[MDEV-28466] ASAN heap-use-after-free in _mi_make_key or calc_row_difference - Jira

XML

Word

Printable

Details

Type: Bug
Status: Confirmed (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.4, 10.5, 10.6, 10.7, 10.8, 10.11, 11.0, 11.1, 11.2, 11.3, 11.4
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2, 11.3, 11.4
Component/s: Versioned Tables, Virtual Columns
Labels:
None

Description

CREATE TABLE t (a VARCHAR(8), b TEXT AS (a) VIRTUAL, KEY(b(8))) WITH SYSTEM VERSIONING;

INSERT INTO t (a) VALUES ('foo'),('bar');

UPDATE t SET a = 'qux';

# Cleanup

DROP TABLE t;

With MyISAM:

10.4 6e7c6fcf
==929408==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000213b0 at pc 0x00000080ebc7 bp 0x7ff1cd428650 sp 0x7ff1cd427e18
READ of size 3 at 0x60c0000213b0 thread T5
#0 0x80ebc6 in __asan_memcpy (/mnt8t/bld/10.4-asan/bin/mysqld+0x80ebc6)
#1 0x30801a6 in _mi_make_key /data/src/10.4/storage/myisam/mi_key.c:149:9
#2 0x3104d24 in mi_update /data/src/10.4/storage/myisam/mi_update.c:111:18
#3 0x2fed7f2 in ha_myisam::update_row(unsigned char const, unsigned char const) /data/src/10.4/storage/myisam/ha_myisam.cc:1918:10
#4 0x172a5ab in handler::ha_update_row(unsigned char const, unsigned char const) /data/src/10.4/sql/handler.cc:6834:3
#5 0x1047e9c in mysql_update(THD, TABLE_LIST, List<Item>&, List<Item>&, Item, unsigned int, st_order, unsigned long long, bool, unsigned long long, unsigned long long) /data/src/10.4/sql/sql_update.cc:1082:31
#6 0xc724fa in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4450:21
#7 0xc55486 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8011:18
#8 0xc4d787 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1873:7
#9 0xc57cb3 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378:17
#10 0x11d2205 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420:11
#11 0x11d1763 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316:3
#12 0x22f3d11 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869:3
#13 0x7ff1d6f42ea6 in start_thread nptl/pthread_create.c:477:8
#14 0x7ff1d6c7adee in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x60c0000213b0 is located 112 bytes inside of 124-byte region [0x60c000021340,0x60c0000213bc)
freed by thread T5 here:
#0 0x80f4ed in free (/mnt8t/bld/10.4-asan/bin/mysqld+0x80f4ed)
#1 0x32864f7 in free_memory /data/src/10.4/mysys/safemalloc.c:279:3
#2 0x328654d in sf_free /data/src/10.4/mysys/safemalloc.c:197:3
#3 0x323ef5f in my_free /data/src/10.4/mysys/my_malloc.c:222:5
#4 0x87ad25 in Binary_string::free() /data/src/10.4/sql/sql_string.h:610:7
#5 0x8dfca3 in Binary_string::set(char const*, unsigned long) /data/src/10.4/sql/sql_string.h:467:5
#6 0x8de0f9 in String::set(char const, unsigned long, charset_info_st const) /data/src/10.4/sql/sql_string.h:769:20
#7 0x1664cf0 in Field_varstring::val_str(String, String) /data/src/10.4/sql/field.cc:7787:12
#8 0x8aebcc in Field::val_str(String*) /data/src/10.4/sql/field.h:865:48
#9 0x16a9520 in Field_blob::store_field(Field*) /data/src/10.4/sql/field.h:3950:11
#10 0x16c0830 in field_conv_incompatible(Field, Field) /data/src/10.4/sql/field_conv.cc:851:14
#11 0x16c062f in field_conv(Field, Field) /data/src/10.4/sql/field_conv.cc:864:10
#12 0x177566d in save_field_in_field(Field, bool, Field*, bool) /data/src/10.4/sql/item.cc:6561:8
#13 0x17978ea in Item_field::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6612:10
#14 0x10e5b94 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.4/sql/table.cc:8555:24
#15 0xa7633f in fill_record(THD, TABLE, List<Item>&, List<Item>&, bool, bool) /data/src/10.4/sql/sql_base.cc:8591:18
#16 0xa77253 in fill_record_n_invoke_before_triggers(THD, TABLE, List<Item>&, List<Item>&, bool, trg_event_type) /data/src/10.4/sql/sql_base.cc:8719:11
#17 0x1047907 in mysql_update(THD, TABLE_LIST, List<Item>&, List<Item>&, Item, unsigned int, st_order, unsigned long long, bool, unsigned long long, unsigned long long) /data/src/10.4/sql/sql_update.cc:1017:11
#18 0xc724fa in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4450:21
#19 0xc55486 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8011:18
#20 0xc4d787 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1873:7
#21 0xc57cb3 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378:17
#22 0x11d2205 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420:11
#23 0x11d1763 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316:3
#24 0x22f3d11 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869:3
#25 0x7ff1d6f42ea6 in start_thread nptl/pthread_create.c:477:8

