SIGSEGV's in spider_direct_sql_init_body, spider_direct_sql_body, my_hash_insert, thd_ha_data, thd_get_ha_data and safe_mutex_lock, heap-use-after-free in spider_direct_sql_body

CREATE FUNCTION spider_direct_sql RETURNS INT SONAME 'ha_spider.so';

SELECT spider_direct_sql ('SELECT * FROM s','a','srv "b"');

Core was generated by `/test/MD180223-mariadb-11.0.1-linux-x86_64-dbg/bin/mariadbd --no-defaults --cor'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x000015255cb023be in spider_direct_sql_body (initid=0x152510013a68, 

    args=0x152510013a28, is_null=<optimized out>, error=0x152510013a98 "", 

    bg=bg@entry=0 '\000')

    at /test/11.0_dbg/storage/spider/spd_direct_sql.cc:1516

1516	  if (!(direct_sql = (SPIDER_DIRECT_SQL *)

[Current thread is 1 (Thread 0x15255cbdd640 (LWP 2348034))]

(gdb) bt

#0  0x000015255cb023be in spider_direct_sql_body (initid=0x152510013a68, args=0x152510013a28, is_null=<optimized out>, error=0x152510013a98 "", bg=bg@entry=0 '\000') at /test/11.0_dbg/storage/spider/spd_direct_sql.cc:1516

#1  0x000015255cb02dbd in spider_direct_sql (initid=<optimized out>, args=<optimized out>, is_null=<optimized out>, error=<optimized out>) at /test/11.0_dbg/storage/spider/spd_udf.cc:29

#2  0x000055c3720494d7 in udf_handler::val_int (null_value=<synthetic pointer>, this=0x152510013a18) at /test/11.0_dbg/sql/sql_udf.h:108

#3  Item_func_udf_int::val_int (this=0x152510013968) at /test/11.0_dbg/sql/item_func.cc:3818

#4  0x000055c371ef1013 in Type_handler::Item_send_longlong (this=<optimized out>, item=0x152510013968, protocol=0x152510001368, buf=<optimized out>) at /test/11.0_dbg/sql/sql_type.cc:7496

#5  0x000055c371ef7889 in Type_handler_longlong::Item_send (this=<optimized out>, item=<optimized out>, protocol=<optimized out>, buf=<optimized out>) at /test/11.0_dbg/sql/sql_type.h:5765

#6  0x000055c371bcf5dc in Item::send (this=0x152510013968, protocol=0x152510001368, buffer=0x15255cbdaff0) at /test/11.0_dbg/sql/item.h:1235

#7  0x000055c371c050f9 in Protocol::send_result_set_row (this=this@entry=0x152510001368, row_items=row_items@entry=0x1525100134d0) at /test/11.0_dbg/sql/protocol.cc:1332

#8  0x000055c371c876d1 in select_send::send_data (this=0x152510014460, items=@0x1525100134d0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x152510013ae0, last = 0x152510013ae0, elements = 1}, <No data fields>}) at /test/11.0_dbg/sql/sql_class.cc:3102

#9  0x000055c371d76d15 in select_result_sink::send_data_with_check (sent=0, u=<optimized out>, items=<optimized out>, this=<optimized out>) at /test/11.0_dbg/sql/sql_class.h:5748

#10 JOIN::exec_inner (this=this@entry=0x152510014488) at /test/11.0_dbg/sql/sql_select.cc:4754

#11 0x000055c371d77be0 in JOIN::exec (this=this@entry=0x152510014488) at /test/11.0_dbg/sql/sql_select.cc:4666

#12 0x000055c371d75b18 in mysql_select (thd=thd@entry=0x152510000d58, tables=0x0, fields=@0x1525100134d0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x152510013ae0, last = 0x152510013ae0, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x152510014460, unit=0x152510004fa0, select_lex=0x152510013218) at /test/11.0_dbg/sql/sql_select.cc:5146

#13 0x000055c371d7628b in handle_select (thd=thd@entry=0x152510000d58, lex=lex@entry=0x152510004ec8, result=result@entry=0x152510014460, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/11.0_dbg/sql/sql_select.cc:608

