20 0xc57cb3 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378:17
          #21 0x11d2205 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420:11
          #22 0x11d1763 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316:3
          #23 0x22f3d11 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869:3
          #24 0x7f3990d6bea6 in start_thread nptl/pthread_create.c:477:8
       
      Thread T27 created by T0 here:
          #0 0x7fa19a in pthread_create (/mnt8t/bld/10.4-asan/bin/mysqld+0x7fa19a)
          #1 0x22f9fb9 in spawn_thread_v1(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.4/storage/perfschema/pfs.cc:1919:15
          #2 0x84a79a in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.4/include/mysql/psi/mysql_thread.h:1275:11
          #3 0x85d363 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6280:15
          #4 0x85deaa in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6350:3
          #5 0x85ed0e in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6448:3
          #6 0x85b702 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6606:5
          #7 0x84eaa7 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5938:3
          #8 0x841d11 in main /data/src/10.4/sql/main.cc:25:10
          #9 0x7f39909ccd09 in __libc_start_main csu/../csu/libc-start.c:308:16
       
      SUMMARY: AddressSanitizer: heap-use-after-free (/mnt8t/bld/10.4-asan/bin/mysqld+0x7ac2d5) in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)
      Shadow bytes around the buggy address:
        0x0c1880001bf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c1880001c00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
        0x0c1880001c10: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
        0x0c1880001c20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c1880001c30: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
      =>0x0c1880001c40: fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa fa fa
        0x0c1880001c50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
        0x0c1880001c60: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
        0x0c1880001c70: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
        0x0c1880001c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c1880001c90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
        Shadow gap:              cc
      ==929547==ABORTING
      

      Reproducible on 10.4+ with MyISAM and InnoDB as above.
      Not reproducible on 10.3.

        Attachments

          Activity

            People

            Assignee:
            nikitamalyavin Nikita Malyavin
            Reporter:
            elenst Elena Stepanova
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:

                Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.