previously allocated by thread T5 here:
#0 0x80f76d in malloc (/mnt8t/bld/10.4-asan/bin/mysqld+0x80f76d)
#1 0x32854b0 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118:28
#2 0x323e9df in my_malloc /data/src/10.4/mysys/my_malloc.c:101:10
#3 0xf64d72 in Binary_string::realloc_raw(unsigned long) /data/src/10.4/sql/sql_string.cc:101:32
#4 0x87aec3 in Binary_string::realloc(unsigned long) /data/src/10.4/sql/sql_string.h:625:9
#5 0xf667cd in Binary_string::copy() /data/src/10.4/sql/sql_string.cc:220:12
#6 0x16b4b6d in String::copy() /data/src/10.4/sql/sql_string.h:823:27
#7 0x16a9649 in Field_blob::store_field(Field*) /data/src/10.4/sql/field.h:3953:13
#8 0x16c0830 in field_conv_incompatible(Field, Field) /data/src/10.4/sql/field_conv.cc:851:14
#9 0x16c062f in field_conv(Field, Field) /data/src/10.4/sql/field_conv.cc:864:10
#10 0x177566d in save_field_in_field(Field, bool, Field*, bool) /data/src/10.4/sql/item.cc:6561:8
#11 0x17978ea in Item_field::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6612:10
#12 0x10e5b94 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.4/sql/table.cc:8555:24
#13 0x16fd7b9 in handler::ha_rnd_next(unsigned char*) /data/src/10.4/sql/handler.cc:2906:16
#14 0x1ca5062 in rr_sequential(READ_RECORD*) /data/src/10.4/sql/records.cc:485:35
#15 0xa2ac08 in READ_RECORD::read_record() /data/src/10.4/sql/records.h:70:30
#16 0x104751c in mysql_update(THD, TABLE_LIST, List<Item>&, List<Item>&, Item, unsigned int, st_order, unsigned long long, bool, unsigned long long, unsigned long long) /data/src/10.4/sql/sql_update.cc:1001:23
#17 0xc724fa in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4450:21
#18 0xc55486 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8011:18
#19 0xc4d787 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1873:7
#20 0xc57cb3 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378:17
#21 0x11d2205 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420:11
#22 0x11d1763 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316:3
#23 0x22f3d11 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869:3
#24 0x7ff1d6f42ea6 in start_thread nptl/pthread_create.c:477:8

Thread T5 created by T0 here:
#0 0x7fa19a in pthread_create (/mnt8t/bld/10.4-asan/bin/mysqld+0x7fa19a)
#1 0x22f9fb9 in spawn_thread_v1(unsigned int, unsigned long, pthread_attr_t const, void* ()(void), void*) /data/src/10.4/storage/perfschema/pfs.cc:1919:15
#2 0x84a79a in inline_mysql_thread_create(unsigned int, unsigned long, pthread_attr_t const, void* ()(void), void*) /data/src/10.4/include/mysql/psi/mysql_thread.h:1275:11
#3 0x85d363 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6280:15
#4 0x85deaa in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6350:3
#5 0x85ed0e in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6448:3
#6 0x85b702 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6606:5
#7 0x84eaa7 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5938:3
#8 0x841d11 in main /data/src/10.4/sql/main.cc:25:10
#9 0x7ff1d6ba3d09 in __libc_start_main csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free (/mnt8t/bld/10.4-asan/bin/mysqld+0x80ebc6) in __asan_memcpy
Shadow bytes around the buggy address:
0x0c187fffc220: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c187fffc230: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c187fffc240: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
0x0c187fffc250: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c187fffc260: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c187fffc270: fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa fa fa
0x0c187fffc280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
0x0c187fffc290: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c187fffc2a0: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
0x0c187fffc2b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c187fffc2c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==929408==ABORTING