#14 0x000055c371cdbe8d in execute_sqlcom_select (thd=thd@entry=0x152510000d58, all_tables=0x0) at /test/11.0_dbg/sql/sql_parse.cc:6267

#15 0x000055c371ce74af in mysql_execute_command (thd=thd@entry=0x152510000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/11.0_dbg/sql/sql_parse.cc:3949

#16 0x000055c371cee7cf in mysql_parse (thd=thd@entry=0x152510000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x15255cbdc2c0) at /test/11.0_dbg/sql/sql_parse.cc:8002

#17 0x000055c371cf0963 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x152510000d58, packet=packet@entry=0x15251000ae19 "", packet_length=packet_length@entry=58, blocking=blocking@entry=true) at /test/11.0_dbg/sql/sql_class.h:242

#18 0x000055c371cf27bc in do_command (thd=0x152510000d58, blocking=blocking@entry=true) at /test/11.0_dbg/sql/sql_parse.cc:1407

#19 0x000055c371e436e2 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55c3750d6b98, put_in_cache=put_in_cache@entry=true) at /test/11.0_dbg/sql/sql_connect.cc:1416

#20 0x000055c371e43941 in handle_one_connection (arg=0x55c3750d6b98) at /test/11.0_dbg/sql/sql_connect.cc:1318

#21 0x00001525760a3b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#22 0x0000152576135a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Core was generated by `/test/MD110223-mariadb-10.11.2-linux-x86_64-dbg/bin/mariadbd --no-defaults --co'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x000015104f0205f3 in spider_direct_sql_body (initid=0x15102c013a38, 

    args=0x15102c0139f8, is_null=<optimized out>, error=0x15102c013a68 "", 

    bg=bg@entry=0 '\000')

    at /test/10.11_dbg/storage/spider/spd_direct_sql.cc:1518

[Current thread is 1 (Thread 0x15104f0fc640 (LWP 2347983))]

(gdb) bt

#0  0x000015104f0205f3 in spider_direct_sql_body (initid=0x15102c013a38, args=0x15102c0139f8, is_null=<optimized out>, error=0x15102c013a68 "", bg=bg@entry=0 '\000') at /test/10.11_dbg/storage/spider/spd_direct_sql.cc:1518

#1  0x000015104f020ff2 in spider_direct_sql (initid=<optimized out>, args=<optimized out>, is_null=<optimized out>, error=<optimized out>) at /test/10.11_dbg/storage/spider/spd_udf.cc:29

#2  0x0000558917c18b07 in udf_handler::val_int (null_value=<synthetic pointer>, this=0x15102c0139e8) at /test/10.11_dbg/sql/sql_udf.h:108

#3  Item_func_udf_int::val_int (this=0x15102c013940) at /test/10.11_dbg/sql/item_func.cc:3818

#4  0x0000558917ac1e3f in Type_handler::Item_send_longlong (this=<optimized out>, item=0x15102c013940, protocol=0x15102c001368, buf=<optimized out>) at /test/10.11_dbg/sql/sql_type.cc:7496

#5  0x0000558917ac8649 in Type_handler_longlong::Item_send (this=<optimized out>, item=<optimized out>, protocol=<optimized out>, buf=<optimized out>) at /test/10.11_dbg/sql/sql_type.h:5769

#6  0x00005589177a937c in Item::send (this=0x15102c013940, protocol=0x15102c001368, buffer=0x15104f0f9ff0) at /test/10.11_dbg/sql/item.h:1235

#7  0x00005589177dd7bb in Protocol::send_result_set_row (this=this@entry=0x15102c001368, row_items=row_items@entry=0x15102c0134c0) at /test/10.11_dbg/sql/protocol.cc:1332

#8  0x0000558917860685 in select_send::send_data (this=0x15102c014428, items=@0x15102c0134c0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x15102c013ab0, last = 0x15102c013ab0, elements = 1}, <No data fields>}) at /test/10.11_dbg/sql/sql_class.cc:3103

