Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-29483

Heap-use-after-free (Binary_string::copy() at sql/sql_string.cc:250) reported by ASan

    XMLWordPrintable

Details

    Description

      Dear MariaDB developers,

      I am Zu-Ming Jiang, a PhD student at ETH Zurich. I used my new fuzzer to fuzz MariaDB and found a bug that can directly crashes MariaDB 10.10.1 server. The bug information is following:

      The installation process of MariaDB (debug mode, enable ASAN)

      cd mariadb-10.10.1
      mkdir build; cd build
      cmake .. -DCMAKE_BUILD_TYPE=Debug -DWITH_ASAN=ON
      make -j12 && sudo make install

      Reproduce process

      – step 1: set up MariaDB server and create a database named "testdb"
      /usr/local/mysql/bin/mysqld --basedir=/usr/local/mysql --datadir=/usr/local/mysql/data --plugin-dir=/usr/local/mysql/lib/plugin --user=mysql&
      /usr/local/mysql/bin/mysql -uroot
      mysql> create database testdb;

      – step2: trigger the bug
      /usr/local/mysql/bin/mysql --force -uroot -Dtestdb < mysql_bk.sql
      /usr/local/mysql/bin/mysql --force -uroot -Dtestdb < bug_trigger_stmt.sql

      Bug Information

      The bug-triggering files "mysql_bk.sql" and "bug_trigger_stmt.sql" is in the attached.

      The error report of MariaDB is in the attached file "bug_report.txt"

      Attachments

        1. bug_report.txt
          12 kB
          Zuming Jiang
        2. bug_trigger_stmt.sql
          0.6 kB
          Zuming Jiang
        3. mysql_bk.sql
          7 kB
          Zuming Jiang

        Activity

          People

            sanja Oleksandr Byelkin
            Zuming Jiang Zuming Jiang
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.