With InnoDB --mysqld=--innodb --mysqld=--default-storage-engine=InnoDB:

==929547==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c00004e230 at pc 0x0000007ac2d6 bp 0x7f397a345920 sp 0x7f397a3450c8

READ of size 3 at 0x60c00004e230 thread T27

    #0 0x7ac2d5 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) (/mnt8t/bld/10.4-asan/bin/mysqld+0x7ac2d5)

    #1 0x7ac7ca in memcmp (/mnt8t/bld/10.4-asan/bin/mysqld+0x7ac7ca)

    #2 0x2442b17 in calc_row_difference(upd_t*, unsigned char const*, unsigned char const*, TABLE*, unsigned char*, unsigned long, row_prebuilt_t*, unsigned long&) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:8562:20

    #3 0x2440108 in ha_innobase::update_row(unsigned char const*, unsigned char const*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:8900:10

    #4 0x172a5ab in handler::ha_update_row(unsigned char const*, unsigned char const*) /data/src/10.4/sql/handler.cc:6834:3

    #5 0x1047e9c in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*) /data/src/10.4/sql/sql_update.cc:1082:31

    #6 0xc724fa in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4450:21

    #7 0xc55486 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8011:18

    #8 0xc4d787 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1873:7

    #9 0xc57cb3 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378:17

    #10 0x11d2205 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420:11

    #11 0x11d1763 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316:3

    #12 0x22f3d11 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869:3

    #13 0x7f3990d6bea6 in start_thread nptl/pthread_create.c:477:8

    #14 0x7f3990aa3dee in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x60c00004e230 is located 112 bytes inside of 124-byte region [0x60c00004e1c0,0x60c00004e23c)

freed by thread T27 here:

    #0 0x80f4ed in free (/mnt8t/bld/10.4-asan/bin/mysqld+0x80f4ed)

    #1 0x32864f7 in free_memory /data/src/10.4/mysys/safemalloc.c:279:3

    #2 0x328654d in sf_free /data/src/10.4/mysys/safemalloc.c:197:3

    #3 0x323ef5f in my_free /data/src/10.4/mysys/my_malloc.c:222:5

    #4 0x87ad25 in Binary_string::free() /data/src/10.4/sql/sql_string.h:610:7

    #5 0x8dfca3 in Binary_string::set(char const*, unsigned long) /data/src/10.4/sql/sql_string.h:467:5

    #6 0x8de0f9 in String::set(char const*, unsigned long, charset_info_st const*) /data/src/10.4/sql/sql_string.h:769:20

    #7 0x1664cf0 in Field_varstring::val_str(String*, String*) /data/src/10.4/sql/field.cc:7787:12

    #8 0x8aebcc in Field::val_str(String*) /data/src/10.4/sql/field.h:865:48

    #9 0x16a9520 in Field_blob::store_field(Field*) /data/src/10.4/sql/field.h:3950:11

    #10 0x16c0830 in field_conv_incompatible(Field*, Field*) /data/src/10.4/sql/field_conv.cc:851:14

    #11 0x16c062f in field_conv(Field*, Field*) /data/src/10.4/sql/field_conv.cc:864:10

    #12 0x177566d in save_field_in_field(Field*, bool*, Field*, bool) /data/src/10.4/sql/item.cc:6561:8

    #13 0x17978ea in Item_field::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6612:10

    #14 0x10e5b94 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.4/sql/table.cc:8555:24

    #15 0xa7633f in fill_record(THD*, TABLE*, List<Item>&, List<Item>&, bool, bool) /data/src/10.4/sql/sql_base.cc:8591:18

    #16 0xa77253 in fill_record_n_invoke_before_triggers(THD*, TABLE*, List<Item>&, List<Item>&, bool, trg_event_type) /data/src/10.4/sql/sql_base.cc:8719:11

    #17 0x1047907 in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*) /data/src/10.4/sql/sql_update.cc:1017:11