#9  0x000055891794a92f in select_result_sink::send_data_with_check (sent=0, u=<optimized out>, items=<optimized out>, this=<optimized out>) at /test/10.11_dbg/sql/sql_class.h:5746

#10 JOIN::exec_inner (this=this@entry=0x15102c014450) at /test/10.11_dbg/sql/sql_select.cc:4699

#11 0x000055891794b7c8 in JOIN::exec (this=this@entry=0x15102c014450) at /test/10.11_dbg/sql/sql_select.cc:4611

#12 0x0000558917949731 in mysql_select (thd=thd@entry=0x15102c000d58, tables=0x0, fields=@0x15102c0134c0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x15102c013ab0, last = 0x15102c013ab0, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x15102c014428, unit=0x15102c004f98, select_lex=0x15102c013208) at /test/10.11_dbg/sql/sql_select.cc:5091

#13 0x0000558917949ea4 in handle_select (thd=thd@entry=0x15102c000d58, lex=lex@entry=0x15102c004ec0, result=result@entry=0x15102c014428, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.11_dbg/sql/sql_select.cc:581

#14 0x00005589178b4b69 in execute_sqlcom_select (thd=thd@entry=0x15102c000d58, all_tables=0x0) at /test/10.11_dbg/sql/sql_parse.cc:6267

#15 0x00005589178c016a in mysql_execute_command (thd=thd@entry=0x15102c000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:3949

#16 0x00005589178c7484 in mysql_parse (thd=thd@entry=0x15102c000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x15104f0fb2c0) at /test/10.11_dbg/sql/sql_parse.cc:8002

#17 0x00005589178c9618 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x15102c000d58, packet=packet@entry=0x15102c00ae09 "", packet_length=packet_length@entry=58, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:243

#18 0x00005589178cb471 in do_command (thd=0x15102c000d58, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407

#19 0x0000558917a1653a in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55891aaedb98, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416

#20 0x0000558917a16799 in handle_one_connection (arg=0x55891aaedb98) at /test/10.11_dbg/sql/sql_connect.cc:1318

#21 0x000015107f7f6b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#22 0x000015107f888a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Core was generated by `/test/MD110223-mariadb-10.3.38-linux-x86_64-opt/bin/mysqld --no-defaults --core'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  thd_ha_data (thd=0x14c3ec000c58, hton=0x0)

    at /test/10.3_opt/sql/sql_class.cc:423

[Current thread is 1 (Thread 0x14c4440cf640 (LWP 2348216))]

(gdb) bt

#0  thd_ha_data (thd=0x14c3ec000c58, hton=0x0) at /test/10.3_opt/sql/sql_class.cc:423

#1  0x00005595be7d166d in thd_get_ha_data (thd=<optimized out>, hton=<optimized out>) at /test/10.3_opt/sql/sql_class.cc:438

#2  0x000014c4218debb9 in spider_direct_sql_body (initid=0x14c3ec00f9d8, args=0x14c3ec00f998, is_null=<optimized out>, error=0x14c3ec00fa08 "", bg=<optimized out>) at /test/10.3_opt/storage/spider/spd_direct_sql.cc:1604

#3  0x00005595bea795de in udf_handler::val_int (null_value=<synthetic pointer>, this=<optimized out>) at /test/10.3_opt/sql/sql_udf.h:107

#4  udf_handler::val_int (null_value=<synthetic pointer>, this=0x14c3ec00f988) at /test/10.3_opt/sql/sql_udf.h:98

#5  Item_func_udf_int::val_int (this=0x14c3ec00f8c8) at /test/10.3_opt/sql/item_func.cc:3608

#6  0x00005595be95fb3d in Type_handler::Item_send_longlong (this=<optimized out>, item=0x14c3ec00f8c8, protocol=0x14c3ec0011b0, buf=<optimized out>) at /test/10.3_opt/sql/sql_type.cc:5454