    #18 0xc724fa in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4450:21

    #19 0xc55486 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8011:18

    #20 0xc4d787 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1873:7

    #21 0xc57cb3 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378:17

    #22 0x11d2205 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420:11

    #23 0x11d1763 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316:3

    #24 0x22f3d11 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869:3

    #25 0x7f3990d6bea6 in start_thread nptl/pthread_create.c:477:8

previously allocated by thread T27 here:

    #0 0x80f76d in malloc (/mnt8t/bld/10.4-asan/bin/mysqld+0x80f76d)

    #1 0x32854b0 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118:28

    #2 0x323e9df in my_malloc /data/src/10.4/mysys/my_malloc.c:101:10

    #3 0xf64d72 in Binary_string::realloc_raw(unsigned long) /data/src/10.4/sql/sql_string.cc:101:32

    #4 0x87aec3 in Binary_string::realloc(unsigned long) /data/src/10.4/sql/sql_string.h:625:9

    #5 0xf667cd in Binary_string::copy() /data/src/10.4/sql/sql_string.cc:220:12

    #6 0x16b4b6d in String::copy() /data/src/10.4/sql/sql_string.h:823:27

    #7 0x16a9649 in Field_blob::store_field(Field*) /data/src/10.4/sql/field.h:3953:13

    #8 0x16c0830 in field_conv_incompatible(Field*, Field*) /data/src/10.4/sql/field_conv.cc:851:14

    #9 0x16c062f in field_conv(Field*, Field*) /data/src/10.4/sql/field_conv.cc:864:10

    #10 0x177566d in save_field_in_field(Field*, bool*, Field*, bool) /data/src/10.4/sql/item.cc:6561:8

    #11 0x17978ea in Item_field::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6612:10

    #12 0x10e5b94 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.4/sql/table.cc:8555:24

    #13 0x16fd7b9 in handler::ha_rnd_next(unsigned char*) /data/src/10.4/sql/handler.cc:2906:16

    #14 0x1ca5062 in rr_sequential(READ_RECORD*) /data/src/10.4/sql/records.cc:485:35

    #15 0xa2ac08 in READ_RECORD::read_record() /data/src/10.4/sql/records.h:70:30

    #16 0x104751c in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*) /data/src/10.4/sql/sql_update.cc:1001:23

    #17 0xc724fa in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4450:21

    #18 0xc55486 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8011:18

    #19 0xc4d787 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1873:7

    #20 0xc57cb3 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378:17

    #21 0x11d2205 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420:11

    #22 0x11d1763 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316:3

    #23 0x22f3d11 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869:3

    #24 0x7f3990d6bea6 in start_thread nptl/pthread_create.c:477:8

Thread T27 created by T0 here:

    #0 0x7fa19a in pthread_create (/mnt8t/bld/10.4-asan/bin/mysqld+0x7fa19a)

    #1 0x22f9fb9 in spawn_thread_v1(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.4/storage/perfschema/pfs.cc:1919:15

    #2 0x84a79a in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.4/include/mysql/psi/mysql_thread.h:1275:11

    #3 0x85d363 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6280:15

    #4 0x85deaa in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6350:3

    #5 0x85ed0e in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6448:3

    #6 0x85b702 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6606:5

    #7 0x84eaa7 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5938:3

    #8 0x841d11 in main /data/src/10.4/sql/main.cc:25:10

    #9 0x7f39909ccd09 in __libc_start_main csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free (/mnt8t/bld/10.4-asan/bin/mysqld+0x7ac2d5) in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)

Shadow bytes around the buggy address:

  0x0c1880001bf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c1880001c00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c1880001c10: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa

  0x0c1880001c20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c1880001c30: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

=>0x0c1880001c40: fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa fa fa

  0x0c1880001c50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04

  0x0c1880001c60: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00

  0x0c1880001c70: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa

  0x0c1880001c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c1880001c90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==929547==ABORTING

Reproducible on 10.4+ with MyISAM and InnoDB as above.
Not reproducible on 10.3.

Attachments

Activity

People

Assignee:: Nikita Malyavin

Reporter:: Elena Stepanova

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Dates

Created:: 2022-05-03 23:05

Updated:: 2024-03-21 15:32

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.