#7  0x00005595be769fbe in Protocol::send_result_set_row (this=this@entry=0x14c3ec0011b0, row_items=row_items@entry=0x14c3ec0050b8) at /test/10.3_opt/sql/protocol.cc:1000

#8  0x00005595be7d8da7 in select_send::send_data (this=0x14c3ec00fb90, items=@0x14c3ec0050b8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14c3ec00fa50, last = 0x14c3ec00fa50, elements = 1}, <No data fields>}) at /test/10.3_opt/sql/sql_class.cc:3049

#9  0x00005595be87cc22 in JOIN::exec_inner (this=this@entry=0x14c3ec00fbb8) at /test/10.3_opt/sql/sql_select.cc:4065

#10 0x00005595be87d2b6 in JOIN::exec (this=this@entry=0x14c3ec00fbb8) at /test/10.3_opt/sql/sql_select.cc:3984

#11 0x00005595be87d446 in mysql_select (thd=0x14c3ec000c58, tables=<optimized out>, wild_num=0, fields=<optimized out>, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x14c3ec00fb90, unit=0x14c3ec0047b8, select_lex=0x14c3ec004f78) at /test/10.3_opt/sql/sql_select.cc:4393

#12 0x00005595be87dd43 in handle_select (thd=thd@entry=0x14c3ec000c58, lex=lex@entry=0x14c3ec0046f8, result=result@entry=0x14c3ec00fb90, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.3_opt/sql/sql_select.cc:372

#13 0x00005595be811d9d in execute_sqlcom_select (thd=0x14c3ec000c58, all_tables=0x0) at /test/10.3_opt/sql/sql_parse.cc:6340

#14 0x00005595be81f7cd in mysql_execute_command (thd=<optimized out>) at /test/10.3_opt/sql/sql_parse.cc:3871

#15 0x00005595be8221a2 in mysql_parse (thd=0x14c3ec000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.3_opt/sql/sql_parse.cc:7855

#16 0x00005595be8239e5 in dispatch_command (command=COM_QUERY, thd=0x14c3ec000c58, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.3_opt/sql/sql_parse.cc:1941

#17 0x00005595be825bae in do_command (thd=0x14c3ec000c58) at /test/10.3_opt/sql/sql_parse.cc:1398

#18 0x00005595be90867e in do_handle_one_connection (connect=<optimized out>) at /test/10.3_opt/sql/sql_connect.cc:1404

#19 0x00005595be9086fd in handle_one_connection (arg=<optimized out>) at /test/10.3_opt/sql/sql_connect.cc:1309

#20 0x000014c44813eb43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#21 0x000014c4481d0a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Core was generated by `/test/MD110223-mariadb-10.3.38-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  thd_ha_data (thd=0x149fe4000d38, hton=0x0)

    at /test/10.3_dbg/sql/sql_class.cc:423

[Current thread is 1 (Thread 0x14a0440ea640 (LWP 2348487))]

(gdb) bt

#0  thd_ha_data (thd=0x149fe4000d38, hton=0x0) at /test/10.3_dbg/sql/sql_class.cc:423

#1  0x000055557392a26b in thd_get_ha_data (thd=<optimized out>, hton=<optimized out>) at /test/10.3_dbg/sql/sql_class.cc:438

#2  0x000014a0219f5a1e in spider_direct_sql_body (initid=0x149fe4010e68, args=0x149fe4010e28, is_null=<optimized out>, error=0x149fe4010e98 "", bg=bg@entry=0 '\000') at /test/10.3_dbg/storage/spider/spd_direct_sql.cc:1604

#3  0x000014a0219f63ab in spider_direct_sql (initid=<optimized out>, args=<optimized out>, is_null=<optimized out>, error=<optimized out>) at /test/10.3_dbg/storage/spider/spd_udf.cc:29

#4  0x0000555573c511f7 in udf_handler::val_int (null_value=<synthetic pointer>, this=0x149fe4010e18) at /test/10.3_dbg/sql/sql_udf.h:107

#5  Item_func_udf_int::val_int (this=0x149fe4010d58) at /test/10.3_dbg/sql/item_func.cc:3608

#6  0x0000555573af9983 in Type_handler::Item_send_longlong (this=<optimized out>, item=0x149fe4010d58, protocol=0x149fe4001318, buf=<optimized out>) at /test/10.3_dbg/sql/sql_type.cc:5454

#7  0x0000555573afd62d in Type_handler_longlong::Item_send (this=<optimized out>, item=<optimized out>, protocol=<optimized out>, buf=<optimized out>) at /test/10.3_dbg/sql/sql_type.h:2498

#8  0x00005555738b7910 in Item::send (this=0x149fe4010d58, protocol=0x149fe4001318, buffer=0x14a0440e73a0) at /test/10.3_dbg/sql/item.h:886

#9  0x00005555738b55d4 in Protocol::send_result_set_row (this=this@entry=0x149fe4001318, row_items=row_items@entry=0x149fe4005358) at /test/10.3_dbg/sql/protocol.cc:1000

#10 0x000055557393308a in select_send::send_data (this=0x149fe4011020, items=@0x149fe4005358: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x149fe4010ee0, last = 0x149fe4010ee0, elements = 1}, <No data fields>}) at /test/10.3_dbg/sql/sql_class.cc:3049

#11 0x00005555739e870c in JOIN::exec_inner (this=this@entry=0x149fe4011048) at /test/10.3_dbg/sql/sql_select.cc:4065

#12 0x00005555739e9384 in JOIN::exec (this=this@entry=0x149fe4011048) at /test/10.3_dbg/sql/sql_select.cc:3984

#13 0x00005555739e9576 in mysql_select (thd=thd@entry=0x149fe4000d38, tables=0x0, wild_num=0, fields=@0x149fe4005358: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x149fe4010ee0, last = 0x149fe4010ee0, elements = 1}, <No data fields>}, conds=0x0, og_num=<optimized out>, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x149fe4011020, unit=0x149fe4004a58, select_lex=0x149fe4005218) at /test/10.3_dbg/sql/sql_select.cc:4393

#14 0x00005555739ea02b in handle_select (thd=thd@entry=0x149fe4000d38, lex=lex@entry=0x149fe4004998, result=result@entry=0x149fe4011020, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.3_dbg/sql/sql_select.cc:372

#15 0x0000555573973fd7 in execute_sqlcom_select (thd=thd@entry=0x149fe4000d38, all_tables=0x0) at /test/10.3_dbg/sql/sql_parse.cc:6340

#16 0x000055557397d9a1 in mysql_execute_command (thd=thd@entry=0x149fe4000d38) at /test/10.3_dbg/sql/sql_parse.cc:3871

#17 0x0000555573986694 in mysql_parse (thd=thd@entry=0x149fe4000d38, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14a0440e9510, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.3_dbg/sql/sql_parse.cc:7855

#18 0x0000555573988609 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x149fe4000d38, packet=packet@entry=0x149fe4018ae9 "", packet_length=packet_length@entry=58, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.3_dbg/sql/sql_class.h:200

#19 0x000055557398a5cf in do_command (thd=0x149fe4000d38) at /test/10.3_dbg/sql/sql_parse.cc:1398

#20 0x0000555573a8e01f in do_handle_one_connection (connect=<optimized out>) at /test/10.3_dbg/sql/sql_connect.cc:1404

#21 0x0000555573a8e150 in handle_one_connection (arg=<optimized out>) at /test/10.3_dbg/sql/sql_connect.cc:1309

#22 0x000014a0485a8b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#23 0x000014a04863aa00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

SIGSEGV|spider_direct_sql_body|spider_direct_sql|udf_handler::val_int|Item_func_udf_int::val_int

SIGSEGV|spider_direct_sql_body|udf_handler::val_int|udf_handler::val_int|Item_func_udf_int::val_int

SIGSEGV|thd_ha_data|thd_get_ha_data|spider_direct_sql_body|spider_direct_sql

SIGSEGV|thd_ha_data|thd_get_ha_data|spider_direct_sql_body|udf_handler::val_int